Installation order JHF

[Dave]

So while i was away from work for 2 weeks, someone patched our firewall cluster (R81.10) with the latest JHF without installing this JHF on the SMS server.

How bad is this in regards to which inconsistency or issues that can happen? 

Can i just continue to install the JHF on the SMS without risk, or do i need to take some things into account?

[Chris_Atkinson]

Whilst not recommended it should be fine for JHFs in most scenarios. 

[Dave]

Hi Chris,

Thanks for letting know, but i wonder what the potential downside of this scenario could be.

Can you maybe explain a little bit?

[Chris_Atkinson]

Would depend on the inclusions in a particular JHF but I wouldn't make a habit of doing it in this order, especially if the difference in JHF level is significant.

More generally it likely comes down to compatibility testing, mandating the order somewhat limits the amount of testing needed and hence reduces the potential for issues if that order is adhered to logically.

[Lesley]

What take is on the SMS? I always make them the same version. Sometimes there are few days in between and never got an issue. Maybe if you have a plain R81.20 without jumbo it could cause an issue if you upgrade only gateways.

On otherhand I know some people never update SMS and only fw (what I don't recommend).

[Bob_Zimmerman]

While all members of a cluster should run the same jumbo (except when you're actively updating the cluster), there's no real dependency between jumbo on the management and jumbo on the firewalls. I've even had some managements stuck at R81.10 with firewalls at R81.20 for a few years. This is a supported configuration.

[Chris_Atkinson]

Supported for/between select major versions as documented and with limitations like not being able to use features of the newer version.

[Tomer_Noy]

It's perfectly fine to install a JHF on a gateway before the Management. There is no dependency, unless one is specifically stated for using a specific feature.

Often, customers might install a JHF on a specific gateway to resolve some issue, and it's not mandatory to install that JHF on the Management.

We do recommend to install JHFs regularly on the Management to get periodic important fixes, but that's unrelated to the JHF on the gateway.

The below post is from a while back, but explains things pretty well:
https://community.checkpoint.com/t5/Management/Management-JHF-Did-You-Know/m-p/56880