KEX parameters when upgrading R82 --> R82.10 with Blink

[Alex-]

I've upgraded an SMS with Blink to R82.10 from R82 and the sntrup761x25519 KEX method is not available, either in Web UI or CLI, even after reboot.

Another log server was set up from scratch with R82.10 and the option there is present.

Upgraded server:

SERVER> show version all
Product version Check Point Gaia R82.10
OS build 467
OS kernel version 5.14.0-427.13.1cpx86_64
OS edition 64-bit
SERVER> show ssh server kex supported
--------------------------------
supported kex:
--------------------------------
curve25519-sha256
[email protected]
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
--------------------------------

New server:

NEWSERVER> show version all
Product version Check Point Gaia R82.10
OS build 467
OS kernel version 5.14.0-427.13.1cpx86_64
OS edition 64-bit
NEWSERVER> show ssh server kex supported
--------------------------------
supported kex:
--------------------------------
curve25519-sha256
[email protected]
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
[email protected]
--------------------------------

[Chris_Atkinson]

Sounds familiar / similar to this discussion note the dbset cmds mentioned by @Bob_Zimmerman 

https://community.checkpoint.com/t5/AI-Network-Firewall/Identical-R82-10-GWs-with-different-options-...

[Alex-]

OK.

R82.10 is still rough around the edges. At one point of the CPUSE upgrade of the SMS, I got redirected to the Blink install page, making me wonder if I actually clicked on Clean install instead of Upgrade when I was sure I did so. Then it continued on its own and finished the upgrade.

Anyway, for customers who'll care about sntrup out of the box, I'll go with advanced upgrade.