Newly installed R80.20 gateways do not send logs to the R80.10 log server

[prisciltetchou]

Hello Mates, 

We have been introducing R80.20 appliances with the standards configuration. 

But they do not send logs to our R80.10 log server. 

Can R80.10 log server support R80.20 gateways? 

This is the first time I post a question here. 

Please let me know if you need more information. 

[Daniel_Taney]

It's always been my understanding the best practice is to ensure all your Management and Log Servers are running the same or newer version of Check Point software before introducing higher version Gateways into the environment. Is there any particular reason you can't upgrade the log server to R80.20?

[PhoneBoy]

Log Server generally must be same or higher version than gateways.
That said I know there are specific patches that enable management of gateways of a higher version.
What version of management in this case?

[Maarten_Sjouw]

It should work when at least Jumbo 167 has been installed.

[prisciltetchou]

This is the version of the management server. It is the same as the log server:

HOTFIX_R80_10_JUMBO_HF Take: 203

[prisciltetchou]

We planned to migrate all existing gateway from R77.30 to R80.20. 

To simplify our work, we decided to install new gateways in R80.20. 

The management server is also in R80.10 and it manages well those R80.20 gateways. 

[_Val_]

Did you install database on your log server after setting up R80.20 gateways? I suspect the logs are sent, but not shown/indexed

[prisciltetchou]

I just did that and it works!

Thank you for your help. 

Could you please explain me more what was the problem? 

[_Val_]

If installing the database helped, there was no problem. 

The log server was receiving and processing logs from the new GWs, but it was unable to interpret and show them, because it has had and old version of database where new GW objects did not exist. When deploying a new GW, always install database on a separate log server.

[prisciltetchou]

Hello, 

Sorry I am coming back with tis topic. 

Now I can see logs from the GWs but some columns are blank like the rule name column. 

I need to filter logs from rule's name but since it is blank, it makes it impossible for me. 

Please how could I do to make it appear? 

Thanks in advance for your help. 

[PhoneBoy]

If logs are coming across but you're not seeing all the data, this might be a bug and it'd be best to involve the TAC.

[rohan_savant]

We have r80.10 Management box supporting r80.20 gateways. All features except the Features new to r80.20 work fine including logging and all blades so it is definitely supported as long as you have JHF take 169 or above.