Support

[melipla]

I would like major improvements in Check Point support. It's all I want for Christmas.

[fdamstra]

Originally Posted by melipla

I would like major improvements in Check Point support. It's all I want for Christmas.

Indeed. I'm not sure what we're paying for at this point. I have two tickets that have been open for over a week with no response other than, "We are reviewing and looking for a fix."

[RayPesek]

Is anybody using a CSP for their support instead of going directly with Check Point? We're looking at that option for next year but we don't really have any cases that haven't required running debugs, etc.

Although the CSP option is a bit less expensive, I'm not sure it would work as well as direct support for what we experience.

Any thoughts would be appreciated.

Thanks,

Ray

[northlandboy]

Ray, I've had experience with both sides of it. A couple of places I've been at have had worked through a CSP, the last couple have been Diamond support direct with CP.

To be honest, I don't know how much value we got out of going through a CSP. The types of problems that I have are either A) hardware replacement - through Nokia or whoever, or B) Complex Check Point issues that need to be escalated to Check Point.

I can't think of too many issues I've had that have been solved by the CSP themselves - often they just end up as a conduit, relaying messages back and forth. Maybe they're suitable for less experienced shops, but if you've got some good engineers on site, they can resolve most issues. One relevant thing is SK access - CSPs get better access than you do as a normal user. Get certs, you get some pretty good access. Get Diamond support, and you get Expert access, which I think is pretty similar to CSP level. I very much like the Expert level access - helps me solve quite a few things on my own.

I guess it can be useful to have a CSP if you're say running Nokia kit, and you want them do deal with Nokia when required, or Check Point when required. I'm sure you're fairly experienced with Check Point, but I don't know what your site's like in general, or what's important for you.

I don't generally deal with the money side of things though, so I don't know exactly how the costings work out.

Regards the first post here, about better support, I don't know exactly how much attention CP pays to our ramblings, but perhaps if we could give some specific things we would like done better? Absolutely we all want better support, and I'm sure most of us who've been around for a while have had our major frustrations with it, but we need to lay out some specifics for things we would like done better.

I guess something that I get frustrated with is that support often takes a one-track approach to things. They will decide that something is the cause of the problem, and refuse to entertain any other possibilities. Not enough seems to be done to fully analyse the problem - they will decide on one thing, and expect you to make a change immediately. As we all know though, in most large environments, change needs to be planned and scheduled in advance. By the time you get around to making the change, the call has been closed off...and then it doesn't fix the problem. You get the feeling that they are trying to avoid responsibility for the issue, to point the finger at some other component - but as the end user, you just want to get the service working again.

I had a support call with Cisco earlier this year, on something we'd tracked down to a problem with multicast forwarding on certain IOS revisions. The Cisco response was very good - they quickly proposed three possible workarounds, and a longer term fix, involving an IOS upgrade. They recognised that the IOS upgrade was not going to happen immediately, due to potential impact, and instead had a variety of workarounds. They did not try and shirk responsibility, by blaming Check Point for doing something wrong with multicasting - as they could have.

Flash forward a few months - I got involved in a similar issue at a different site, but this time the call went to Check Point (someone else had been investigating it). HA wasn't working, packets were being sent by each firewall, but not received by the other. Check Point's response? The version of Stonebeat you are running is not supported. Never even looked at the information. That's the kind of thing that gets frustrating - I'm looking for help with resolving a problem, I'm not specifically trying to blame any particular vendor, or dodge responsibility (welll, sometimes I am...).

So, what can we put in terms of specifics for improvement in Check Point support?

[RayPesek]

Thanks for taking the time to write so much. That's pretty much what I'm thinking as well, not much value for us. The cost difference is less than ten percent and I do not like middlemen very much. Too much filtering, intentional or otherwise, seems to occur.

I've got Advanced Access to SecureKnowledge via our Enterprise Gold and my CCSE, which I find very valuable. I particularly like the new version because I can do an "advanced" search, set the time period to a week and search on * which returns all new articles in the last week.

I've only seen a couple of Expert Access Required articles and when I wanted to see them, I just open a support case and they give them to me.

The CSP guys are good and obviously they have better and more experience than I do because they do handle support for other companies. But we're very stable and things just work (usually). And I can hire them on a time-and-materials basis if needed.

I must luck out on my cases with CP or my problems are extraordinary because the people I get always work out. There's two persons in particular that I am always happy to get on a case because they listen and put a lot of effort into it.

One thing that made Nokia's CP support outstanding was that they use the phone a lot rather than relying on email. My last two CP cases have been the same way, so maybe some changes are being made there. I've also gotten notes from supervisors when my case person is out of the office offering someone else if needed.

I do like the fact that CP is now posting HFAs for download instead of having to find out about them through some back door. The time period from their availability to CSPs and the public might even be dropping. A year ago it was a month or more. I think the R61 HFA01 got posted in just a few weeks.

One thing I would like to see is enhanced benefits for certification holders. The Benefits section is really lame, a couple of outdated links and outdated articles. Advanced Access is good but I get that through my company. Expert Access would be nice as would be access to CSP-type downloads, such as the HFAs or at least their release notes as soon as they become available.

I understand that CP needs to support their resellers and CSPs, but ultimately it's the customer, us, that are funding their profitability and we're the ones that need to stay happy. :-)

Ray

[BarryStiefel]

Originally Posted by RayPesek

Thanks for taking the time to write so much. That's pretty much what I'm thinking as well, not much value for us. The cost difference is less than ten percent and I do not like middlemen very much. Too much filtering, intentional or otherwise, seems to occur.

