R81.10 EA Program | Production

[Tsvika_Akerman]

Welcome to Check Point’s Cyber Security Platform R81.10, the industry’s most advanced Threat Prevention and security management software that delivers uncompromising simplicity and consolidation across the enterprise. Whether it is deploying the latest technologies and security to protect the organization or expertly crafting security policies, R81.10 enables enterprises to be their best. Now with the newest version, R81.10 delivers feature parity with Check Point Maestro, in addition, the Scalable Platform software delivers the option to mix and match security gateways in the same Security Group to maximize cost-efficiency. R81.10 introduces the ability to automatically update the Smart Console with the latest fixes and improvements all while accelerating the administrator's daily operations. R81.10 enhances Infinity Threat Prevention, the industry’s first autonomous Threat Prevention system that provides fast, self-driven policy creation and one-click security profiles keeping policies always up to date. Policies are installed in seconds, upgrades require only one click, and Quantum gateways can be simultaneously upgraded in minutes.

Enrollment | Production EA

 Early Availability Production Programs let you experience and participate in shaping Check Point products by test driving pre-release versions and providing detailed feedback.

Enroll Now: https://www.surveymonkey.com/r/cp-ea-r81-10-enrollment

Following the enrollment survey submission, we will contact you in order to review the details, answer questions and agree on the process.

Additional questions? contact us@ EA_SUPPORT@checkpoint.com

New in this release

 Quantum Security Gateway and Gaia

Quantum Maestro Hyperscale*

•        Mix appliances - The ability to include different appliance models in the same Security Group.
•        Maestro Orchestrator is aligned with the latest version as part of the main-train release and includes the latest Gaia fixes and improvements.
•        All VPN functionality is now supported:
  •        Route Based VPN.
  •        Permanent Tunnels.
  •        Link Selection Load Sharing.
  •        Service Based Link Selection.
  •        Route-based probing for Link Selection.
  •        Back-to-back tunnels (hub and spokes).
  •        Dynamic Routing through VPN tunnels.
  •        Identity Awareness through VPN tunnels.
  •        Members’ local connections through VPN tunnels.

VSX

Configure Bridge and Multi-Bridge interfaces on a regular Virtual Systems not in Bridge Mode to use features that require an IP address to work, such as Identity Awareness, Threat Emulation, UserCheck Web Portal and Captive Portal.

IPsec VPN

VPN performance enhancements -
Site to Site VPN and Remote Access clients
are now handled by two different processes.

Access Control

Enhance security by setting default values to Access Rules when the last object in a rule’s cell is removed.

Advanced Routing

•        IPv4 PIM enhancements. and stability fixes.
•        Ability to clear OSPF error counters.
•        OSPFv2 Graceful Restart with ClusterXL.
•        Static Multicast Forwarding.
•        Support for different ECMP algorithms.

ISP Redundancy

Support up to 10 ISP links.

Quantum Security Management

Security Management Servers enchantments

•        Infallible Management Login - Improved stability of the log-in process to the Management server using SmartConsole or Management API, when the Server is under load.
•        Significant improvements for the stability and performance of the Security Management Server, especially for large Management environments under high load:
  •         Admin operations to the Security Management Server such as backup and restore, and revisions purge are drastically faster.
  •        Faster Management API functions execution.
  •         Search and navigate in SmartConsole is smoother when concurrent SmartConsole administrators are connected

Management REST API

•        New export, import, and upgrade Management APIs for primary Security Management Servers or Multi-Domain Servers.
•        Unified Management API commands for server export and import, Domain backup and migration.
•        SmartLSM - REST API commands to simplify the creation of ROBO Gateways.

SmartConsole

Automatic updates - SmartConsole detects and installs client updates for the same major version.

Logging and Monitoring

•        IPS and Anti-Bot logs now include a MITRE ATT&CK section that details the different techniques for malicious attack attempts. This Section provides an easier way to understand an attack by looking at the log card and to export the data to external SIEM systems, and an easy search and filter for attack events based on MITRE techniques.
•        Dynamic logs distribution - Configure the Security Gateway to distribute logs between the active Log Servers to reduce CPU and Disk utilization.
•        Enhancement to logging services stability.

CloudGuard Controller

•        Use AWS Security Token Service (STS) Assume Role to simplify the access to AWS Data Centers.
•        Support all Microsoft Azure Data Center locations.

Management High Availability

•        Synchronization and stability enhancements.
•        Significant Full sync duration improvement.

Multi-Domain Server

IoT support for Multi-Domain Security Management.

