Henrik Svendsen

Born in 1980, I grew up playing Nintendo. Served in the Military for 10 years, before deciding to get into IT. After studying for a year, I started working as a Microsoft MCSE, and later made the switch to Security, primarily based on Checkpoint Technologies. I am curious of nature, and love a challenge. Married with Claire, and together we have two wonderful daughters Pernille and Mette. In my spare time I Play games (never grow up!) and watch TV series whenever the opportunity is there.

Sync Redundancy in ClusterXL – Just because you could, does it then mean that you should ?

by

SK92804 – Sync Redundancy in ClusterXL.
If you have ever worked with Checkpoint Cluster, my guess is that you have been using ClusterXL.

When creating a Checkpoint cluster, you will notice that you have the possibility to create more than one sync interface.
In Cluster properties, > topology, you have the option to define the network, and what it is used for.
1st Sync is defined on eth2
1

and i just created a 2nd Sync network, using eth4 on both node.

3
BUT… this could potential be the cause of issues.

Versions affected: R70,R71,R75,R76,R77,R77.10,R77.20,R77.30

Checkpoint states that while being able to create multiple sync interfaces in the SmartDashboard, you should not do so.
By design (And real life expirence..) configuring multiple synchronization networks does not provide 100{660587945da3d28a1fd29f93b9f96b8a9cf4237460baa7c708dfe4eec8fd0540} sync redundancy.

It is still possible to configure multiple sync networks in SmartDashboard, but this is for unique special cases where the cluster administrator is unable to create Bond interfaces.

So Checkpoint advices you to Bond interfaces, if you want to use multiple nics for sync redundancy.

CPUSE requires a valid license for updates. SK94508

by 
You have just installed a new checkpoint, and have not yet installed the licences... 
You want to update IPS, but recieve an error when trying...   BUGGER !
 Checkpoint have released SK94508 to deal with the problem.

"CPUSE requires a valid license for downloads and updates. 
The trial license is currently active and will expire on DD-MMM-YYY HH:MM:SS" message in Gaia Portal 
('Upgrades (CPUSE)' pane / 'Software Updates' pane - 'Status and Actions' - "Important Messages" section at the top)

Debug of Gaia Software Updates Agent daemon (per sk92449) shows in /opt/CPInstLog/DeploymentAgent.log:
DEBUG: The user has not authorized downloads, not performing update.

Solution:
Log in to Expert mode, and perform cpstop.
Edit $CPDIR/tmp/mis_Objects.C

Modify 
from
: (DownloadAccess
   :allow_download_content (false)
to
: (DownloadAccess
   :allow_download_content (true)
Save the file.

Run CPSTART.