about getting product updates ?

[derspot]

If I have a client that has NGX R60 - are they automatically entitled for the newest NGX Release - NGX R62. If so , how do I obtain the R62 bits ? Is it by ordering an Eval package.

How do I obtain update packages such as HFA4 for NGX ?

[northlandboy]

Yes you need to order the CD for R62 code. No more downloads since NGX. PITA.

HFAs can be downloaded though - go to http://www.checkpoint.com/downloads/index.html and follow the link for latest HFAs.

Regards if they are entitled, it depends on what support agreement they have. NG -> NGX you needed to upgrade your license, requiring support. If the client has R60, but no support, then they are probably not entitled to run R62, but if they had the code then their license would work fine.

[derspot]

I see , well installing patches ( HFAs ) manually sucks these days. I mean most major vendors do have automated patch download/installation solution.

[RayPesek]

If you're licensed for full functionality in SmartUpdate, you can push a lot out rather than doing it one by one.

That being said, automated patch installs can be dangerous due to changes. Look at what would happen if Cisco did IOS upgrades that way, what with all of their syntax and functionality changes between variants.

Ray

[northlandboy]

Originally Posted by derspot

I see , well installing patches ( HFAs ) manually sucks these days. I mean most major vendors do have automated patch download/installation solution.

Not so sure about automated download solutions for enterprise-class systems. I doubt I would ever want something like that to run on say Cisco 7600s, Solaris servers, HP-UX boxes, etc. Windows, Mac & Linux clients, fine - but that's a very different market to firewalls. What major vendors are you referring to? Do you mean other major firewall vendors? Let's compare like with like.

As Ray pointed out, you can use SmartUpdate, which makes it relatively easy to download updates, and push them out, but it's not fully automated, nor should it be. It's similar I guess to using Ciscoworks to push out IOS images. There is absolutely no way that in a production network I am going to allow something to automatically download patches, install and reboot on my firewalls, without at least some sort of intervention on my part.

FWIW, although most places I work at are licensed for SmartUpdate (license is included with license for RTM), and I've done some major updates with it, I don't normally bother. For me, it's usually better to just scp the packages out, untar and run the HFA - that way I can sit on it and watch what's going on. When you've got millions of dollars going through systems, patching becomes a big issue - and saving 5 minutes by using a GUI rather than command line is pretty much irrelevant.

Mind you, from what I hear Check Point uses SmartUpdate in a big way internally. Probably good if you need to blitz a test lab. But then they did have a massive network outage last week...

[derspot]

Originally Posted by northlandboy

Not so sure about automated download solutions for enterprise-class systems. I doubt I would ever want something like that to run on say Cisco 7600s, Solaris servers, HP-UX boxes, etc. Windows, Mac & Linux clients, fine - but that's a very different market to firewalls. What major vendors are you referring to? Do you mean other major firewall vendors? Let's compare like with like.

As Ray pointed out, you can use SmartUpdate, which makes it relatively easy to download updates, and push them out, but it's not fully automated, nor should it be. It's similar I guess to using Ciscoworks to push out IOS images. There is absolutely no way that in a production network I am going to allow something to automatically download patches, install and reboot on my firewalls, without at least some sort of intervention on my part.

FWIW, although most places I work at are licensed for SmartUpdate (license is included with license for RTM), and I've done some major updates with it, I don't normally bother. For me, it's usually better to just scp the packages out, untar and run the HFA - that way I can sit on it and watch what's going on. When you've got millions of dollars going through systems, patching becomes a big issue - and saving 5 minutes by using a GUI rather than command line is pretty much irrelevant.

Mind you, from what I hear Check Point uses SmartUpdate in a big way internally. Probably good if you need to blitz a test lab. But then they did have a massive network outage last week...

By major Vendors I meant Microsoft. Well , if you can donwload/upgrade from SmartUpdate - then that's what i was looking for. I am just starting with CP and havent yet performed any upgrades. CP is little confusing to me so far.

The client i am dealing with has ( from user center ):

Subscription and Support
==================
Software Subs. Expiration Date: 01-Feb-2007 Type: Enterprise SW Subscription & Standard Support

Antivirus Subs. No Antivirus Subscription for this product

Antispyware Subs. No Antispyware Subscription for this product

SmartDefense Subs. No SMRD Subscription for this product

Support Expiration Date: 01-Feb-2007 Type: Enterprise SW Subscription & Standard Support


So I guess the Software Subs thing gives them the ability to use SmartUpdate to download patches. Does this include SmartDefense updates ?

[RayPesek]

Welcome to Check Point! If you're only a little confused, you're doing great. Unfortunately, licensing the product is where it really gets confusing.

If you go to http://pricelist.checkpoint.com, you'll see the different products and their list prices. The General Price List is what you're looking for.

Go into your Account section and note the license strings and try to match them to the price list. From your description, you do not get SmartDefense updates. You can still use it, but you would need to write the tests yourself. I think SmartDefense is one of the good features and it's not that expensive.

SmartUpdate is partially free, the part that lets you manage licenses. The first tab is what costs money.

Like Northlandboy, I rarely use SmartUpdate for precisely the same reasons he quoted. I like to see what's going on as it occurs. I do keep the SmartUpdate repository up to date with the various packages in case I should need to use it for some reason.

For R62, you go to the downloads page and go into the Upgrade Kits section. There you can get the CDs mailed to you for free. http://www.checkpoint.com/downloads/index.html under the Quick Links section.

Ray