SmartLSM

Use group object, Multiple IP addresses and IP ranges in LSM profiles

Endpoint Security VPN

•        Endpoint Security Web Management enhancements to allow the configuration of:
  •        Media Encryption & Port Protection policy
  •        Firewall policy
  •        Application Controlpolicy
  •        Developer protection policy

Push Operation for Host Isolation and Client Uninstall

*Quantum Maestro Hyperscale - Will not be part of R81.10 EA program

[HristoGrigorov]

I am about to migrate our prod. SMS from R80.40 to R81 and although I don't want to bind in any "bloody  engagement contract" I will try to provide feedback if something goes terribly wrong. So, whish me good luck... 😉

[Evan_Gillette]

Is it fair to assume that this statement
"Maestro Orchestrator is aligned with the latest version as part of the main-train release and includes the latest Gaia fixes and improvements."

implies Maestro will support things like generic data center objects? That is listed as a limitation of r81sp

[PhoneBoy]

This is referring to the software image that runs on the orchestrator itself, which I believe is currently on R80.20SP. 
There may be some Maestro-specific limitations (though we are working to remove them).

[Tal_Ben_Avraham]

@Evan_Gillette  - as @PhoneBoy  mentioned, This is another step to the complete unification (integrating MHO code into main-train). Now MHO and GW (SGM) is part of main releases and will be included in all main-releases. However, though this doesn't mean all features will be supported for SP (please keep following limitation notes), you can expect all gaps/limitations to be reduced significantly in each new version.

In addition, all new features/capabilities are expected to be supported for SP.

[Douglas_Araujo]

For the ISP Redundancy section, will be any other enhancement on this feature or only support for 10 ISP's?

Because only increasing the number of ISP's without any other enhacement (set link priority based on application, set routing through one specific ISP in a simple way - without PBR, monitor link quality - latency, jitter, available bandwith), will continue to be a poor feature in the solution.

And, at least for me, it will continue to be a "not recommended for use" when I meet a customer that wants to use ISP redundancy with Check Point.

[Magnus-Holmberg]

Within Dorits roadmap there was some pictures on SDWAN like features where things like link quality, cost etc was included.
Not sure in what release it will be included, but it seams to be on the roadmap atleast 🙂

Regards,
Magnus

[Garrett_DirSec]

I've been working with local CP partner engineer on the SD-WAN specifics.   the info I learned is now months old.

I was the guy who Dorit addressed the topic of buying SD-WAN company or develop in-house during CPX 2021 (Americas). 

• develop in-house
• target # sites ~~ 30
• public EA target late Q3
• full GAIA priority -- SMB GAIA to follow at "later date" 
• everything subject to change.

PS -- curated this content to avoid any concerns about proprietary info. 

[PhoneBoy]

@Garrett_DirSec I believe the target release for those features is R81.20, FYI.
Again, subject to change. 

[the_rock]

I dont see much difference between R81 itself, but so far, no complaints, running fine...hope I did not jinx it : )

[shlomip]

@the_rock ,

Are you running R81 or EA version of R81.10?

[Garrett_DirSec]

thanks @PhoneBoy for the release details. 

[the_rock]

@shlomip...its R81.10 version.

[JozkoMrkvicka]

I see that R81.10 is in Public EA available within Early Availability Programs

Once registered, going to Download section I am redirected to some odd page.

Is that only me who is not able to download the files ?

Thank you.

[shlomip]

@JozkoMrkvicka ,

Is the download page unavailable? this link you redirected too is the "Download agreement" page - are you getting this page? ( when pressing the "Odd page" that is what i get) follow which you expect to get the download page

There might be some networking issues, try deleting cookies and make sure you made the registration itself

, if that persist - Please let me know

[JozkoMrkvicka]

@shlomip 

I am registered to R81.10 Public EA:

The "Download agreement" page is shown. When I click on Accept:

[shlomip]

@JozkoMrkvicka ,

you are there, Just press the accept button and you will be directed to the download page

Then just choose R81.10, press "Search" and you will get the download list

[Ted_Serreyn]

I also get a message after accepting the license agreement and am NOT able to download.

Our apologies, the Early Availability Program you are attempting to access does
not exist in the system or you are not entitled to access it.
To access an Early Availability Program, please register at the User Center.

[shlomip]

hi @Ted_Serreyn ,

Thanks for letting us know.

We are looking into that and will update

Shlomi

[the_rock]

One thing I noticed, which I find very odd...I saw this with 2 customers, as well as in my lab R81.10. Say if you enable infinity threat prevention, lets you apply the policy fine, but then sometime during next 24 hours, policy keeps failing until you disable infinity threat prevention and just enable IPS blade itself. Im not sure why this happens, but I experienced exact same issue in lab with trial license that covers any blade.

Ideas, suggestions?

[shlomip]

@Ted_Serreyn , @JozkoMrkvicka ,

You should be able to download the files now, please let me know if you still encounter any issue.

Thanks and Sorry for the inconvenience 

Shlomi

[shlomip]

@the_rock ,

Let me Check about the infinity Threat Prevention issue you raised and get back to you

Shlomi

[randolchen]

Hi @PhoneBoy, have you heard any news for the replacement of the LoginParam XML file for auto connect feature on the SmartConsole.exe?. I heard that it will be replaced by using some SSO token instead.

kind regards,

Randol

[the_rock]

Thanks a lot @shlomip . Honestly, I am little surprised I had this issue with R81. I had someone from Israel office give me presentation about it couple of months back, but we never really got into troubleshooting the problem, just the features, which is great, but if the issue is there, solution for it would be nice : )

[shlomip]

@the_rock ,

I will contact you offline for this

Shlomi

[Jason_Elmore1]

Still unable to download the EA, same message as above.

