The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
60000 / 40000 Appliances - Software and Hardware Compatibility
Technical Level
Solution ID
sk93332
Technical Level
Product
Quantum Scalable Chassis
Version
R80.20SP, R81, R81.10, R81.20
OS
Gaia
Platform / Model
41000, 44000, 61000, 64000
Date Created
06-Aug-2013
Last Modified
14-Dec-2022
Solution
Note : This article also applies to R76SP.50.
Table of Contents:
Software and Firmware versions
Hardware software revision
Software Blades support
Chassis and Modules Compatibility
Security Switch Module (SSM) Compatibility
Security Gateway Module (SGM) Compatibility
Supported upgrade paths
Related solutions
Revision history
Software and Firmware versions
For Firmware Packages, refer to sk161293 - Firmware Packages for Scalable Platforms 40000 / 60000
To check the current firmware version on all SGMs, run:[Expert@HostName:0]# asg_version -v
Enter the string to filter this table:
Component / Version
R76SP / R76SP.10 /R76SP.20 / R76SP.30 /R76SP.40
R76SP.50 / R80.20SP / R81 / R81.10 / R81.20
Check Point software
R76SP Take 139
R76SP.10 Take 146 + Jumbo HF
R76SP.20 Take 60
R76SP.30 Take 47 + Jumbo HF
R76SP.40 Take 73
SSM60 Base switch configuration
7.5.20
N / A
SSM60 Base switch firmware
7.5.20
N / A
SSM60 Fabric switch configuration
7.5.20
N / A
SSM60 Fabric switch firmware
7.5.20
N / A
SSM160 firmware
7.5.20 for R76SP and above
5.5.R1.4.CP404.T-ATCA404.binoxpkg- R76SP.30 and above
5.5.R1.6.CP.T-ATCA404.binoxpkg
SSM440 firmware
N / A
5.5.R5.7.CP.T-ATCA510.binoxpkg
CMM firmware
3.70-rev6.1 (61000 N+1 / 41000)
3.70-rev6 (61000 N+N / 64000 / 44000)
SGMs BIOS image
SGM220: 1.3
SGM260: 2.1
SGM400: 2.28
IPMC bootloader image
SGM220: 1.54
SGM260: 1.36 (1)
SGM220: 1.54
SGM260: 1.40 (upgrade only if necessary)
SGM400: 1.00
IPMC firmware image
SGM220: 1.54
SGM260: 1.4
SGM400: 1.14
FPGA image
SGM220: 1.54
SGM260: 2.4
SGM400: 2.34
FPGA recovery image
SGM220: 2.4
SGM260: 2.66
SGM400: 2.34
SSD firmware
4PC10362 or 2CV102M3
SGM220
SGM260
SGM400
D2010355
400i
D2010370
G2010130
G2010140
G2010150
N2010101
N2010110
N2010111
N2010112
N2010121
SCV10111
SCV10142
XCV10100
XCV10110
N2010112
N2010111
N2010101
N2010110
N2010121
SCV10111
SCV10142
XCV10100
XCV10110
XCV10120
Note : Upgrade only if necessary. All versions between 1.36 and 1.40 are supported.
Hardware software revision
CMM firmware file listed in the below table contains the most updated version according to the installed Jumbo Hotfix Take. To validate the file content, refer to sk117633 and the listed MD5 for each file.
Files listed in the below table, are under $FWDIR/conf/hw_firmware
SSM
HW type
Firmware Version
Firmware Content
SSM160
Version: 5.5.R1.4.CP404
File: 5.5.R1.4.CP404.T-ATCA404.binoxpkg
MD5: f58ff6405cf1e1c50e71521e3f0b9b76
The device now supports an improved mechanism for automatic recovery of the Packet processor internal tables from parity errors
Added a new Load-balancing option, which is based on IP packet's TCP/UDP port
Supporting monitoring of parity counter
Limitation on the amount of VLANs rules on the SSM.
Version: 5.5.R1.5.CP
File: 5.5.R1.5.CP.T-ATCA404.binoxpkg
MD5: ae8c9b37a3957541762ba260bd3859ba
When working with L4 distribution, the SSM will accept the distribution matrix after SSM reboot
Support of Bidirectional 40G transceiver
Version: 5.5.R1.6.CP
File: 5.5.R1.6.CP.T-ATCA404.binoxpkg
MD5: 8b0109e8dd956f9d33fbc290199369e4
Persistent logging for the SSM messages logs.
