[cciesec2006]

that's not correct.

Enforcement modules can have higher HFA than SmartCenter. In other
words, you can have SmartCenter running NGx R65 with NO HFA while
enforcement modules running NGx R65 with HFA_02 and HF_249.
The drawback of this is that you may lack some features on the
SmartCenter but it will work

Enforcement modules can NOT be running higher checkpoint version than
SmartCenter. In other words, you can not have SmartCenter running on
NGx R62 managing Enforcment Modules running NGx R65.

That's the way I understand how checkpoint work, unless they decide
to change it in NGx