Read only / write mode switching in R80

[Vandana_Dubey]

Hi I am missing for restart in read only or write button in R80 that was in previous version. Can anyone help me about that? Sorry if I am repeating the question. I am new to checkmates.

[PhoneBoy]

There is no button to do this in R80 SmartConsole. However, it is possible to launch a second instance of SmartConsole from the same PC in Read Only mode (i.e. just launch SmartConsole again from the Start Menu).

[Vandana_Dubey]

Oh !!! Thank you so much to confirm

[Tomer_Sole · Accepted solution]

Hi Vandana, I also want to offer an alternative. The R7x SmartDashboard best practice of connecting with read-only and switching to write mode once the other admins have left, may not be as important in R80 and above.

With the new option of having multiple administrators writing at the same time, you may just connect with read-write permissions all the time. As long as you haven't published your changes, no one will be affected.

What do you think?

[Daniel_Morin]

Although I agree being in read-only mode isn't important to avoid admin contention, it is generally best practice with network management to remain in read-only mode so you can't make changes accidentally.

Therefore i would like to enter read-only mode when I do any exploring and switch to read-write only when I have changes to make or in the few cases where items you want to view are grayed out/inaccessible in read-only mode.

[Matthew-Dale]

I've started using the R80 console and I'm surprised to find this is missing. While only a minor feature it was useful to log in as read-only and have an easy way to switch to write mode and back again.

[Mark_Mitchell]

I second the read only method of working. I always connect to devices in read only mode when reviewing and information gathering. Only until a change is required will I launch in read write. 

Although not a big issue not having the button, it did save a couple of minutes and mouse clicks.  

I also think that having a mindset of read only helps new administrators gain their bearings on a live configursrion with the console in the comfort of knowing that they cannot accidently make any changes (until they are ready to).

[-N-]

I understand that CheckPoint wants me to use the new features, but I too would welcome a way to comfortably switch my session between read-write and read-only, so here is my 2¢:

It often happens that I need to make a quick change to policy and it would be really helpful if I could just glance the "status" of all admins and see if they "promise to make no changes" or if there is risk of them racing their publish against mine, because when that happens and they manage to publish before me, then I am pretty much forced to install their changes (and be the one responsible for breaking things). Unfortunately I often work with less experienced colleagues that sometimes publish changes that are, in fact, not complete, so I really, really do not like installing their changes, because then it will be ME responsible for THEIR breakage...

I tried to talk to my colleagues into closing SC when not needed, but starting SC is too slow to be done on demand. Switching between read-only and read-write now also requires a SC restart, making it even less practical.

Before HomeOffice I just asked everybody in the room to avoid publishing because I have a priority change to install, but now that does not work, renewing my need for this feature.

I second the idea that it is a good practice to browse logs in read-only mode and to switch to read-write only when needed.

[PhoneBoy]

Rather than quit and restart SmartConsole, just start another instance of it.
You can have one read only session in one instance and a read/write session in another, both with the same user logged in at the same time.
This should be possible from R80.20 onward.

Switching an existing session from read only to read-write is currently not possible and would require an RFE.

[TomasFy]

It IS A PROBLEM when using OT/2FA passwords like RSA or similar token. When you are logged in to a Mgmt server in RW from one machine and want to connect from another (not that uncommon in bigger environment), after authentication you are presented with message that your RW session is already active from other client and have two options:

1) Connect in RO more - works OK, but it's not what you need;

2) Click PROCEED button and (try to) take over the existing session.

Problem is with the second option because R80 Console will try to reconnect in RW mode using the same OT password second time, generating Authentication Failure message from Authentication Server, because OT password/passcode cannot be used more than once.

I have found no way to take over existing RW session in that circumstances.

Check Point - can you do something with this? It is in my opinion big disadvantage for enterprise users using OT/2FA for authentication.

[PhoneBoy]

Did you open a TAC case about this specific issue?

It sounds like a bug to me.

Also in R80.20, you can have multiple read-write sessions going, so you don't need to "take over" an existing session, you can just start a new one.