Cannot manage R82.10 (3920 appliance) with R82 Take 43 management

[metalhead]

Hi checkmates,

we try to connect our first cluster of 3920 appliances to our R82 management.

3920 appliances are running R82.10 Take 22

Management is running on R82 Take 43

We can successfully create a cluster object and join both members but I am not able to install a policy.

The management gives an error that cluster object version (which is set to 3900 appliance and R82.10) is different from the gateway version.

Cluster object screenshot and error message attached attached.

[Expert@management:0]# cpinfo -y all

This is Check Point CPinfo Build 914000250 for GAIA

[CPshared]

    HOTFIX_R82_JUMBO_HF_MAIN    Take: 43

[Expert@fw:0]# cpinfo -y all

This is Check Point CPinfo Build 914000219 for GAIA

[CPshared]

    HOTFIX_R82_10_JUMBO_HF_T271_MAIN    Take: 22

Any help appreciated. Case already open but they claim I cannot manage a R82.10 gateway with my R82 Management ...

Regards Thomas

[emmap]

OK, so TAC are wrong there, you may need to escalate the case. 

Second, have you make sure that you have the latest R82 SmartConsole? You need Build 1053 or higher.

[metalhead]

Yes I know they are wrong 🙂
SmartConsole build is 1057

I just cannot imagine that this is a general issue with the new R81.20 release ...

[Wolfgang]

@metalhead Did you a fetch of the gateways properties (interfaces, version etc.) we had a similar problem in the past with a gateway which has newer version installed then SMS. We configured the version in SmartConsole manual and policy install does not work with the same error messages. After a new successfully fetch from the gateway, the same version was shown in SmartConsole as configured manual. But then, policy install was succesfull.

[metalhead]

Hi Wolfgang,

thanks for your help.

We completely rebuild the cluster object in Smartconsole and only did a topology fetch. It pulled version 82.10 and set appliance modell to 3900. Then you can immediately see it complaining.

I wonder if anyone already successfully attached a R81.20 cluster to a R82 management.

[Chris_Atkinson]

Others are indeed using these gateways as clusters e.g.

https://community.checkpoint.com/t5/Security-Gateways/ClusterXl-issue-on-3920-82-10/m-p/263084#M5161...

[metalhead · Accepted solution]

So together with TAC we figured out the solution.

With 3900 appliances the gateway version in the gateway cluster object is set automatically to R82.10 but in the background/database it is set to R82. That´s why we got the errors on version mismatch.

The solution was to open the gateway cluster object and despite the fact that version is already set to R82.10 correctly RE-SELECT R82.10 and save the object. That seems to save the correct version to the database.

Regards Thomas

[the_rock]

O wow, very interesting solution, but glad it worked!

[Marianne136855]

Thanks - I had the same problem and your method fixed it!

I was very worried because both of these seem to suggest R82 cannot manage R82.10 - which is of course not true!

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_RN/Content/Topics-RN/Supported-Sec...

https://support.checkpoint.com/results/sk/sk113113

[Robin_H]

Saved our day! Not fixed in Take 44.
Edit: Or SmartConsole B1062, whichever is the source of the problem.