In R70 (and NGX) the location of the user.def file has changed. Any changes to user.def are made to individual files based on the compatability package for the gateway version that the change is being installed on. Files per version are:
R70-R71: $FWDIR/conf/user.def.NGX_FLO$
R60-R65:$FWDIR/conf/user.def.NGX_R60
R55W: $FWDIR/conf/user.def.R55WCMP
NG (FP3-R55):$FWDIR/conf/user.def.NGCMP
Edge: $FWDIR/conf/user.def.EdgeCmp
The more I use the Smart-1 Appliances from Check Point, the more I dislike the option.
I applied HFA_20 to R70.1 to redundant Smart-1 appliances today and they both lost all there IP settings and routes.
Lucky for me the Lights Out Management worked and I was able to get back in and add the IP address and default route.
I don’t understand, this isn’t rocket science. Check Point had better get their act together in the appliance area or they are going to have a pretty upset customer base.
Just an FYI to anyone out there that is looking to upgrade, make sure you have out of band management if you are going to upgrade to HFA_20 on R70.
There is a memory leak in R65 and R70 with the cpd process. When a firewall is queried the memory leak occurs when cpd responds to that query.
This has been fixed in HFA_60 for those of you running R65. There is no fix out yet for anyone running R70.
If you are upgrading to R70 from R65 and have installed at least two of the following HFA’s to R65 you may have server stability issues
HFA 30
HFA 40
HFA 50
To avoid issues before upgrading run
rm -f /opt/CPsuite-R65/fw1/PA/conf/PA/PA
If you are doing an upgrade_export run the command before preforming the upgrade_export
Note if you are installing from scratch this isn’t a problem.