topic Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA in Spark Firewall (SMB)

R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Thu, 30 Jun 2022 16:33:12 GMT

We are happy to announce the release of R81.10 for Quantum spark 1500\1600\1800 Appliances

With the release of our new Quantum Spark R81.10 version, Check Point introduces code alignment between our Quantum Spark product line with the Quantum R81.10 Security Gateway release.

This major Quantum Spark release adds many new capabilities, as well as a wide range of stability and performance improvements.

This release supports locally managed only (Local + SMP). Centrally managed is supported at EA level.

Enhancement and New Features (Locally Managed)

Improve and Simplify SSL inspection operation

Some network devices do not support installation of an SSL certificate, therefore making SSL inspection not possible.
When you use the gateway capability to automatically sense and identify network elements, you can now select on which network element SSL inspection is enabled.
Gateway administrators have full control on which network elements SSL inspection will operate:

Desktops and laptop are automatically selected, and other network devices can be easily added.
You can also select bypassing inspection on MacOS devices.

Smart Accel – (EA level)

Improves gateway performance by accelerating low risk traffic sources:

Video streaming (Netflix, YouTube, Spotify)
Well known corporate services (Microsoft, Google, Apple, Check Point Services)
Social Media services (Facebook, Tiktok)
Web Conferences (Skype, WebEx, Zoom)

Password Complexity

Set password complexity as high to harden the Gateway Admin Password
Password length, number of different characters, Password history, Password Expiration

Updatable objects and FQDN in the Rule Base

Use fully qualified domain name (FQDN) object in the Access Policy.

VoIP improvements

Enable bidirectional traffic with the SIP provider service when SIP traffic inspection is disabled.

VPN Monitoring

New information was added to the VPN tunnels monitoring page

Support Radius 2.0 server
FTP AV - Inspect FTP protocol by Anti-Virus Software Blade
ZScaler (VPN 3rd party) support
Mirror port

Allows duplicating all the traffic that goes through one or more LAN ports, into one of the other LAN ports.

TCPDump via WebUI

Additional capabilities for TCPdump tool. Includes additional filters, custom filter and RT output.

Notes:

The Quantum Spark R81.10 release is supported only on the new 1500\1600\1800 Series Security Gateways.
Embedded Gaia software inherits its code base from the R81.10 GA version of enterprise appliances. Therefore, although not specifically mentioned, the R81.10 Quantum Spark Gateways inherit all maintrain limitations (see sk170418).
As the majority of R&D efforts will now shift to R81.10 code base, we encourage our customers to start evaluating and migrating to the new code base
R80.20.xx code base for 1500\1600\1800 Series Security Gateways will continue to be supported, in the near future – with further releases, and in the medium term – with stability, performance and bug fixes only

For additional info, please refer to sk179004

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

G_W_Albrecht — Fri, 01 Jul 2022 07:28:20 GMT

No identity collector support yet ?

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Ruan_Kotze — Fri, 01 Jul 2022 09:14:04 GMT

First thing that I noticed was lack of Identity Collector support:-(

Something else that is also not clear is whether central management is supported for Spark 1500's running R81.10. Management release notes only mention 1600 and up.

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

G_W_Albrecht — Fri, 01 Jul 2022 10:21:29 GMT

Look above:

This release supports locally managed only (Local + SMP). Centrally managed is supported at EA level.

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Fri, 01 Jul 2022 11:26:12 GMT

Identity collector is supported for centrally managed appliances.

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Sat, 23 Jul 2022 20:43:09 GMT

1.Identity collector is supported for centrally managed appliances.

2.The firmware released support centrally managed, we just didn't have enough EA coverage , so it was released for the time being as EA.

To centrally managed R81.10.00 you will need MGMT R81.10 + JHF55 or R81.10 + JHF66, or R81.20

thanks

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Douglas_Chenjer — Wed, 06 Jul 2022 06:56:28 GMT

The feedback a bit confusing, release notes says locally managed SMBs. So i cant test the new gaia embedded if my SMBs are centrally managed say on SMS with R81.10 or better (with latest HFA)????

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

G_W_Albrecht — Wed, 06 Jul 2022 07:02:21 GMT

What is R81.10 JHF 5 ? I only know of

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

G_W_Albrecht — Wed, 06 Jul 2022 07:03:30 GMT

Yes, you can - write a personal note to @Amir_Ayalon !

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Douglas_Chenjer — Wed, 06 Jul 2022 07:09:28 GMT

Have you tested this already?. Putting R81.10.10 on an SMB which is Centrally managed?

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

G_W_Albrecht — Tue, 12 Jul 2022 11:50:08 GMT

No - i only have one 1500, locally managed and in production, so no way...

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

cgubesch — Mon, 25 Jul 2022 04:50:24 GMT

Hey @Amir_Ayalon,

we are trying to test R81.10.00 Centrally Managed and we are facing some issues.
Maybe you could help us out.
We have 2x1600 SMB Appliances and have set them up as a cluster with R80.20.35
We are trying to upgrade the cluster to R81.10.00 but we are unable to install the policy via the management afterwards.
we got the following error:

We run our security management server on R81.10 JHF66 and changed the version of our 1600 SMB Cluster Object to R1.10.
Another strange thing that we noticed during troubleshooting: We rebooted our appliances with R81.10.00 installed and after the reboot the version reverted to R80.20.35 again.

Are you or anyone here familiar with those issues? (Or can someone help with the EA deployment of centrally managed SMB Appliances?)
Help is much appreciated.

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Chris_Atkinson — Fri, 22 Jul 2022 12:24:25 GMT

Typo?

Management should be R81.10 JHF T55 or higher to manage the 1600 upgraded to R81.10.00 (currently this is EA status)

Does the issue persists if you resolve the issue with the rules using time objects?

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

MikeH — Fri, 22 Jul 2022 15:06:58 GMT

Are you running the EA code? Central management is not supported in this GA release.

"This release supports locally managed only (Local + SMP). Centrally managed is supported at EA level."

See sk179004

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

cgubesch — Fri, 22 Jul 2022 17:14:16 GMT

yes typo sorry my bad.

I meant R81.10 JHF66..

I am not sure what issue you are refering to with the time objects. Can xou clarify?

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

cgubesch — Fri, 22 Jul 2022 17:15:52 GMT

Do I need another software package for the EA features? I only found the one from the official sk and assumed that it includes the EA features for the central management.

Please clarify.

Thanks in advance

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Sat, 23 Jul 2022 20:35:22 GMT

Yes,

sorry for the confusion.

you are correct.

you need MT R81.10 JHF take 66 that supports LSM+SMC

MT R81.10 JHF take 55 supports only SMC

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Sat, 23 Jul 2022 20:38:23 GMT

no, the same firmware (r81.10.00) that was released support both locally and centrally managed,

we simply decided to GA only locally as we didn't have enough EA coverage for centrally managed.

QA coverage is the same for both locally and centrally managed.

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Amir_Ayalon — Sat, 23 Jul 2022 20:41:03 GMT

Hi,

As i remember there was a bug in JHF 55 that you can't upgrade SMB cluster (R81.10.00). you need to manually upgrade each member.

this bug was resolved in JHF 66 .

if this is what you encounter in JHF 66 - please drop me an email. amiray@checkpoint.com

Re: R81.10.00 for Quantum spark 1500\1600\1800 Appliances - GA

Chris_Atkinson — Sun, 24 Jul 2022 02:01:06 GMT

The error message you posted shows a warning about time objects amongst other things.