The CheckMates Blog - Page 9

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

Software Releases

• R80.10 Ongoing JHF Take 259
• Gaia Healthcheck Script v7.08

Videos

• HTTPS Inspection Best Practices TechTalk
• NSS Labs Breach Prevention Report
• AWS - Automated Remediation via Dome9 CloudBots

Other Topics

• Check Point 1500 Appliance FAQ
• Global Policies and Stealth Rule
• How to Monitor Command Input in Expert Mode
• 23900, R80.30 Upgrade, and SMT
• Performance Tuning Tip: User Mode Firewall vs Kernel Mode Firewall
• Why Can a Policy Server Receive Logs 

Upcoming Events

We are now maintaining our event calendar in Google Calendar
You can browse our calendar of events here: CheckMates Calendar 

@_Val_, @Shay_Levin, and I are busy preparing for the upcoming CPX 360 events.
We will post upcoming CheckMates Live events for 2020 in the near future.

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates Champions in Israel

We flew our 2019 CheckMates Champions out to Tel Aviv for some meetings with Check Point R&D and some fun in Eilat! Congratulations once again to @HeikoAnkenbrand  @G_W_Albrecht  @Timothy_Hall  @Vladimir  @Wolfgang  @Evgeniy_Olkov  @Danny  @Maarten_Sjouw ! 

Community Highlights

Here are the threads to watch from the last week:

New Releases

• GAIA API 1.3 is now GA 
• SmartConsole R80.10 Build 154

Automation

• GAIA API Failing to Install with Ansible 
• Adding Network Object With mgmt_cli Batch CSV File Not Working in R80.20 

CloudGuard

• VMware Tools Not Installed After Upgrading to R80.20 JHF 118
• Migrate CloudGuard IaaS R80.10 Standalone to R80.30

Other Topics

• R80.30 Take 273 versus Take 300
• Traffic Accepted by Implied Rule
• Drops on Interface with High CPU
• Log Exporter and Elasticsearch

Upcoming Events

We are now maintaining our event calendar in Google Calendar
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks:

• 12th November 2019: CheckMates Live Finland
• 14th November 2019: CheckMates Live Romania
• 20th November 2019: CheckMates Live Bangalore
• 21st November 2019: CheckMates Live London with @Val_Loukine AND @PhoneBoy 
• 2nd December 2019: CheckMates Live Omaha with @PhoneBoy 
• 3rd December 2019: CheckMates Live Des Moines with @PhoneBoy 
• 4th December 2019: CheckMates Live Kansas City with @PhoneBoy 
• 5th December 2019: CheckMates Live Springfield with @PhoneBoy 
• 6th December 2019: CheckMates Live St. Louis with @PhoneBoy

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates, Bulgarian Style

@_Val_ and I did a private CheckMates event for DXC and AT&T in Sofia, Bulgaria.
We had quite the turnout (over 100 people!):

Community Highlights

Here are the threads to watch from the past week:

Code Hub

• R80.20 API for IPS Protections 
• Ubiquiti Unifi and Check Point Integration 

IPS

• Different IPS Behavior with R80.30 Management
• IPS Exception Not Working

Management

• Change Control
• SmartConsole Opens in Standby Mode When Gateway Fails Over To Backup (Full HA) 

Other Topcs

• Top 20 Gateway Tuning Tips
• Best Practice: How Often To Patch/Upgrade Your Gateways? 
• fw monitor Segfaults
• SandBlast Agent and Symantec Co-Existence
• Elephant Flows 

Upcoming Events

We are now maintaining our event calendar in Google Calendar
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks:

• 1st November 2019: CheckMates Live Sydney
• 12th November 2019: CheckMates Live Finland
• 14th November 2019: CheckMates Live Romania
• 21st November 2019: CheckMates Live London with @_Val_ AND @PhoneBoy 
• 2nd December 2019: CheckMates Live Omaha with @PhoneBoy 
• 3rd December 2019: CheckMates Live Des Moines with @PhoneBoy 
• 4th December 2019: CheckMates Live Kansas City with @PhoneBoy 
• 5th December 2019: CheckMates Live Springfield with @PhoneBoy 
• 6th December 2019: CheckMates Live St. Louis with @PhoneBoy

