Issues with R81 Jumbo Take 34

[genisis__]

Thought I would bring this to the communities attention. 

We have an R81 SMS installation which currently has Jumbo HFA29 installed.  Jumbo HFA34 was release roughly 3 weeks ago.  Therefore thought I would implement the new Jumbo.

I then uninstall JHFA29 and installed JHFA34 on the SMS, after I attempted to install the security policy but this failed with the following error:

"Policy installation failed on gateway. If the problem persists contact Checkpoint support (Error Code: 2000232)"

Checked the KB and found the following two SKs:

SK172484
SK154435

Both solutions did not resolve my issue. At this point I raised a TAC case and provide a cpinfo file, due the SLA response time TAC could not get back to me quickly enough and I had to rollback to JHFA29.

TAC came back to me saying a number of customers had reported this type of issue, but in most cases the workarounds indicated in  the SK's worked.  In my case this was going to be escalated to R&D.

I then suggested to TAC that if people have seen issues with this ongoing take, that Checkpoint should be pulling the Jumbo from the site.

in summary - I hope Checkpoint pull Take 34 until the issue is correctly resolved, and I totally appreciate this is an ongoing take. 

[RamGuy239 · Accepted solution]

Hi, @genisis__ 

I'm pretty sure I got this very same message after installing R81 Take 34 on our own management managing R81 gateways. It was solved by first doing a policy push without acceleration.

You can do this by simply right-clicking when you are about to push a policy and select to not use accelerated policy push for the installation. After doing this once, policy push has worked ever since.

Since then I've done an advanced upgrade to R81.10 so sadly I can't go back and verify if it was indeed 2000232 that was showing up. But we for sure got an error when trying to push policy after updating to Take 34 so I simply tried a push without acceleration and it worked.

You can use my attached screenshot as reference.

[genisis__]

Thanks - when I next attempt this, will give that a go, if this does resolve the issue, then the SKs should also be updated to reflect this as an option to try.

The TAC engineer did not indicate this as a solution so I'm wondering if the issue I faced is different.

[genisis__]

Just tried your suggestion and this worked! I will update the TAC case and ask them to also update the SK.

[RamGuy239]

Really glad I could be of assistance. I've found R81 to be quite stable and good but I've had my struggles with accelerated policy push. Luckily I have yet to encounter any of these accelerated policy issues on R81.10 thus far.

[genisis__]

That's positive news for R81.10,  I will likely migrate to this very soon.

[the_rock]

I know there was a solution to this, so apologies for my reply, but I just wanted to say I had a customer once with exact same issue back in R80.40 and they were told case was escalated to R&D, but at the end, custom fix had to be installed. Its unfortunate that these things are not better tested before releasing to customers.

[genisis__]

I agree.

[RamGuy239]

To be fair. R81 Take 34 was an "ongoing" jumbo hotfix. I would prefer to have no bugs, obviously but going with ongoing releases you have to take into consideration that they have yet to pass the same quality assurances as a GA jumbo hotfix.

[MatanYanay]

Hi @the_rock

Can you please share with me the custom fix was provided for your customer on top of R80.40

I would like to check if its already part of our JHF version and if not we will try to push it into the JHF version

Thanks 

Matan. 

[the_rock]

Hi Matan,

I really cant recall now the name, but it was some custom fix on top of R80.40 take 102 (I THINK) that was related to invalid SPIs...