cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Re: Check Point R80.20 Now GA

Open a support case for this, TAC will provide you with a solution, thanks

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

Hi,

can you please share more info of which problems you had with SXL so we will be able to assist?

0 Kudos

Re: Check Point R80.20 Now GA

I have rollback to R80.10 and the problem disappear completely (unfortunately I couldn't wait for TAC cause it was prod sys). But let me resume the problem:

After upgrade to R80.20 Connection problems started with more focus on UDP (many DNS problems), from the the DNS servers I started to see many UDP bad traffic, like:

[bad udp cksum 0x6cda -> 0xf65b!] 36502*

Even some TCP connection started to have some problems, but TCP wasn't big problem cause the re-transmission worked most of the time, but not on UDP. After disable SecureXL (fwaccel off -a) all started working as normal, no issues.

I don't have output's to provide (show...), the time was running against to me Smiley Sad

0 Kudos

Re: Check Point R80.20 Now GA

Did you have SXL disabled on R80.10?

0 Kudos

Re: Check Point R80.20 Now GA

SecureXL on R80.10 is active.

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

can you share more about GW configuration? 

do you have NAT enabled on those connections?

is the GW configured as Proxy?

which blades are enabled?

0 Kudos

Re: Check Point R80.20 Now GA

Hope this can still help:

With R80.10:

Accelerator Status : on
Accept Templates   : enabled
Drop Templates     : disabled
NAT Templates      : disabled by user
NMR Templates      : enabled
NMT Templates      : enabled

Accelerator Features : Accounting, NAT, Cryptography, Routing,
                       HasClock, Templates, Synchronous, IdleDetection,
                       Sequencing, TcpStateDetect, AutoExpire,
                       DelayedNotif, TcpStateDetectV2, CPLS, McastRouting,
                       WireMode, DropTemplates, NatTemplates,
                       Streaming, MultiFW, AntiSpoofing, Nac,
                       ViolationStats, AsychronicNotif, ERDOS,
                       McastRoutingV2, NMR, NMT, NAT64, GTPAcceleration,
                       SCTPAcceleration
Cryptography Features : Tunnel, UDPEncapsulation, MD5, SHA1, NULL,
                        3DES, DES, CAST, CAST-40, AES-128, AES-256,
                        ESP, LinkSelection, DynamicVPN, NatTraversal,
                        EncRouting, AES-XCBC, SHA256

With R80.20:

+-----------------------------------------------------------------------------+
|Id|Name |Status     |Interfaces               |Features                      |
+-----------------------------------------------------------------------------+
|0 |SND  |enabled    |xxxxxxxxx      |Acceleration,Cryptography     |
|  |     |           |                         |Crypto: Tunnel,UDPEncap,MD5,  |
|  |     |           |                         |SHA1,NULL,3DES,DES,CAST,      |
|  |     |           |                         |CAST-40,AES-128,AES-256,ESP,  |
|  |     |           |                         |LinkSelection,DynamicVPN,     |
|  |     |           |                         |NatTraversal,AES-XCBC,SHA256  |
+-----------------------------------------------------------------------------+

Accept Templates : enabled
Drop Templates   : disabled
NAT Templates    : enabled

The only difference I see is NAT templates (on R80.10 is disabled and on R80.20 Enabled).

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

can you share output of enabled_blades from R80.10?

0 Kudos

Re: Check Point R80.20 Now GA

Just want to throw out there that I've worked around my limitations of PPPoE devices and now on standard ethernet. I think I've narrowed down my issues to IPv6 SXL - the 6in4 tunnel interface isn't showing in SXL, so I believe it's not being accelerated. Assuming this is still a limitation, traffic between accelerated and non-accelerated interfaces?

Clearly still having issues with SXL, although I have a workaround (thanks Valeri) frustrating there's no way out of the box of disabling it.

0 Kudos

Re: Check Point R80.20 Now GA

Hi, the following command options are still listed for cp_conf sxl - disable / enable

Command Line Interface R80.20 Reference Guide 

Are you sure it does not work in your case?

0 Kudos

Re: Check Point R80.20 Now GA

Certain. It spat back out the list of available commands and ignored my input.

0 Kudos

Re: Check Point R80.20 Now GA

Understood, thanks. We need to fix the documentation ASAP

Employee+
Employee+

Re: Check Point R80.20 Now GA

Hi Daniel,

 In R80.20 due to new Architecture of SXL there is no option to disable SXL permanently but from our lab testing we can say that PPPoE working as expected in R80.20 meaning that all traffic passing through such interface will be F2F, .

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

Just like R80x main change was mgmt archtecture, the big architectural change in R80.20 is in the XL ellemented:


- SXL limitations removed 

- high end code integrated to main train - clustering code unified, scalable ppk integrated, etc 

- Revised slow path and medium/fast path so that accelerator software code and the code running on hardware acceleration card, is the same code 

This is why you can do actions like monitoring accelerated packets and no sxl disable during  install policy. 

The flip side is that sxl is “built in” and no longer “optional” (finally :-), if i may add). 


Re: Check Point R80.20 Now GA

Understood - as long as the documentation is updated to reflect that then great Smiley Happy

Little frustrating the gateway guide suggests that it can be disabled though, unless that's referring to the EA version of R80.20 gateway.

