- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
So I upgraded some 5xxx appliances from R77.30 to R80.10 using CPUSE. I didn't read the upgrade instructions, like I did in the old days with IPSO. Partially because Check Point makes it very easy to upgrade with CPUSE, partially because I did not expect the thing to happen, that happened to my DHCP configuration.
You see - as soon as you need any DHCP Option other than DNS, Router or Domain, you're forced to manually craft your own little dhcpd.conf.
During the automated upgrade, this dhcpd.conf is overwritten and the original state is lost, ignoring the fact, that you have set this file to immutable (chattr +i) before.
We're in 2018. Free and open source firewalls such as pfSense have a GUI which allows the creation of custom DHCP options for more than 10 years now. But Check Point? Buy some crazy snake oil threat prevention thingy! New and shiny! Software Blades! Woooop! But a simple thing, such as custom DHCP options? Rocket science.
Sorry for the rant. I had to.
And no worries: I had a backup of the dhcpd.conf.
Hahaha, you made me laugh but point is valid 100%! Can't agree more
Files you modify outside of Gaia/WebUI may not be preserved on an upgrade.
What things were you adding to your dhcpd.conf?
Files that are set to +i (immutable) should not be overwritten or at least automatically backed up by an upgrade process.
Options we use include 186 (WYSE WDM Server), 043, 066 120, 160 (all needed for Skype for Business with Hardware phones by Polycom).
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY