NGX R62 and Smartdefense issue

[ngxadmin]

I recently upgraded from SecurePlatform NGX_R60_HFA_02 to SecurePlatform NGX_R62. I have a distributed environment with a Smartcenter server and 2 enforcement nodes. All three boxes are Sun_V20Z with Opteron processors.

The first issue I noticed was an increase in cpu utilization on the active enforcment node. It went from 3-5% to 12-18% during normal business hours. I created a case with Checkpoint and it was explained that increased utilization was common with the upgrade to R62. So be it. Does not affect the end user performance.

The real problem is with updating Smartdefense. I was uptodate on Smartdefense on the R60 platform up till March 6th. I tried the smartdefense update on March 14th with R62. The updates downloaded ok. However, when I clicked save (JUST SAVE, IM NOT TALKING ABOUT POLICY PUSH) the hourglass came up and it took approximately 4 minutes to save. (Prior to that smartdefense update, it was taking 1-3 seconds to do the save (on R62)).

I created a case with Checkpoint and it was explained to me that Smartdefense is doing a whole bunch more stuff in R62 etc. etc. Using policy revision control, I reverted back to a policy created earlier in the day that did not have the March 14th Smartdefense update.

After indicating my dissatification on the followup Customer Feedback form, the case was reopened. Same explanation. R62/smartdefense is doing more stuff and there are other customers with this issue. Some policies are taking up to 15 minutes to install (dont know their platform or rulebase size).

I am used to a 15-30 second install. When you click install policy, a save is done. My habit is to make a change, click save and then do a policy install.
In my case, Ive got a 4 minute save time, plus another 4 minutes and 30 seconds.

Thats unacceptable in our environment. I am currently not updating smartdefense. I was wondering if there were other firewall administrators who have similiar scenarious with R62 and smartdefense.

Thank you.

[bspencer]

I noted the increased CPU usage (from 3-5% in R60 to 15-20% in R62), though, I have not noticed the deployment slowness you have been seeing (maybe only a little lag in R62 -- not the minutes you stated).

[RayPesek]

Likewise. 90 rules (including desktop policy and QoS), 300 objects or so, 1 GHz processor on Server 2003 with 512 MB of RAM. The saves went up to maybe fifteen or twenty seconds from five, but I can see the box is now underpowered because the CPU gets maxxed out, along with the memory in use. It was OK on R55 but barely.

I run with almost every SmartDefense check enabled as well.

Ray

[ngxadmin]

This issue was recognized by Checkpoint's Products Organization and has been fixed in R65 and will be fixed in the next HFA of R62 (HFA_01).

[ngxadmin]

Correction. Resoved in R62 HFA_02 (and R65).

[BarryStiefel]

Originally Posted by ngxadmin

This issue was recognized by Checkpoint's Products Organization and has been fixed in R65 and will be fixed in the next HFA of R62 (HFA_01).

Please stop shouting.

[RayPesek]

Originally Posted by ngxadmin

Correction. Resoved in R62 HFA_02 (and R65).

Bummer, since R62 HFA01 hasn't been released yet.

Ray

[sdrodgers]

Check Point is telling me the hot fix is 90 days out

[mrippe]

R65 is out, have you tested with it?

[ngxadmin]

No, I have not upgraded to R65 yet. I was told both the upcoming HFA for R62 and R65 resolved this issue. I was waiting to hear more from others in relation to R65 and potential other issues and stability etc.

[sdrodgers]

I have had problems with R62 and Smart Defense. When I upgraded my management server to R62 and one set of firewalls to R62. I noticed my CPU utilization on my R55 firewalls was rising. The CPU went to 98 - 100%. After further investigation I have found the problem to be R^62 Smart Defense. After I have disabled smart defense the cpu utilization came back down.
I did push policy from R62 management server to all my firewalls after upgrade.

[Pathnetworks]

I had this problem and had voted.

It took like 3 minutes to save, versus the 15 seconds with R61. Thinking this had been a failed upgrade of the SmartCenter, I did the following:

1. Used the upgrade scripts again to export my config.

2. Uninstalled everything and deleted the FW1 dir.

3. Restarted and reinstalled the SmartCenter and SmartConsole, pointing to my exported config.

Now my saves are back to normal. So the issue seemed to have been that a dll or something was still kicking around from R61? I noted that the older directories still seemed to exist until I had deleted them all.

The above approach also fixed a VPN-1 EDGE Sofaware server problem I was encountering as well.

[ngxadmin]

Resolved with Smartconsole_ NGX_R62HFA_01.

[cynthia.christy]

could you please get me an e-book on smart defense.....