R65 HFA01 released

[dantro]

It's a huge download and it fixes many critical issues regarding licenses, passwords, Edges, Management-HA etc.

Install on R65 Enforcement Modules and especially on your SCS asap.

Check Point Software Technologies: Support Providers Only Login

[chillyjim]

This is currently available only to CSP's and not the general public.

Public release should be in about a week if CSP testing goes well.

[melipla]

Originally Posted by dantro

It's a huge download and it fixes many critical issues regarding licenses, passwords, Edges, Management-HA etc.

Thanks for the heads up, any chance we can get a list of bugfixes?

[joris]

Yep, to know the included fixes would be nice.

grtz,

[mcnallym]

Release notes are too big to attach and at 21 pages a bit big to cut and paste.

There are a total of 55 improvements/fixes hence I am not going to type it all out or cut and paste.

[cciesec2006]

Here is my take on R65 HFA_01.

Scenario A:
1) install a fresh build P-1 R65 on SPLAT,
2) migrate CMA from R55 HFA_17 into R65,
3) Everything is work fine,

Scenario B:
1) install a fresh build P-1 R65 on SPLAT,
2) Apply HFA_01,
3) migrate CMA from R55 HFA_17 into R65,
4) CMA FAILED to start.

In other words, HFA_01 has issues.

my 2c

[lammbo]

Woo Hoo! I just read the release notes and 8 of these fixes are for my Eventia Suite. I know at least 6 of them, I am solely responsible for identifying. Seems like CP support always has a copy of my DB in their lab.

I'm on the fence whether this is a good thing or not... LOL Makes me wonder if I'm the only one running Eventia sometimes.

[joris]

Originally Posted by cciesec2006

Here is my take on R65 HFA_01.

Scenario A:
1) install a fresh build P-1 R65 on SPLAT,
2) migrate CMA from R55 HFA_17 into R65,
3) Everything is work fine,

Scenario B:
1) install a fresh build P-1 R65 on SPLAT,
2) Apply HFA_01,
3) migrate CMA from R55 HFA_17 into R65,
4) CMA FAILED to start.

In other words, HFA_01 has issues.

my 2c

HFA_01 idd had issues since they released a revised HFA_01.

[dantro]

We've also encountered issues with the old HFA_01. Didn't test the new revision yet. I really dislike how Check Point handles these things. They shouldn't officially release a HFA and revise it without any notification. The latest release information from yesterday also says "September 24, 2007". Looks like Copy&Paste. I wish they would put more time into the quality of their products.

[lammbo]

I seem to recall that CP did exactly the same thing before, I think it was with HFA_01 for R60.

I recall that there was much confusion over this because once you download HFA_01, you expect the next release to be 02, not a re-pack of 01 that nobody was notified was in error on the first build.

This is very bad behavior on behalf of CP. The LEAST they could do is notify us.

[chillyjim]

This is why it is released on the CSP only site first.

If you are a CSP you should have gotten the notice that it was updated with additional fixes.

[RayPesek]

Nokia has the release notes available at https://infocenter.knowledge.nokia.c...0707&actp=LIST

56 fixes.

Ray

[hanjan]

Hello all!

I tried to install R65 HFA_01 on my SCS today and got no errors during install, but after reboot it turned out that a lot of files in the lib directory has a size of zero bytes.

Error message is only: "error while loading shared libraries: /opt/CPshrd-R65/lib/libscis.so
: file is too short"

Effects of this include that the network does not start, neither does the CP products.

As Murphy's law dictates - my backup file is corrupt :(

Does anyone have a tip on how to resolve this issue? And is this a common error?


Best regards,
Jan-Ivar

[Porter]

I did the update in a test environment -> splat smartcenter, everthing went fine, no issues or problems

[RayPesek]

I'd run an upgrade_export right now if I were you and copy it somewhere safe.

Have you tried just running the uninstall script?

Ray

[Porter]

also did it on a splat enforcement point without any issues

[Porter]

and finally did the update on several productive splats without any issues

[melipla]

Had problems installing this on my SmartCenter server, restoring from backup now...

[RayPesek]

While you're waiting, what were the problems?

Ray

[dantro]

I had problems on the SCS as well. Couldn't add internal interfaces in topology anymore, only external ones. Couldn't define an encryption domain and so on, the setting was always on "Host only". Deinstalled the HFA_01 and everything was just fine. Could choose "Network based on topology" or a manual encryption domain. "Host only" wasn't even shown without HFA_01 anymore. And the QoS license was still not being accepted even though the release notes say this was fixed.