Prevent specific types of broadcast / multicast traffic, received on the SSM front panel management interfaces, from reaching the SSM OS and overloading its CPU.
SSM440
Version: 5.5.R5.2.CP
File: 5.5.R5.2.CP.T-ATCA510.binoxpkg
MD5: 41847956cc99df7fee23c923e545e257
GA firmware for SSM440
The device now supports an improved mechanism for automatic recovery of the Packet processor internal tables from parity errors
Added a new Load-balancing option, which is based on IP packet's TCP/UDP port
Supporting monitoring of parity counter
Limitation on the amount of VLANs rules on the SSM.
Version: 5.5.R5.3.CP
File: 5.5.R5.3.CP.T-ATCA510.binoxpkg
MD5: 5a04014710ad305155e2740cabc746d5
When working with L4 distribution, the SSM will accept the distribution matrix after SSM reboot
Support of Bidirectional 40G transceiver.
Version: 5.5.R5.6.CP
File: 5.5.R5.6.CP.T-ATCA510.binoxpkg
MD5: 4c76e083d72071eedc259fe8f2684966
When working with 1G transceiver on the SSM management ports, after SSM reboot the link will be shown as UP but traffic will not pass.
On some cases, there is a traffic latency between the SGM and the SSM when using management ports.
On some cases the SSM buffer for CIN traffic is getting fully utilized, causing drops of fragmented traffic between the SGM and the SSM.
Version: 5.5.R5.7.CP
File: 5.5.R5.7.CP.T-ATCA510.binoxpkg
MD5: 5bd3ec533c618ef0c86231d70d9da33c
Persistent logging for the SSM messages logs
Prevent specific types of broadcast / multicast traffic, received on the SSM front panel management interfaces, from reaching the SSM OS and overloading its CPU.
CMM
HW type
Firmware Version
Firmware Content
61K N+N / 44K / 64K
Version: 3.40-rev4
MD5: 430f12e91172908c4743b2a138a6f65f
Version: 3.40-rev6.1
File: SM700_update.tar
MD5: 6156fea5f1c1bf87b98cce47d8831ee5
GA firmware for 64k / 44K
Disable CMM HPM2 communication with SGMs
Version: 3.70-rev6
File: SM700CC_update.tar
MD5: ce2776cd59c57cc369a1a0bb20895273
Support replacement CPU and Memory components on the CMM. Refer to sk138652 .
Chassis fans sporadically going to max speed. After a few minutes, the speed will go back to normal values. This is caused by a bad reading of the fans sensors in the chassis, which cause the CMM to think that they are not rotating. As a response, the CMM sets all fans to max speed. The new firmware implements a mechanism that buffers the readings of the fans sensors, when sampled, the buffer median is taken as the sensor value.
61K N+1 / 41K
Version: 3.70-rev6.1
File: SM_update.tar
MD5: cfc973213fcff47e3631c80f2c60a094
Chassis fans sporadically going to max speed. After a few minutes, the speed will go back to normal values. This is caused by a bad reading of the fans sensors in the chassis, which cause the CMM to think that they are not rotating. As a response, the CMM sets all fans to max speed. The new firmware implements a mechanism that buffers the readings of the fans sensors, when sampled, the buffer median is taken as the sensor value
SGM
HW type
Firmware Version
Firmware Content
SGM400
Version: IPMC 1.02
GA IPMC firmware for SGM400
Version: IPMC 1.14
File: mic5342_ipmc_checkpoint_1.14.img
MD5: f1bd3bb25f1af8fd4144a656ba7f492c
Communication interruption on the chassis IPMB channels may cause several issues. Refer to sk123571 .