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the past week:

Software Updates:

• R80.30 JHF Ongoing Take 76 (Replaces Take 71) 
• R80.20 JHF Ongoing Take 117
• New Dome9 Integration with ServiceNow

Endpoint/Remote Access:

• SandBlast Agent Installation with Endpoint VPN 
• Connect Full Featured Endpoint VPN Client to a SecuRemote Only Site 
• Kernel Panics on MacOS X Catalina
• SNX on MacOS X Catalina

Other Topics:

• FullHA Cluster Upgrade from R77.30 to R80.30
• Tool to Trigger IPS Signature
• Scheduled Rule Setting
• Double VLAN Addresses on VSX
• Identity Awareness Use Cases

Upcoming Events

We are now maintaining our event calendar in Google Calendar
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 15th October 2019: HTTPS Inspection Best Practices in Sao Paulo with @PhoneBoy 
• 16th October 2019: HTTPS Inspection Best Practices in Brasilia with @PhoneBoy 
• 17th October 2019: HTTPS Inspection Best Practices in Rio de Janeiro with @PhoneBoy 
• 23rd October 2019: Using the Check Point API to Automate Operations TechTalk
• 1st November 2019: CheckMates Live Sydney
• 12th November 2019: CheckMates Live Finland
• 2nd December 2019: CheckMates Live Omaha with @PhoneBoy 
• 3rd December 2019: CheckMates Live Des Moines with @PhoneBoy 
• 4th December 2019: CheckMates Live Kansas City with @PhoneBoy 
• 5th December 2019: CheckMates Live Springfield with @PhoneBoy 
• 6th December 2019: CheckMates Live St. Louis with @PhoneBoy

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

We Finally Have Threaded Replies Again!

One of the things that "broke" when we migrated platforms earlier this year was how discussion threads were shown on the site.
Specifically, replies would not be indented in any way, so it wouldn't be clear what was a response to what.
It created a usability issue for the site.
I won't get into the details of why we didn't have the functionality, but sufficed to say: we now do.
Feedback is always welcome.

Community Highlights

Here are the threads to watch from the past week:

• R80.30 JHF 71 Ongoing Take was released this week
• Inline Layers vs Ordered Layers: What's More Efficient?
• Can Gateway Logs be Sent Directly to a SIEM (not through a Log Server)? Yes, but not all logs.
• HTTPS Inspection Concerns Not technical concerns, but of PII.
• Identity Awareness with Transparent Kerberos Authentication for Terminal Server 
• SMB Scheduled Backup
• Cannot add Contract via SmartUpdate
• Removing Last Object in Rule Cell in R80.x 
• Problem Accessing Standby Cluster Member From Non-Local Network Good reason to get on the latest jumbo hotfix.
• R80.x Change Control: A Visual Guide an oldie but goodie that's still relevant

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 15th October 2019: HTTPS Inspection Best Practices in Sao Paulo with @PhoneBoy 
• 16th October 2019:
  • Using the Check Point API to Automate Operations TechTalk
  • HTTPS Inspection Best Practices in Brasilia with @PhoneBoy 
• 17th October 2019: HTTPS Inspection Best Practices in Rio de Janeiro with @PhoneBoy 
• 1st November 2019: CheckMates Live Sydney
• 2nd December 2019: CheckMates Live Omaha
• 3rd December 2019: CheckMates Live Des Moines
• 4th December 2019: CheckMates Live Kansas City
• 5th December 2019: CheckMates Live Springfield
• 6th December 2019: CheckMates Live St. Louis

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates Around The World

@_Val_ was in Belgium:

@meiry and I were in Philadelphia and NYC:

Community Highlights

Here are the threads to watch from the last week:

Code Hub/API Discussions

• How to Install Database on all Domains at once from CLI
• R80.x Clear Old Sessions Script
• How to Run fw sam via Management API

Threat Prevention

• What Traffic Does the Gateway scan first,? FW, IPS, Threat Prevention, etc...
• DNS Malware Trap -- DNS Servers
• Exceptions on IPS Core Protections

Other Topics

• Low Throughput from 4200 Appliance
• Speed Up Connection Process for Remote Access Clients
• Thoughts on a Random Cluster Problem
• Cluster Re-Sync
• Question about Overlapping Encryption Domains Same Management
• Logging Statistics

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 23rd September 2019:
  • CheckMates Live New England with @PhoneBoy 
• 25th September 2019:
  • TechTalk: Fighting Cyber Security Threats with SandBlast Now
  • CheckMates Live Sweden
• 26th September 2019:
  • CheckMates Live Denmark (Copenhagen)
  • CheckMates Live Nashville with @Adam_Forester 
• 30th September 2019:
  • CheckMates Live Jacksonville, FL with @Adam_Forester 
• 15th October 2019: HTTPS Inspection Best Practices in Sao Paulo with @PhoneBoy 
• 16th October 2019:
  • Using the Check Point API to Automate Operations TechTalk
  • HTTPS Inspection Best Practices in Brasilia with @PhoneBoy 
• 17th October 2019: HTTPS Inspection Best Practices in Rio de Janeiro with @PhoneBoy 

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

Celebrating the Best of CheckMates 2019

Congratulations to the best of the best!

Upgrades

• How To Advanced Upgrade Smart-1 210 SMS on R77-30 to R80.20
• R77.30.03 to R80.30 Endpoint Migration Issues (all resolved)
• Exporting Logs From One SMS to Another Newly Created SMS
• Upgrade Path from R77.30 to R80.30
• Migrate From Smart-1 HA SMS to Virtual SMS With New IP

Other Topics

• SmartEndpoint Changing The Number of Total Endpoints
• App Control Self-Help Guide
• Adding Rules to a Rule Section Using Ansible
• Do Access Roles Need Identity Awareness to Function?
• Move Gateways From One Domain To Another
• Creating a Simple VPN Connection
• SMB Remote Access VPN Clients Connect Site-to-Site to Remote VPN Networks
• Check Point OPSEC LEA with LogRhythm SIEM
• Max Number of Virtual Systems Per VSX

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 17th September 2019:
  • CheckMates Live Belgium
  • CheckMates Live Philadelphia with @PhoneBoy 
• 19th September 2019:
  • CheckMates Live NYC with @PhoneBoy 
• 23rd September 2019:
  • CheckMates Live New England with @PhoneBoy 
• 25th September 2019:
  • TechTalk: Fighting Cyber Security Threats with SandBlast Now
  • CheckMates Live Sweden
• 26th September 2019:
  • CheckMates Live Denmark (Copenhagen)
  • CheckMates Live Nashville
• 16th October 2019: Using the Check Point API to Automate Operations TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

As I was on vacation the previous week, there was no "This Week in CheckMates" last week.
This week's threads to watch come from the last two weeks:

R80.40 Early Availability

We are starting the R80.40 Production EA program in the near future!
Participants in the Production EA get to work directly with R&D as part of this process.
A public EA of R80.40 will be made available later on.
A few relevant threads:

• R80.40 EA Program
• R80.40 Automatically Changes the Number of CoreXL/SNDs Firewall
• add simple-cluster API (finally!!!)
• Management of UTM-1 EDGE Devices in R80.30 and R80.40

New Software Releases

• Endpoint Security R81.30
• R80.10 Jumbo Hotfix GA Take 225
• R80.20 SmartConsole GA Build 67
• R80.30 Jumbo Hotfix Ongoing Take 50

Upgrade to R80.x

• R80.20 Management Performance explains some differences between R80.x and earlier releases that may account for performance differences.
• Migration MDS from R77.30 to R80.30 failed explains what you should do before upgrading to ensure a successful one.
• Is R80.20 More Stable than R80.10?
• Skip R80.10 on Gateways? Yes, go to R80.30.
• R55/R65 Bug Tracker If you're still on these releases, upgrading is definitely recommended.

