This post is written to be strictly evidence-based. Where Check Point documentation is explicit, I state it. Where it is not explicit (for example, “X was not supported in R81.20”), I do not claim it.
In practice, the biggest “change” you will notice when moving from R81.20 → R82.x (including R82.20) is that multiple SD-WAN capabilities are delivered as Early Availability (EA) features, gated behind R82 EA packages, with explicit guidance to coordinate with the SD-WAN team and to obtain packages via sk180605. (sc1.checkpoint.com)
1) The key R82 SD-WAN shift: EA feature gating (packages + workflow)
Across multiple R82 SD-WAN capabilities, the Admin Guide repeats the same operational pattern:
-
“This section describes an SD-WAN feature in the Early Availability stage.”
-
“To get this feature, you must install the R82 Early Availability packages on the SD-WAN Security Gateway.”
-
“See the ‘Downloads’ section in sk180605.”
-
“Contact the SD-WAN team… before starting your journey.” (sc1.checkpoint.com)
Practical takeaway: Upgrading to R82.x does not automatically mean you “get everything.” For several capabilities, you must treat enablement as a controlled rollout: packages + validation + change plan.
2) R82 EA Feature: SD-WAN with a Maestro Security Group
R82 documentation explicitly includes “EA Feature: SD-WAN with a Maestro Security Group.” (sc1.checkpoint.com)
What is explicitly stated (high confidence):
-
It is Early Availability.
-
It requires the R82 EA packages, referenced via sk180605.
-
The document recommends coordinating with the SD-WAN team prior to enablement. (sc1.checkpoint.com)
Why this matters operationally: Maestro introduces an extra layer of distributed dataplane operations. SD-WAN support in Maestro SG changes onboarding and troubleshooting patterns (for example, ensuring the SD-WAN software/agent components and configuration are consistent across members), and you should treat it as feature-gated EA.
Note: If you want a “precise, step-by-step enablement checklist” (Nano Agent on SGMs, where to configure interfaces, and what to avoid), I can write it, but I will only do so by quoting the exact steps from the same R82 guide pages you are using.
3) R82 EA Feature: SD-WAN with a Traditional VSX Virtual System
R82 documentation explicitly includes “EA Feature: SD-WAN with a Traditional VSX Virtual System.” (sc1.checkpoint.com)
The Admin Guide also lists specific limitations for this EA feature. In the PDF excerpt returned by search results, it explicitly calls out that SD-WAN Profile supports only Layer 3 Virtual Systems and then continues with additional limitations. (sc1.checkpoint.com)
How to interpret this correctly (design impact):
-
VSX enablement is not “universal.” It is bounded by VS mode/type constraints documented in the SD-WAN guide.
-
Treat VSX SD-WAN as “architecture-driven,” not “toggle-driven.” If your VSX design doesn’t fit the supported model, you should not force it.
4) R82 EA Feature: SD-WAN with SmartLSM (SmartProvisioning)
R82 documentation explicitly includes “EA Feature: SD-WAN with SmartLSM (SmartProvisioning).” (sc1.checkpoint.com)
What is explicitly stated:
Why this matters: SmartLSM is fundamentally about lifecycle at scale (profiles and standardized provisioning). SD-WAN integration here is a meaningful operational upgrade for large fleets—again, gated by EA packaging and rollout discipline.
5) R82 EA Feature: SD-WAN in Layer 2
R82 documentation explicitly includes “EA Feature: SD-WAN in Layer 2.” (sc1.checkpoint.com)
What is explicitly stated:
Design note: L2 support can matter for specific edge cases and migrations, but because it is EA-gated, treat it as an engineering project (lab validation, change control).
6) R82 EA Feature: QoS in SD-WAN
R82 documentation explicitly includes “EA Feature: QoS in SD-WAN.” (sc1.checkpoint.com)
What is explicitly stated:
Operational importance: QoS tied to SD-WAN policy intent is a big deal for real-world deployments (voice/video vs bulk traffic), but here again: treat it as EA enablement, not default behavior.
7) R82 EA Feature: IPv6 in SD-WAN
R82 documentation explicitly includes “EA Feature: IPv6 in SD-WAN.” (sc1.checkpoint.com)
What is explicitly stated:
Precision note: IPv6 behavior details (what SD-WAN can and cannot do for IPv6) must be taken from the IPv6 EA section itself. If you want, I can summarize the IPv6 limitations and supported paths strictly from that page/PDF section.
8) What to do when planning R81.20 → R82.20
Because many “headline” capabilities are EA-gated in R82, the best planning model is:
-
Identify whether you are targeting GA-only SD-WAN features or enabling one or more EA features.
-
If EA is in scope, treat it like a controlled release:
-
confirm R82 EA package requirements,
-
confirm platform/architecture constraints (especially VSX),
-
validate in lab,
-
deploy with rollback and operational runbooks,
-
align with Check Point SD-WAN guidance to coordinate before enablement. (sc1.checkpoint.com)
