JH 122 Broke Mobile Access Rules

[israelfds95]

Note: This post is only intended to share an observation with the community. I have already rolled back from JH 122 because of this issue. If you are planning to install JH 122 and have Mobile Access policies in production, this information may be useful.

Environment

I upgraded a production cluster member from JH 91 to JH 122 (Latest) to evaluate the fixes included in the release, mainly because I am currently investigating an SD-WAN probes issue and JH 122 contains several relevant SD-WAN improvements.

Since JH 122 is the Latest Jumbo Hotfix, I decided to follow a conservative deployment strategy:

• Installed JH 122 only on Cluster Member 2 (Standby).
• Kept Cluster Member 1 running JH 91, which had been operating without issues.
• Performed a failover so the upgraded member became Active, allowing production validation while still having a rollback option.

Issue Observed

The following day, users started reporting problems with Mobile Access.

The customer has multiple Mobile Access rules that have been working reliably for many years. After the upgrade, these rules began generating unexpected drops, preventing legitimate traffic that had previously been allowed.

No policy changes had been performed other than the Jumbo Hotfix upgrade.

Rollback

To confirm whether the issue was related to the Jumbo Hotfix, I failed back to the gateway still running JH 91.

Immediately after the rollback:

• Mobile Access traffic returned to normal.
• The unexpected drops disappeared.
• No additional configuration changes were required.

Conclusion

Based on this validation, the behavior appears to be associated with JH 122 in this environment.

I have already removed JH 122 from production.

This JH 122 don't resolved my problems with SD-WAN probes, that I'm investigating with check point team.

Has anyone else experienced a similar issue with JH 122 affecting Mobile Access policies?

[Lau]

Hi,

I had the same issue occur when just upgrading the management server to JHF take 122 and the gates staying on 107 and installing the policy. I was able to resolve it by restarting the gateways and have since patched the gateways too. The issue has not occurred again for 3 days now.

Regards,

Lau

[genisis__]

So all your appliances are running JHFA122 and stable?  I heard JHFA122 could go recommended very soon, as many clients are waiting for this before implementation, subject to any reported issues.

[Lau]

Maybe 10 out of 100 gateways are running JHF 122. But all that have been patched are working so far. A few of these are running the mobile access portal with both MAB application rules and normal remote access client rules.

[genisis__]

Good to know.  Hopefully the Jumbo with move to recommended status soon then.

[Orel_Vanounou · Accepted solution]

This issue was further checked thanks to this post.

TAC will have it documented soon under a new SK 185259.

[genisis__]

sk185259 - After Jumbo Hotfix Upgrade Mobile Access rule stopped working