Other Topics

• Change Match for Any Default Value in Services
• Policy Revision Installation History: Does the Compiled Policy Include the Database?
• Manual NAT with Proxy ARP Fails Randomly
• SD-WAN Security Techtalk Video and Slides
• How to Block Hashes of Malware by IPS Signature

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 12th September 2019: CheckMates Live Munich with @Valeri_Loukine 
• 17th September 2019:
  • CheckMates Live Belgium
  • CheckMates Live Philadelphia with @PhoneBoy 
• 19th September 2019:
  • CheckMates Live NYC with @PhoneBoy 
• 23rd September 2019:
  • CheckMates Live New England with @PhoneBoy 
• 25th September 2019:
  • TechTalk: Fighting Cyber Security Threats with SandBlast Now
  • CheckMates Live Sweden
• 26th September 2019: CheckMates Live Denmark (Copenhagen)
• 16th October 2019: Using the Check Point API to Automate Operations TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

I decided to try a slightly different format for the "Community Highlights" section last week, and I kind of like it. Tell me what you think! Meanwhile, here are the threads to watch from the last week:

New Software Releases

• R80.20 JHF New GA Take 91
• R77.20.87 Jumbo Hotfix Accumulator for SMB Appliances
• General Availability of Cloud Management for SandBlast Agent

Upgrade to R80.x

Given that R77.30 is going End of Support in September, now is as good a time as any to get upgraded. Here are a few threads of interest:

• Optimal Steps for ClusterXL Cluster Upgrade
• R77.30 > R80.20 Verification Failure
• The database contains objects with non Unicode characters

API/CLI Examples

• How to specify a Session Name and Description in a mgmt_cli
• View network host objects via CLI

Other Topics

• Proxy ARP on Check Point R80.10
• Scheduled Policy Installation on R80.20
• Firewall Rule for Any TCP and Any UDP Port
• Management Support for UTM-1 EDGE in Upcoming R80.40

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 28th August 2019: CheckMates Live Moscow
• 2nd September 2019: CheckMates Live Vienna with @Valeri_Loukine 
• 4th September 2019:
  • CheckMates Live London with @Valeri_Loukine 
  • SD-WAN Security TechTalk
• 5th September 2019: CheckMates Live Manchester with @Valeri_Loukine 
• 12th September 2019: CheckMates Live Munich with @Valeri_Loukine 
• 17th September 2019:
  • CheckMates Live Belgium
  • CheckMates Live Philadelphia with @PhoneBoy 
• 19th September 2019:
  • CheckMates Live NYC with @PhoneBoy 
• 23rd September 2019:
  • CheckMates Live New England with @PhoneBoy 
• 25th September 2019:
  • TechTalk: Fighting Cyber Security Threats with SandBlast Now
  • CheckMates Live Sweden
• 26th September 2019: CheckMates Live Denmark (Copenhagen)
• 16th October 2019: Using the Check Point API to Automate Operations TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

New Software Releases

• Endpoint Security R81.20
• Endpoint Security Versions Release Schedules
• SmartConsole R80.30 Build 8

Upgrade to R80.x

Given that R77.30 is going End of Support in September, now is as good a time as any to get upgraded. We've had a couple of success stories of customers upgrading to R80.20 and R80.30:

• R80.30: A Good News Story
• Zero Downtime Upgrade From R77.30 to R80.20

IPS and Threat Prevention

• Difference Between IPS and Threat Prevention Policy Layers
• IPS Shared Policy Layer
• IPS Utilization Report in SmartView

Other Threads:

• R80.20+ Security Gateway Architecture Logical Packet Flow
• Mitre ATT&CK Framework and Check Point (TechTalk Recording)
• CheckMates Member of the Month for August 2019: Matt-Dunn
• Export All Rules Referencing a List of IPs
• QoS Users: Influence Upcoming Enhancements!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 19th August 2019: CheckMates Live in Singapore with @Valeri_Loukine 
• 22nd August 2019: CheckMates Live Sydney with @Valeri_Loukine 
• 22nd August 2019: CheckMates Live Orange County with @PhoneBoy 
• 28th August 2019
  • SD-WAN Security TechTalk
  • CheckMates Live Moscow
• 2nd September 2019: CheckMates Live Vienna with @Valeri_Loukine 
• 4th September 2019: CheckMates Live London with @Valeri_Loukine 
• 5th September 2019: CheckMates Live Manchester with @Valeri_Loukine 
• 12th September 2019: CheckMates Live Munich with @Valeri_Loukine 
• 17th September 2019: CheckMates Live Belgium
• 25th September 2019:
  • TechTalk: Fighting Cyber Security Threats with SandBlast Now
  • CheckMates Live Sweden
• 26th September 2019: CheckMates Live Denmark (Copenhagen)

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com