Software Blades support
Software Blade / Feature
R76SP / R76SP.10 /R76SP.20 / R76SP.30 /R76SP.40 / R76SP.50 / R80.20SP / R81 / R81.10 / R81.20
GW mode
VSX mode
Firewall
Yes
Yes
IPSec VPN
Yes (1)
Yes
IPS
Yes
Yes
Anti-Virus
Yes
Yes
Anti-Bot
Yes
Yes
Anti-Spam
Yes (3)
No
URL Filtering
Yes
Yes
Identity Awareness
Yes
Yes
Application Control
Yes
Yes
Mobile Access
Yes
Yes (3)
Data Loss Prevention
Yes (1)
No
Monitoring
No
No
HTTPS Inspection
Yes (1)
Yes (1)
Hit Count
Yes
Yes
Threat Emulation
Yes (2)
Yes (2)
QoS
No
No
Notes:
For IPv4 addresses only.
Supported starting from R76SP.40
Supported starting from R80.20SP.
Chassis and Modules Compatibility
The following table shows which Modules and Software are supported by which Chassis model:
41000 AC chassis
61000 N+1
61000 N+N AC chassis
64000 AC chassis
44000 AC chassis
PSU sockets (2)
C13
C13
C19
C19
C15
SSM60 (5)
No
Yes (GW mode, 2 SSMs)
Yes (GW mode, 2 SSMs)
No
No
SSM160
Yes
Yes
Yes
Yes
No
SSM440 (8)
No
Yes
Yes
Yes
Yes
SGM220 (6)
Yes
Yes (3)
Yes (4)
No
No
SGM220T (for NEBS) (6)
No
Yes (4)
Yes (4)
No
No
SGM260 (7)
Yes
Yes
Yes
Yes
Yes
SGM400 (9)
No
No
Yes (8)
Yes
Yes
CMM Type A
Yes
Yes
No
No
No
CMM Type B
No
No
Yes (10)
Yes
Yes
Software
R76SP and above
R76SP.10 + JHF Take 51 or higher and above
R76SP.50 and above
R76SP.50 and above
Notes :
R80.20SP does not support a 4-SSM deployment.
Old chassis: 3 power supply units in a 1U Tray; 2 such 1U Trays per chassis.
Power cord depends on the country and whether customer connects the chassis to a rack, or to a power outlet.
Common order.
Less common order. When ordered - need to double check.
SSM60 is not supported in VSX mode or in a 4-SSM deployment.
SSM60 is not supported in R80.20SP.
SGM220 / SGM220T is not supported in a 4-SSM deployment.
SGM260 supports a 4-SSM deployment.
Additional PSUs are required in order to maintain N+N Redundancy Capabilities for more than 9 SGMs.
Requires R76SP.50 and above.
On 61000 N+N chassis, the CMM firmware is unique and is not interoperable with other chassis.
Security Switch Module (SSM) Compatibility
Notes, referenced in the tables, appear at the end of this section.
Management ports - Speed, Transceivers, and SKU (3)
The following table shows the information about Management ports on various SSMs:
SSM
Port speed
Transceiver type
SKU
SSM60 (1)
2 x 1 GbE / 100 Mb
SFP RJ-45 copper
CPAC-TR-1T-SSM60/160-SFP
SFP fiber SX
CPAC-TR-1SX-SSM60-SFP
SFP fiber LX
CPAC-TR-1LX-SSM60-SFP
2 x 10 GbE
XFP fiber SR
XFP fiber LR
SSM160
2 x 1 GbE / 100 Mb
SFP RJ-45 copper
CPAC-TR-1T-SSM60/160-SFP
SFP fiber SX
CPAC-TR-1SX-SSM160-SFP
SFP fiber LX
CPAC-TR-1LX-SSM160-SFP
SFP fiber SR
CPAC-TR-1SR-SSM160-SFP
2 x 10 GbE
SFP+ fiber SR
CPAC-TR-10SR-SSM160-SFP+
SFP+ fiber LR
CPAC-TR-10LR-SSM160-SFP+
SSM440
