Is It Safe to Change SecureXL on a Cluster?

[RemoteUser]

Hi everyone,

Is it safe to modify the SecureXL mode on a Check Point clusterfor example, switching from UPPAK to KPPAK or vice versa?

Has anyone here made such changes in a production environment?

Are there any known limitations, side effects, or precautions we should be aware of before proceeding?

Thanks a lot in advance!

[the_rock]

I would NOT do that during work hours. I had one customer do it after hours and they did not report any issues. What seems to be the problem?

Andy

[RemoteUser]

hi bro

just out of curiosity

[the_rock]

Thats okay bud. If there is anything you want me to test in the lab, let me know.

Andy

[the_rock]

Good reference

https://community.checkpoint.com/t5/Security-Gateways/SecureXL-UPPAK-Mode-for-Lab/td-p/210731

[Chris_Atkinson]

What is the platform model and expansion cards, version / JHF in question?

Typically in a maintenance window do the standby member failover then do the other member.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_PerformanceTuning_AdminGuide/Conte...

[the_rock]

Hey bud,

I changed the mode in my lab cluster, will monitor and let you know if any issues. I have windows PC machine behind it, its doing ssl inspection as well, so will keep checking that as well.

Andy

[the_rock]

@RemoteUser 

I noticed by default in my R82 lab, mode was kernel, so changed it yesterday to user, rebooted, have not seen any issues.

Andy