[cciesec2006]

Ray,

I used to work for Managed Security Service Providers (MSSPs) and
that's how MSSPs work. You have to keep in mind that almost all
MSSPs use Provider-1 to manage customer enforcement modules.
The Provider-1 infrastructure does not get upgraded very often.
It is a big task and you can not just do it for one customer.

Most often, you end up having customers running HFAs version
higher than the HFAs running on the Provider-1/SmartCenter.
It is not something you do in an enterprise environment but
for MSSPs, that's how it operates.

In summary, you want the SmartCenter running higher HFAs than
the enforcement modules, the other way will work too and supported
by Checkpoint as well.