2 x 10/100/1000BASETX
SFP RJ-45 copper
CPAC-TR-1T-SSM440
2 x 10 GbE
SFP+ fiber SR
CPAC-TR-10SR-SSM440
2 x 10 GbE
SFP+ fiber LR
CCPAC-TR-10LR-SSM440
Traffic ports - Speed, Transceivers, and SKU (3)
The following table shows the information about Traffic ports on various SSMs:
Enter the string to filter this table:
SSM
Port speed
Transceiver type
SKU
SSM60 (1)
5 x 10 GbE
XFP fiber SR
XFP fiber LR
SSM160
7 x 1 GbE / 10 GbE
SFP+ fiber SR
CPAC-TR-10SR-SSM160-SFP+
SFP+ fiber LR
CPAC-TR-10LR-SSM160-SFP+
SFP fiber SR
CPAC-TR-1SR-SSM160-SFP
SFP fiber SX
CPAC-TR-1SX-SSM160-SFP
SFP fiber LX
CPAC-TR-1LX-SSM160-SFP
SFP RJ-45 copper
CPAC-TR-1T-SSM60/160-SFP
2 x 40G
Use SR splitter to convert each port to 4 x 10 GbE (total of 2x4x10G)
QSFP fiber SR
CPAC-TR-40SR-SSM160-QSFP
QSFP fiber LR
CPAC-TR-40LR-SSM160-QSFP
BiDi QSFP fiber SR (40G, MM, LC)
CPAC-TR-40SR-QSFP-BIDI
SSM440
7 x 1 GbE / 10 GbE
SFP+ fiber SR (10G, MM, LC)
CPAC-TR-10SR-SSM440
SFP+ fiber LR (10G, SM, LC)
CPAC-TR-10LR-SSM440
SFP fiber SX (1G, MM, LC)
CPAC-TR-1SX-SSM440
SFP fiber LX (1G, SM, LC)
CCPAC-TR-1LX-SSM440
SFP RJ-45 copper (1G)
CPAC-TR-1T-SSM440
2 x 40 GbE / 100 GbE
Use SR splitter to convert each port to 4 x 10 GbE (total of 2x4x10G)
QSFP fiber SR (40G, MPO)
CPAC-TR-40SR-SSM440
QSFP fiber LR (40G, SM, LC)
CPAC-TR-40LR-SSM440
BiDi QSFP fiber SR (40G, MM, LC)
CPAC-TR-40SR-QSFP-BIDI
QSFP28 fiber SR (100G, MM, MPO)
CPAC-TR-100SR-SSM440
QSFP28 fiber MR CWDM (100G, SM, LC)
CPAC-TR-100MR-SSM440
QSFP28 fiber MR LAN WDM (100G, SM, LC)
CPAC-TR-100MR-WDM-SSM440
QSFP28 fiber LR CWDM (100G, SM, LC)
CPAC-TR-100LR-SSM440
4 x 40 GbE
Use SR splitter to convert each port to 4 x 10 GbE (total of 4x4x10G)
QSFP fiber SR (40G, MPO)
CPAC-TR-40SR-SSM440
QSFP fiber LR (40G, SM, LC)
CPAC-TR-40LR-SSM440
BiDi QSFP fiber SR (40G, MM, LC)
CPAC-TR-40SR-QSFP-BIDI
Sync ports (2) - Speed, Transceivers, and SKU (3)
The following table shows the information about Sync ports on various SSMs:
SSM
Port speed
Transceiver type
SKU
SSM60 (1)
1 x 10 GbE
XFP fiber SR
XFP fiber LR
SSM160
1 x 10 GbE
SFP+ fiber SR
CPAC-TR-10SR-SSM160-SFP+
SFP+ fiber LR
CPAC-TR-10LR-SSM160-SFP+
SSM440
1 x 10 GbE
SFP+ fiber SR (10G, MM, LC)
CPAC-TR-10SR-SSM440
SFP+ fiber LR (10G, SM, LC)
CPAC-TR-10LR-SSM440
Security Gateway Modules (SGMs) support
The following table shows the supported combinations of various SSMs and SGMs on the chassis:
Important Note: Unless specifically stated otherwise, this table applies to all chassis models (41000 / 44000 / 61000 / 61000 N+N / 64000).
SGM
SSM60 (1)
SSM160
SSM440
SGM220
Yes
Yes
Yes
SGM220T (for NEBS) (*)
Yes
Yes
Yes
SGM260
Yes (**)
Yes
Yes
SGM400
No
Yes
Yes
(*) SGM220T is supported only by the 61000 / 61000 N+N Security Systems.(**) Only 2 x SSM60 (Dual Star).