I've got Advanced Access to SecureKnowledge via our Enterprise Gold and my CCSE, which I find very valuable. I particularly like the new version because I can do an "advanced" search, set the time period to a week and search on * which returns all new articles in the last week.

I've only seen a couple of Expert Access Required articles and when I wanted to see them, I just open a support case and they give them to me.

The CSP guys are good and obviously they have better and more experience than I do because they do handle support for other companies. But we're very stable and things just work (usually). And I can hire them on a time-and-materials basis if needed.

I must luck out on my cases with CP or my problems are extraordinary because the people I get always work out. There's two persons in particular that I am always happy to get on a case because they listen and put a lot of effort into it.

One thing that made Nokia's CP support outstanding was that they use the phone a lot rather than relying on email. My last two CP cases have been the same way, so maybe some changes are being made there. I've also gotten notes from supervisors when my case person is out of the office offering someone else if needed.

I do like the fact that CP is now posting HFAs for download instead of having to find out about them through some back door. The time period from their availability to CSPs and the public might even be dropping. A year ago it was a month or more. I think the R61 HFA01 got posted in just a few weeks.

One thing I would like to see is enhanced benefits for certification holders. The Benefits section is really lame, a couple of outdated links and outdated articles. Advanced Access is good but I get that through my company. Expert Access would be nice as would be access to CSP-type downloads, such as the HFAs or at least their release notes as soon as they become available.

I understand that CP needs to support their resellers and CSPs, but ultimately it's the customer, us, that are funding their profitability and we're the ones that need to stay happy. :-)

Ray

I don't understand why Check Point takes some of their "advanced" online technical support content and hides it behind yet another toll booth. Usually, companies try to put as much support content as possible on the web to save on very expensive phone calls from customers. I can't imagine the extra revenue they get from forcing customers to find someone with the enhanced access outweighs the extra costs of customers who just say "Screw it, I'm calling them on the phone".

By the way, you don't have to pay for technical support information here at CPUG. Everything here is free, to everyone, all the time, even if you're not registered. We can't make it any free-er than that.

[northlandboy]

Another improvement I would like Check Point to make to their support - give your staff more machines for simulating customer problems. If we're paying for the top level of support, and paying a lot of money, we shouldn't have to wait in line to get our problems reproduced. Maybe for lower levels of support, but not at Diamond level.

[RayPesek]

I'd like to see CP give their customers a very limited licenses, like one or two IP's, that we could use only for test systems for upgrades and the like. Trying to run a test environment that you have to rebuild every two weeks from eval licenses is a hassle.

Ray

[Reaper]

I run the test enviroment with the same IP-s and licences as real system. I just do it in isolated network not connected to anything.

[melipla]

Originally Posted by northlandboy

Regards the first post here, about better support, I don't know exactly how much attention CP pays to our ramblings, but perhaps if we could give some specific things we would like done better?

For starters, why did Check Point discontinue the 800 number for support?

Recently I've seen changes with how the "initial" call is handled. Now instead of taking my information and putting me into the 45+ minute queue the person takes my information and tries to help me. In the case of the ticket I opened up today, this happened. I appreciate the effort, however she wanted me to debug things that had nothing to do with the issue. She offered to have someone call me back or to put me into the queue. I waited the 45 minutes, the tech came on, didn't even read what the first tech had me do, had me re-explain my ticket, searched previous tickets and in five minutes was able to tell me that I was SOL and that I could submit an RFE, which he admitted wouldn't help me any. I just wasted three hours on something that should've been documented in SK. Now I have to go do the extra work of submitting an RFE, submitting and update to SK, and probably posting something here too because I know the RFE and SK changes may never occurr or won't occurr for months. The kicker is that Check Point already knew the answer and hasn't done any of this work. My fav quote from the call, "Someone called in earlier today with the same question".

That was for a simple question. When you get into harder issues, the ticket can span months. You get handed off to the next level of support with out much communication between the two levels. If your problem is urgent, you have to call back in and get a new tech, and you have to explain everything all over again. Communication seems to be a big issue--its been impossible for me to get a hold of the tech who's assigned to my ticket(s). They're always on another call or not working that day. VM's don't get returned, or worse, they put in the ticket they've tried to called you and were unable to reach you--meanwhile you've been at your desk for the past four hours w/no call.

The techs could do better ticket tracking too....I'm trying things w/escalations that I know I've tried with lower level support but that was 4 months ago and the tech never put in the ticket that we tried it. The reverse is applicable too...take the ticket I did today, the first level tech told me some off the wall things because her understanding of the product was limited....is the higher level tech going to call her and tell her what the real resolution is and maybe give some pointers for future calls of that nature? I see a lot of value in having a well trained support staff....I love the feedback option for tickets but I also like to see it expanded so that if the ticket is escalated/transferred you can at least give feedback on the technician that just helped you. I've had lots of cases where I work with multiple people and to answer a feedback question rating the technical knowledge of the technician...which person do I rate?

I'll agree, I don't understand the seperate levels of support programs. I don't understand the seperate level of access to KB. I don't understand why Check Point doesn't update their own KBs. Why not just open up commenting on KBs then instead of going through months of waiting for someone to approve your KB feedback?

[chillyjim]

Originally Posted by RayPesek

I'd like to see CP give their customers a very limited licenses, like one or two IP's, that we could use only for test systems for upgrades and the like. Trying to run a test environment that you have to rebuild every two weeks from eval licenses is a hassle.

Ray

Ray,

At any point your reseller should be able to generate you 30 day eval keys. If you are looking for a full time lab system, get in touch with your check point sales rep, they should be able to cut you a good deal (esp this time of year :))