Check Point R80.40 has been released!

[Danny]

Release Date and Take	January 2020, Take 394
Release Home page	sk160736 (Release Notes)
Additional Links	R80.40 Resolved Issues | R80.40 Known Limitations | Releases Terminology | Release Map | Upgrade Map
Downloads	SmartConsole R80.40 (Portable) | R80.40 Clean Install .iso | R80.40 Install and Upgrade .iso
Release Highlights	SmartTasks automates daily work with pre-defined or customizable actions Dedicated HTTPS policy layer preventing encrypted traffic from Gen V attacks Zero-touch deployment from hours to minutes for installing new gateways IoT Security Manager identify IoT devices and seamlessly turn their attributes into IoT security policy

R80.40 SKs:

• Domain Migration in R80.40
• TLS FATAL ALERT log message received
• After defining and publishing the IoT discovery service controller, no Threat Prevention profile is ...

[Joshua · Accepted solution]

Finally! This is great. 

[G_W_Albrecht]

Nice ! I will install at after the second GA Jumbo is ready...

[Martin_Valenta]

I have exactly same strategy! 🙂

[Jerry]

seems that 4-cores appliances aren't supported ... 😞 but I do agree, 2 JHF is that's release 1st shoot for us 🙂

[HeikoAnkenbrand · Accepted solution]

I had the R80.40 EA running in the LAB. It had made a stabel impression. But I would also wait for the first JHF.

There are great new functions built in. Nice!!!

[mdjmcnally]

From the known limitations.

Migrating more than one Domain at a time is not supported.

I presume that this is basically the same as always been and that where have VSX where the Base Cluster in one Domain and then VS in other Domains, so that would export each Domain 1 at a time and then import one at a time afterwards then start once all imported.

Same as always been with the VSX.

[Dennis_M]

Great, thank you Check Point!!

[JozkoMrkvicka]

Thumb up that Check Point included latest CPUSE agent (1848) and cpinfo (914000202) in default R80.40 ISO 🙂

[JozkoMrkvicka]

... thumb down

I do have R80.40 EA version installed...

[_Val_]

Uninstall EA version and put GA back on. Or, use portable SmartConsole, if you need both in parallel. 

[Nurit_Gr]

Hi Jozko,

Thank you for posting this.

We are aware of this painful issue and are currently working on an updateable SmartConsole.

I hope we will have a positive update on that in the upcoming months.

[Sigbjorn]

Upgraded my 3100 appliance at home, looks good, but upgrade took ~4 hours (Standalone deployment), so make sure the wife has plans before upgrading at home 😎

[Jerry]

have had the same scenario, did the upgrade of my 2x5600's but before I've made her a list of shopping things 😛 when she was off like 3h I did the cluster upg. all went quite well except ... I've learnt that these days you really rather do that via clish/bash rather than webUI via Chrome 🙂

[Paul_Hagyard]

The R80.40 blink image linked to in sk120193 for management (blink_image_1.1_Check_Point_R80.40_T294_SecurityManagement.tgz) says it is for clean install only when imported into cpuse. When will there be a blink image for upgrade purposes? I haven't checked the gateway image.

[_Val_]

Blink-based upgrades are part of the road map but are not yet available. 

Currently blink images are for clean install only.

[Dov_Fraivert]

Hi Paul.

GW Blink package for R80.40 allows both upgrade and clean installation.
MGMT Blink package for R80.40 allows clean Installation only.

[Christoph]

Can anyone comment on the status of local Threat Emulation Gateways with R80.40?

It looks like we and other people on checkmates run into a problem with the download of images:

"Error: Threat Emulation update failed, cannot download Hps Ready Image file for Win10 64b,Office 2016,Adobe DC. Got empty list of available files from download center, and we expected to get files in this type of update."

[Alexander_Kim]

Hi, Christoph.

TE is not yet supported with R80.40 for local emulation. It is fully supported with R80.40 gateways sending the files to TE cloud.

Local emulation on R80.40 will be supported in Q2.

Cheers,

Kim

[GrilledCarpet]

Can an r80.40 gateway send files to an internal r80.30 threat emulation appliance ?

[_Val_]

yes

[Paul_Hagyard]

Having upgrade issues in a lab environment (so can't raise a SR). Trying to do a migrate_server export and import onto another freshly installed SC (first time configuration has completed successfully).

SC has Internet access and retrieved the latest update agent:

fwmgr> show installer status
Agent: Enabled
Build number: 1865 (agent build is up to date)
Network connection: connected
Update from cloud: Last updated on Fri Feb 28 16:24:32 2020
License: Valid
fwmgr>

However, the server cannot find the upgrade tools version despite sk135172 saying it should update automatically:

[Expert@fwmgr:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1
Failed to find the value
[Expert@fwmgr:0]#

Downloaded the R80.40 upgrade tools package manually from sk135172 and confirmed the checksum.

Import fails through both web UI and clish as it cannot find the current version:

fwmgr> installer import local /var/log/tmp/ngm_upgrade_wrapper_994000246_1.tgz
Preparing package for import. This operation might take a few moments
Note: The selected package will be copied into CPUSE repository
Info: Initiating import and install of ngm_upgrade_wrapper_994000246_1.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Install of package ngm_upgrade_wrapper_994000246_1.tgz Failed
Cannot detect the version of the installed upgrade tools.
fwmgr>

So I can't run the import because it thinks the R80.40 tools are not installed, and I cannot manually install the tools because it thinks the R80.40 tools are not installed...

Reinstall the new SC machine and try again?!

[Paul_Hagyard]

Reboot after applying the license fixed it:

fwmgr> [Expert@fwmgr:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1
994000246
[Expert@fwmgr:0]#

No need to manually import the upgrade tools.