Software versions support
The following table shows which SSMs are supported by which software versions:
Version
SSM60 (1)
SSM160
SSM440
R76SP
GW mode only
GW and VSX modes
No
R76SP.10
GW mode only
GW and VSX modes
No
R76SP.20
GW mode only
GW and VSX modes
No
R76SP.30
GW mode only
GW and VSX modes
No
R76SP.40
GW mode only
GW and VSX modes
No
R76SP.50
No
GW and VSX modes
GW and VSX modes
Backplane topology support
The following table shows which SSMs support various Dual Star topologies:
Topology
SSM60 (1)
SSM160
SSM440
Dual Star (2-SSM deployment)
Yes
Yes
Yes
Dual Dual Star (4-SSM deployment)
No
Yes (4)(5)
No
Notes:
R80.20SP does not support a 4-SSM deployment.
SSM60 is not supported in VSX mode, or in a 4-SSM deployment.
In HA chassis, customer must purchase four transceivers for sync purposes.
Refer to Product Catalog :
Go to the section "More Appliances & Solutions
"
Click on the "Customized Solutions
"
In the "Model
" column, select the appliance
In the "Model Information
" column, click on the "Select
" button
In the section "Accessories & Add Ons
", click on the "More Accessories & Add ons
" link
Refer to 44000 and 64000 Security Systems datasheet and 41000 and 61000 Security Systems datasheet .
Supported starting from R76SP , only on 61000 chassis with SGM260.
Not supported on R80.20SP
Security Gateway Module (SGM) Compatibility
Hardware information
The following table shows various hardware information about SGMs:
Criteria
SGM220
SGM220T (for NEBS) (1)
SGM260
SGM400
CPU Cores
8 / 12
8 / 12
20 physical / 40 with enabled Hyper Threading
28 physical / 56 with enabled Hyper Threading
RAM
12 GB / 24 GB
12 GB / 24 GB
64 GB
64 GB, but faster than SGM260
Back-plane interfaces
10 GbE
10 GbE
10 GbE
40 GbE (2)
Serial Over LAN
No
No
No
Yes
Notes:
SGM220T is supported only by the 61000 / 61000 N+N Security Systems.
Refer to sk118435: 60000 / 40000 Appliances - Working with 40G Back Plane connectivity for SGM400 .
Software versions support
The following table shows which SGMs are supported by which software versions:
(*) SGM220T is supported only by the 61000 / 61000 N+N Security Systems.
Supported combinations of different SGMs on the same chassis
By default, you should always install pairs of the same SGMs (e.g., either 2 x SGM260, or 2 x SGM400). Only in specific cases, it is supported to install a combination of different SGMs.
SGM220
SGM220T (for NEBS) (*)
SGM260
SGM400
SGM220
Yes
Yes (**)
No
No
SGM220T
Yes (**)
Yes
No
No
SGM260
No
No
Yes
No
SGM400
No
No
No
Yes
(*) SGM220T is supported only by the 61000 / 61000 N+N Security Systems.(**) Not the recommended, as the SGM220T may become a system bottle due to different CPU frequencies.
Supported upgrade paths
The following table shows the supported upgrade paths:
Source version
Target version
R76SP
R76SP.10
R76SP.10_VSLS
R76SP.20
R76SP.30
R76SP.40
R76SP.50
R80.20SP
R81
R81.10
R81.20
R76SP
x
Yes
Yes
Yes
Yes
Yes
No
No
No
No
No
R76SP.10
x
x
Yes
Yes
Yes
Yes
Yes
No
No
No
No
R76SP.10_VSLS
x
x
x
Yes
Yes
Yes
Yes
No
No
No
No
R76SP.20
x
x
x
x
Yes
Yes
Yes
No
No
No
No
R76SP.30
x
x
x
x
x
Yes
Yes
No
No
No
No
R76SP.40
x
x
x
x
x
x
Yes
No
No
No
No
R76SP.50
x
x
x
x
x
x
x
Yes
Yes
Yes
Yes
R76SP and above require Security Management Server / Multi-Domain Security Management Server R76 and above.
R80.20SP should be handled by R80.20 Management Servers or R80.10 Management Server with Jumbo HFA Take 203 and above.
Refer to 60000 / 40000 Security System Release Notes (R76SP , R76SP.10 , R76SP.10_VSLS , R76SP.20 , R76SP.30 , R76SP.40 , R76SP.50 , R80.20SP )
Revision history
Applies To:
This SK replaces sk100556