target version does not support Network Group objects that contain inner groups with Data Center obj

[flachance]

Running the R82 Security management Verify Update on a management server running R81.20 JHF Take 113.

I'm getting this message: 

The target version does not support 'Network Group' objects that contain inner groups with 'Data Center Objects'. The following 'Network Group' objects contain inner groups with 'Data Center Objects': PROD_Remote_access_domain

The PROD_Remote_access_domain contains network objects and a group object containing updatable objects such as Office365 Worldwide Services.

Are updatable objects considered Data Center objects?

Is there a way around this? 

thanks

Francis

[the_rock]

Hey @flachance 

Would you mind send a screenshot? I can certainly test this in the R82 lab Tuesday and see if we can find a workaround.

Andy

[flachance]

This is the group that is within another group that creates the issue. 

[the_rock]

Give me some time, will check later.

Andy

[the_rock]

Just tested, same issue.

[flachance]

thanks for confirming. I guess I'll be contacting TAC

[the_rock]

Keep us posted.

Cheers,

Andy

[PhoneBoy]

There is an SK about Data Center Objects not being supported in groups: https://support.checkpoint.com/results/sk/sk167210 
However, Updatable Objects are completely different.

I would open a TAC case here.

[frankcar]

Sorry to ask if answered, but for this error
The target version does not support 'Network Group' objects that contain inner groups with 'Data Center Objects'. The following 'Network Group' objects contain inner groups with 'Data Center Objects': PROD_Remote_access_domain

can we just upgrade our management server to R82 ? or would we need to do the gateways also ? as we are VSX/Maestro and we had a lot of trouble just doing jumbo updates etc in passed and from reading doing in place upgrade for R82 on GW and MGMT you dont get any of the new improvements from reading. hopefully we can just upgrade the manager to get this functionality of using datacenter objects in network groups is my question ? 

Thanks

Frank

[the_rock]

I will try it later in my R82 lab to confirm and update you.

Andy

[the_rock]

My lab:

R82 mgmt

R82 smart event server

R82 single gw

R81.20 cluster

Tested, worked fine, no errors when pushing policy.

Andy

[frankcar]

Hi Andy,

Nice one appreciate the testing, so rules work for you ? what we found is was as able to add it to one group but not nested that group within another group and the rule installed fine, user reported traffic not working in logs showed blocked so we for now created static object to allow this.

Thanks for testing, my works not been able to provide any lab for any testing for us 🙂

Thanks

Frank

[the_rock]

Happy to do remote if you allow that. If not, please send a screenshot of EXACTLY how you have it and whats fialing and I can reproduce. Its better break the lab than anyone's production. Not that I dont care if my lab breaks (I kind of do, since its good lab), but no one would lose sleep over it if it happened lol

Andy

[the_rock]

Yes, to answer your question, rules do work : )

Andy

[flachance · Accepted solution]

So the solution from TAC is to remove the group, perform the update and recreate the group.

Looks like Updatable objects are not supported in network group in R81.20 (Updatable Objects). I didn't know that and we've been doing it with no issues (at least no apparent issues) so it's a bit strange. Anyway it is now supported in R82 (sk181129 - Check Point Quantum R82 Resolved Issues and Enhancements - PMTR-37712) and they provided a way for us to do the upgrade so all is good.

[the_rock]

Hm...my lab is all R82 and I did that today and it did not work at all.

Andy