Or is that something likely to come back with the upgraded kernel? Sounds like it's been integrated into the kernel at a lower level.

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

Daniel, can you please share the guide you saw that indicated this is supported -  i would like to take a look at it and fix if necessary

Thanks

Uri

0 Kudos

Re: Check Point R80.20 Now GA

Apologies, I've only just seen this - can't find it now, so must be a good sign!

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

It does not exist from cpconfig or cp_conf .

I'm using R80.20 SA on my VM

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

Hi Danile

With R80.20 SXL is always on, as stated in the SecureXL chapter in the admin guide.

0 Kudos
JozkoMrkvicka
Platinum

Re: Check Point R80.20 Now GA

Why there is no option to stop/start specific CMA from R80.20 SmartConsole MDS level like it was possible on R77.30 ?

Kind regards,
Jozko Mrkvicka
0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

R80 architecture is more efficient resource wise so fully stopping one cma without stopping the mds is not possible (for example they share database components). 


0 Kudos

Re: Check Point R80.20 Now GA

To add to Dorit's comment - we are familiar with cases in which in R80.10 some specific domains are unresponsive. These cases exist because we still have individual FWM processes per domain for few operations, and problems happened due to those individual processes. We are considering to add the option to reset these processes from the GUI to our next releases.

Those were very specific cases though - if it happened to you as well (in R80.10, not R7x), please open support tickets so that we can have it documented.

0 Kudos
JozkoMrkvicka
Platinum

Re: Check Point R80.20 Now GA

Yes, I faced the situation that I was not able to log into specific CMA from R80.20 MDS.

Solved by "mdsstop/start_customer" command from CLI. Unfortunately, I didnt gather more info about the error Smiley Sad I will revert back once happened again.

Kind regards,
Jozko Mrkvicka
0 Kudos
phlrnnr
Silver

Re: Check Point R80.20 Now GA

What are the main reasons for implementing ccp unicast mode?  Are these the first steps towards being able to have a cluster spread across several datacenters without the need for layer 2 connectivity? 

0 Kudos
JozkoMrkvicka
Platinum

Re: Check Point R80.20 Now GA

Multicast mode was in R77 as default CCP mode. You was supposed to change it to broadcast using Expert command. In R80.20 you can do it using clish.

Unicast is the new CCP mode introduced in R80.20.

The new is also automatic selection of CCP mode (automatic). Maybe some logic behind this would be great Smiley Happy

Selecting the CCP Transport Mode on the Cluster Members 

Kind regards,
Jozko Mrkvicka
0 Kudos
Admin
Admin

Re: Check Point R80.20 Now GA

None of the public cloud providers support Multicast or Broadcast, thus a different mode was needed.

We've actually supported CCP Unicast for a while now with CloudGuard, which is the primary use case.

You still need to have some Layer 2 connectivity since the packets are sent to a MAC address.

You're also limited to 2-node clusters in this mode.

Re: Check Point R80.20 Now GA

did R80.20 just get pulled from CPUSE? 

one minute these were available 

11  R80.20 Fresh Install and Upgrade for Security

        Gateway and Stand Alone                       Available for Download

12  R80.20 Fresh Install and Upgrade for Security

        Management                                    Available for Download

the next moment they are gone ?

:0> installer download 11

Info: Initiating download of Check_Point_R80.20_T101_Fresh_Install_and_Upgrade_Security_Gateway.tgz...

Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)

Result: File not found on Check Point Cloud. Refresh the CPUSE page and try again.

0 Kudos
Admin
Admin

Re: Check Point R80.20 Now GA

To the best of my knowledge, we are not offering R80.20 via CPUSE at the moment.

More specifically, it shouldn't show up by default unless you've added the identifier manually

0 Kudos
Employee+
Employee+

Re: Check Point R80.20 Now GA

Indeed, we recommend R80.20 to everyone that is looking for new functionality but if you are on R77x and dont look for the latest, R80.10 is. the default and the “safe” selection with very high usage. 

We already got 1000 and more customers that started to use R80.20 because they liked the new functionality and the initial feedback from those  that elected to use it, is very good. Feel free to continue and give more feedbacks on checkmates. 

We continue to watch the telemetry and look for large and deep variance of usage. When we will see enough complex elective usage, we will advise that everyone should consider upgrade and make it visible in cpuse. 

Until that point, those that do elect to use it, can easily proactively add it and use it, and many of you did and doing - thank you!

This way, we dont “bother” customers with releases and when they “see” it, we already advise them for action. Hopefully, our proactiveness, lets you focus the operational energy and helps you manage your tradeoffs.  


Re: Check Point R80.20 Now GA

Please, can you help me? On the link

https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Installation_and_Upgrade_...

in the Important session - Before you upgrade to Security Gateway: step 5 - Schedule a full maintenance window to make sure you can make all desired custom configurations again after the upgrade. The upgrade process replaces all existing files with default files. If you have custom configurations on the Security Gateway, they are lost during the upgrade. As a result, different issues can occur in the upgraded Security Gateway. In the upgrade via CPUSE are the gateway settings (interfaces, routes, policies, passwords ...) lost? Which steps to perform in more detail?

0 Kudos