topic Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800 in Spark Firewall (SMB)

Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800 spl

Luis1980 — Fri, 23 Dec 2022 10:50:44 GMT

I need help.

I have to change an old appliance model 12000 with gaia R80.40, which its policies are under the MGMT at R80.40. The new appliance is a model 1800 with Gaia R80.20 that is supported by the MGMT, I need help in the steps to follow to change from one model to another, how to integrate the policies. In the new model I have replicated the configuration of interfaces and static routes. But I need to know what else I have to do before changing the cables from one to another.

Thank you.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Chris_Atkinson — Fri, 23 Dec 2022 12:59:14 GMT

Note there was a similar discussion recently here regarding this uncommon scenario:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/Use-Policy-for-a-12400-with-a-new-SMB-Cluster/td-p/164821

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 08:48:28 GMT

thanks, But I see that in the end, nothing is said about how to do it.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

G_W_Albrecht — Tue, 27 Dec 2022 08:58:56 GMT

Let me explain it this way: Usually, customers change from Embedded SMB appliances to bigger GAiA appliances, but not the other way 😊.

Here, you just have to check the old policy for SMB limitations (see SKs) and change the IPS configs for the smaller HW footprint.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

_Val_ — Tue, 27 Dec 2022 09:11:26 GMT

Cluster or a single appliance?

Mind, 12000 has much more firepower than 1800, so there might be issues with performance.

If you reviewed your policy and found no limitations mentioned in sk178604, then here is how you proceed.

- replicate topology with interfaces and IP addresses identical to your old FW

- disconnect the old FW

- connect new appliance

- in SmartConsole, change FW object to be Spark, adjust GW version, reset and re-establish SIC, push policy

- check traffic flow and other functionalities.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 09:08:52 GMT

Can you explain more about this? Or can you provide me with some SK.
Apart from the policies, I would have to carry out the SIC of the new appliances with the MGMT.

Thankss

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

_Val_ — Tue, 27 Dec 2022 09:10:45 GMT

Yes, you will have to re-establish SIC

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 09:17:27 GMT

It is not a cluster, I have 2 appliances but in standlone.
What do you mean by push politics?

I had also thought about creating a new object and using it for the new FW, what do you think of this idea?

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

_Val_ — Tue, 27 Dec 2022 09:39:21 GMT

How new are you to Check Point? Push policy means applying your Security policy package to your Security gateway.

You can create a new object, but it will have the same management IP address as the old FW, so there will be a conflict.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 09:52:55 GMT

I've been using checkpoint for a few years, but I've never made a change from old FW or new ones.

Are you referring to installing policies?

Thank you for your answers.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

G_W_Albrecht — Tue, 27 Dec 2022 10:13:37 GMT

The procedure would be rather simple if you do replace a GAiA appliance with a newer GAiA appliance. SMB units are basically not intended as a 12000 replacement but for SMBs 8)

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

_Val_ — Tue, 27 Dec 2022 10:34:51 GMT

yes

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 10:52:21 GMT

I am only using the old FW blades firewall, IPSec VPN and IPS, that's why I thought to go down to a lower model, because they are for a backup center.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Tue, 27 Dec 2022 14:39:35 GMT

I understand that the sic configuration is the same as with another fw checkpoint?

And I have to follow these steps

Open the command line interface on the Security Gateway.
Run:
cpconfig
Enter the number for Secure Internal Communication and press Enter.
Enter y to confirm.
Enter and confirm the activation key.
When done, enter the number for Exit.
Wait for Check Point processes to stop and automatically restart.

In SmartConsole:

In the General Properties window of the Security Gateway, click Communication.
In the Trusted Communication window, enter the one-time password (activation key) that you entered on the Security Gateway.
Click Initialize.
Wait for the Certificate State field to show Trust established.
Click OK.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Wed, 28 Dec 2022 08:54:29 GMT

Thank you very much for all your answers.

So these are the steps I'm going to take.

I will try with the management interface of the equipment, the configuration of the old FW has already been replicated, to the new FW.

Will I have to change the name of this interface in the topoly? Since in the new FW the name is LAN1 and in the old one it is eth1.

I will change the name in the platform, hardaware, operating system version, I will then perform the SIC with the MGMT, I understand that it is done the same as in any FW checkpoint.

Push policies.

And I will test traffic and functionalities.

If all goes well I will connect the rest of the interfaces.

Do you think there may be any addictional problem?

Or do you think I'm missing a step.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

_Val_ — Wed, 28 Dec 2022 09:19:00 GMT

Yes, the interface names are not the same, so you will need to adjust them in the topology tab. Initializing SIC is a bit different as well, please follow the documentation.

Once more, you need to make sure that the performance of your new 1800 appliance is enough for your needs.

Another important note, I believe you will have to use R81.10 or a higher version of your management server to manage the 1800 appliance.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

G_W_Albrecht — Wed, 28 Dec 2022 09:34:07 GMT

Better update interfaces and topology from SMB as found here: https://sc1.checkpoint.com/documents/SMB_R81.10.00/AdminGuides/Centrally_Managed/EN/Topics/Configuring-Gateway-and-Cluster-Objects.htm?TocPath=Small-scale%20Deployment%20Installation%7C_____1

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Wed, 28 Dec 2022 09:46:51 GMT

According to the information I found, R80.40 is compatible.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

G_W_Albrecht — Wed, 28 Dec 2022 09:54:00 GMT

This is for the older firmware versions R80.20.xx that have end of support in Oct-23, and end of support for R80.40 is January 2024.

Re: Replacement of the checkpoint 12000 r80.40 model, associated with an R80.40 console, by the 1800

Luis1980 — Wed, 28 Dec 2022 10:03:06 GMT

don't understand your answer. According to the documentation found if it is compatible with an MGMT with R80.40 version

Management

1600 and 1800 Security Gateways are conveniently managed locally via a Web interface (offering simple and intuitive management and configuration), and centrally by Cloud-hosted SMP (Security Management Portal) which can scale to manage over 10,000 Check Point SMB Appliances. The Gateways can also be managed centrally by Check Point's central management solutions: SmartConsole, MDM, and LSM.

You can manage 1600 / 1800 Quantum Spark Appliances with these on-premises Management Servers:

R81 and higher versions
R80.40 Jumbo Hotfix Accumulator Take 91 and higher
R80.30 Jumbo Hotfix Accumulator Take 227 and higher