Endpoint Security VPN Version vs. Build Numbers vs. Windows/MacOS Version

[00071491]

Hello,

In regards to the recent VPN Clients failing to work after 2021-1-1 (sk171213), I did some digging to find the VPN Build Numbers article (sk102150).  This SK is a great resource, but the one critical thing it doesn't list is Windows/MacOS version numbers alongside of the CP Client Version/Build Numbers. 

Example:  CP Client version E84.20 has a Client build number of 84.20.6108.  From within Windows 10 Programs and Features, it lists E84.20 as version 98.61.2210.  I don't have a Mac to test with, so I can't confirm how it looks from the OS X point of view.

It would be very helpful for those of us with asset tracking systems such as SCCM/PDQ/Etc to find unsupported client versions listed in sk171213.  Unsure what CP employee/dept needs to see this ( @tomerli ?) , but if CheckPoint could update sk102150 with the Windows/MacOS version numbers in another column I think that would solve some of the confusion.  There was older post I came across which had a similar concern: https://community.checkpoint.com/t5/Endpoint-Security-Products/Endpoint-E82-00-quot-about-quot-versi...

If there's a good way to determine the Windows/MacOS version that will be unsupported, please share.

Thank you.

Rory

[G_W_Albrecht]

If i understand it correctly, the version has to be at least R81.20. Should that not be enough ?

[00071491]

Hi, thank you for the reply.  In most cases that would be fine, but we have 450 laptops and we are trying to be proactive.  The hope is to eliminate 50+ people calling into our Help Desk when they resume work on Jan 4th at 8am.  Most staff are still working from home.  Our Inventory software, like many others, report back the version listed in Windows' Programs and Features, which appears to be a 98.xx.xxxx format.  Is there any documentation as to what Windows version 81.20 is within Programs and Features?

Side questions, is there an Auto-update feature for the VPN Clients?  Maybe I missed something in that regard where I can have version control at the gateway level.  

[jgar · Accepted solution]

Hi,

here's a table that I made, correlating the "E8x.xx" version number with the build number reported by inventory tools.
My guess is that the build number is different, depending whether you install the client in "Checkpoint Mobile" mode, or in "Endpoint Security" mode, for instance.
Numbers below are for the "Mobile" install mode.

Also keep in mind that Mobile & Securemote installs are NOT affected by the issue in sk171213 (that wasn't crystal clear in the initial wording of the kb).

version	build
E80.60	98.60.276
E80.61	98.60.320
E80.62	98.60.452
E80.64	98.60.729
E80.65	98.60.810
E80.70	98.60.1031
E80.71	98.60.3013
E80.72	98.60.5008
E80.80	98.60.5503
E80.81	98.60.5615
E80.82	98.60.6012
E80.83	98.60.7010
E80.84	98.60.8010
E80.85	98.60.8506
E80.86	98.60.9016
E80.87	98.60.9514
E80.88	98.61.1
E80.89	98.61.58
E80.90	98.61.112
E80.92	98.61.175
E80.96	98.61.303
E81.00	98.61.516
E81.10	98.61.611
E81.20	98.61.672
E81.30	98.61.800
E81.40	98.61.1004
E82.00	98.61.1104
E82.10	98.61.1215
E82.20	98.61.1311
E82.30	98.61.1404
E82.40	98.61.1507
E82.50	98.61.1607
E83.00	98.61.1703
E83.10	98.61.1816
E83.20	98.61.1909
E83.30	98.61.2001
E84.00	98.61.2002
E84.10	98.61.2116
E84.20	98.61.2210
E84.30	98.61.2307

[_Val_]

Thank you for your feedback. We are now updating the SK, it will have all the mentioned info very soon.

[00071491]

Hi @_Val_, any word on when sk102150 will be updated?  I've been referencing back to jgar's post here due to a few of our machines 'disconnecting on lock' as outlined in sk170854.  Thank you for your time.

[joses]

Can this be provided on a public URL and be kept up to date??  We are trying to automate packaging of CheckPoint Windows MSI client and without the version we can detect the application is installed correctly. Adding the Windows build number would be great value to allow that automation.

[_Val_]

We already have that reference, actually even two: sk107255 & sk117536

[joses]

Hi Val, sorry i meant to reply on Jgar post.

On the links you shared i couldn't find anywhere that in example Version E84.60 = MSI Version 98.61.267

Is that available anywhere or its just me that couldnt find it??

Thanks

[joses]

Hi Val,  do you guys have that information anywhere?

Thanks and sorry for bringing it up again.

[_Val_]

I quite do not understand the task at hands. Why do you need builds numbers if you already have versions? What is the purpose?

[00071491]

Hi Val, at least for me, the version number that shows up in Windows' Programs and Features is what I'm looking for and created the post about.  e.g. 98.61.2307 for E84.30.  The CheckPoint version E84.30 with Client Build Number of 84.30.6614 are not very helpful when it comes to Software Inventory applications such as Microsoft SCCM, PDQ Inventory, Solarwinds, etc. as they only use the version number that's inside of Programs and Features.  That is where the big need comes in.

[joses]

For the exact same reason explained above.  We have an automation solution that will check checkpoint releases and when there is a new version available it will download, package and deploy that to many customers (which use checkpoint vpn).

Part of the deployment is the software detection, which is based on the version thats ends up on Add/Remove programs (aka ProductVersion of the MSI).

Without that information and can check, download and package but the deployment does not work automatically because i dont know how to detect the software after the silent instalation happens.

Please let me know if that is not clear enough. (sometimes different names like build, version, productversion get mixed up and cause confusion).

Thanks

[_Val_]

@00071491 & @jgar fair enough, I understand the inventory argument. I will ask the responsible team internally whether this is something they can do.

However, from my own personal point of view, you the automatic deployment idea is not the best practice. Before you decide to deploy a new version of your VPN clients, there should be a cycle of lab tests. Endpoint version management is a delicate thing, and you may want to ensure 100% functionality after update, especially with combination of your MGMT and GWs, which, I believe, you do not update with every new release Check Point makes available, but just form time to time.

Once more, simple RSS subscription for SecureKnowledge feed and lookup on the mentioned SKs would ensure situation when you do have info about newer EPS version availability, although without build number, at this point.

[joses]

Thanks Val,

Will wait for your response once you know more.

[_Val_]

Nothing yet, sorry. Will update when/if I have something.

[_Val_]

Okay, here is one SK you wanted to see: sk102150

@joses, @00071491 @jgar let me know if you need more

[00071491]

Hi, I haven’t seen the OS version listed in any SK articles yet, but you should be able to reference jgar’s reply to get a somewhat up to date list. It’s only few versions old as of this writing, but maybe become dated in the coming months. 

[G_W_Albrecht]

How about the newer versions ?

[00071491]

Great, thank you for that list and also adding to the SK.  Much appreciated.

[G_W_Albrecht]

For SmartEndpoint admins, we now additionally have How to fix and check, with Compliance blade, that you have a safe or patched version for the Endpoin... !