Spark with indicators issue

[Teddy_CPDC]

Hi 

I have a spark 1600 HA cluster and central managed. firmware version is R81.10.10.

I have indicators feed from firehol level1 and apply on the spark.

After upgrade one appliance to R81.10.17, the spark appliance become offline.

I check the list, it include private IP subnet.

The log on SM show CPD and AMON is deny by indicator list.

Why does the default implied rules not work on R81.10.17?

[Chris_Atkinson]

Regarding IOCs does your issue match what is reported here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/SMB-Upgrade-to-R81-10-17-Build-620-Error-Mode... 

Otherwise please report this through the official TAC channels for further investigation.

https://help.checkpoint.com/

[Teddy_CPDC]

Hi,

In this case, the upgrade firmware is R81.10.17 Build 996004653.

Is the step of disable IOC feed also need? 

[Chris_Atkinson]

The fix was incorporated into that release for the specific issue described there, if you still face issues with that build please update TAC accordingly.

[the_rock]

Personally, I would have done exact same thing you did, but if that failed, I would open TAC case as Chris suggested.

Andy