MDS R80.10 with SmartEvent R77.30 compatibility

[Vladimir]

Please advise if there are any downsides in upgrading MDS HA to R80.10 or R80.20.M1 if the SmartEvent server in this environment will remain on R77.30 (it was exempt from the upgrade for reasons unknown to me and the hardware is not capable of running R80.XX).

Thank you,

Vladimir

[Maarten_Sjouw]

The internal working of the R77.30 SE is quite different from the R80.XX and up versions. They added the SOLR database and access to the SmartEvent server in R80.XX is now directly through the SmartConsole via the management server. Actually is was a NGSE version that was a pre R80 version which started using the SOLR DB to store the logs.

In a R77.30 it made sense to build a SE server and a separate Correlation Unit server as the load on the SE server was a lot higher.

I do not think it will be supported while the other way around is supported.

Some things that have changed from 77 to 80 SE:

• In a multidomain environment you cannot buid a SE server in a domain context directly anymore.
• R80.10+ SE only has personal reports and schedules.
• R80+ SE uses the SOLR Database to store logs
• Correlation Units' work is much less performance impacting due to the use of the SOLR DB.

[Vladimir]

Maarten,

Thanks for the reply, but I cannot find any supporting information that would state that the target environment would not work. I suspect that this will be the case, but I have to substantiate my statements to the client.

While I am aware of the differences in architecture and limitations of SE R80.XX, I am not as intimately familiar with it to determine if R80.10 infrastructure cannot use R77.30 SE.

Do you happen to know if there are any SKs that I can use as a reference? I recall seeing the one for the opposite scenario you are referring to (R80.10 SE working with R77.30 environment). 

[Maarten_Sjouw]

No, sorry I cannot help you there, I think you will need to get a official response from Check Point to be usable towards your customer.

[Vladimir]

Thank you. Dameon Welch Abernathy‌, can you help to get a definitive word from CP on the subject (i.e. supported, unsupported, will prevent deployment of R80.XX altogether)? 

[PhoneBoy]

While you can use SmartEvent R80.x with R77.30 Management, I feel pretty confident in saying the reverse is not supported.

[Vladimir]

Dameon,

It very well may be the case, but what I am trying to figure out is if the presence of R77.30 SE in MDS HA environment will prevent its successful upgrade to R80.10 or R80.20.M1. I really need some kind of official CP statement or document to back it up or state that the SE R77.30 should be removed from the environment prior to the upgrade.

If it is not too much trouble, please forward this inquiry to your MDS team.

Thank you,

Vladimir 

[PhoneBoy]

Understand.

Let me get a definite answer.

[Vladimir]

Thank you!

[Yonatan_Philip]

If you have an R77.30 environment - MDS plus an SME server, it is up to you to decide which server you upgrade first.

You can upgrade the MDS first and leave the SME for a later date - the SME will not be fully functional during this transition period, but it won't impact your MDS server functionality.

I guess the downside is that your SME server is only partially functional - I wouldn't go as far as saying it's in an unsupported state, as it's supported. But the 'support' for any problem will be "Please upgrade your SME server".

This is the same situation for your MLM - a log server has to be in the same version of your management server, but it is an acceptable upgrade approach to start with your MDS server, test it, and then proceed with upgrading the rest of your environment.

It's an unstable but supported state. The behavior during the transition period will be unstable, but once you finish upgrading the rest of your environment things should go back to normal.

The main difference between MLM and SME is that your MLM should always be in the same version as your management while the SME also supports forward compatibility (since customers often, for various reasons, upgrade the SME before the rest of the environment).

HTH 

 Yonatan 

[Hugo_vd_Kooij]

Actually we have long held back on going to R80 except for SmartEvent.

We have upgraded most customers SmartEvent server to R80 or R80.10 while they still use R77.30 as SmartCenter.

If you fear that R80 is too heavy for SmartEvent machines I think you will find that R77.30 SmartEvent is too heavy for that hardware as well.

And I prefer virtual appliances for SmartCenter and SmartEvent as you can add more resource more easily most of the times

[Vladimir]

Agree with your approach completely. I am trying to keep the MDS guys on R77.30 for as long as possible, but some of them are getting restless and have taken the plunge with 5050s already.

It is, in general, hard to justify the costs associated with hardware management appliances under the best of circumstances. 

I'd be grateful if someone here will tell me what are the justifications for using those instead of virtualized management which offers portability, faster recovery and flexibility in resource allocation.

[Hugo_vd_Kooij]

Pricing is always a serious argument. (we're Dutch 😉

Some appliances are cheaper then just a license.