Jason

[Daniel_Kavan]

Can I upgrade from R80.40 to R81.10 EA?   I think the answer is no, need to reformat and clean install.   Once I'm on R81.10 EA, can I upgrade to R81.10 GA when it comes out?   I think the answer is no, need to reformat and clean install. 

[shlomip]

@Jason_Elmore1 ,

This should not happen, we are looking into this from our side.

meanwhile ,please make sure you were logged in and registered to the program 

[shlomip]

@Daniel_Kavan ,

to answer your questions

Can I upgrade from R80.40 to R81.10 EA?  Yes. You can. the public EA contains the upgrade package and instructions. Please  follow it

 Once I'm on R81.10 EA, can I upgrade to R81.10 GA when it comes out?  You can technically. But we do not support it with the public EA ( e.g. EA 2 GA upgrade issues). You can also see that the public EA program is intended for lab purposes only. (See its limitations/disclaimer)

You can however, join our private EA program and enjoy that support and more.

HTH

Shlomi

[shlomip]

@Jason_Elmore1 ,

R81.10 public EA Download should be OK now. Please let me know if you experience any more issues.

Sorry for the inconvenience 

Shlomi

[PhoneBoy]

FYI, in the context of a public EA, we have never supported EA to GA upgrades.
This is one of many advantages of participating in the private EA program 🙂

[Jason_Elmore1]

It's working now, thanks.

Jason

[shlomip]

@Jason_Elmore1 ,

Glad to Hear. You are welcome to contact us with any feedback regarding R81.10

[shlomip]

Just to close the loop with @the_rock , and the  the infinity Threat Prevention issue, we discussed this  offline and it was solved.

[the_rock]

Thanks @shlomip , appreciate all the help!

Andy

[Paul_Hagyard]

In the past it has been possible to liaise with TAC to provide an upgrade path from public EA to GA, typically with some custom scripts. There are no guarantees however, which makes running public EA only viable for a basic lab. Rebuilding my home environment manually would take hours, the API doesn't cover everything, and migrate export/import is no help after weeks have gone by.

How are people finding R81.10 in terms of stability? I've recently rebuilt my R81 gateway back to R80.40 as R81 was intermittently dropping DNS reply traffic from Internet name servers. I've also had numerous issues with my R81 SmartCenter refusing to authenticate SmartConsole logins - until after cpstop/cpstart.

[shlomip]

@Paul_Hagyard ,

We have positive feedback so far on R81.10 from our EA program in terms of stability, we pay close attention to it as well as to quality. 

I am not familiar with the specific R81 issues you raised, if you have any references will be happy to try and assist/review them

[JackOtero]

When will we have ISP redundancy compatibility for VSX - VSLS environments? I am a customer who is passing his entire environment to VSX and this limitation forces him to have other devices to do this work.

They must work on this limitation urgently

[PhoneBoy]

@JackOtero if this is an urgent requirement, please bring it through your local Check Point office.

[_Val_]

@JackOtero I second what @PhoneBoy said, please raise an RFE with your local Check Point guys.

[JackOtero]

@PhoneBoy Solved with separate devices to realize ISP redundancy. My point is CheckPoint should work in future releases ISP redundancy support for VSX - VSLS environments.

[Will_H]

@JackOtero There are better solutions than ISP redundancy. ISP redundancy opens up a whole can of worms and caveats that would need to be evaluated every time you want to change something. ISP redundancy IMO is something better left to the external routers who are usually running BGP.

Again, my option, its much less hassle to let the external interface of your firewall have 1 VIP and not 2 or 3, with weights, DNS foolery for inbound stuff and all the other shenanigans. 

Sure there are use cases but the con's far outweigh the pro's. 

Buy bigger circuits, or move that ISP load balancing function to the routers.

My 2 Cents.

[PhoneBoy]

I believe the way we are handling this going forward @JackOtero is by enhancing Policy-Based Routing and the like to handle these features, which should work with VSX.
That said, this problem is likely better solved with an upstream router handling this. 

[JackOtero]

I think the best solution is to add ISP redundancy for VSX - VSLS environments, this compatibility should be there for future updates.

[Pauli]

Requires the Feature

"Access Control

Enhance security by setting default values to Access Rules when the last object in a rule’s cell is removed."

R81.10 on Management Server AND Gateway or R81.10 on Management Server only (and the GWs with R80.40/R81)??

[PhoneBoy]

@Pauli I don't believe this requires upgrading gateways.
It does require configuration, though.

[JackOtero]

You can show me a SK where I show how to make the settings?. I have 2 internet channels, with published web servers and client VPN connections pointing to them

[PhoneBoy]

@JackOtero please create a new thread for your question.