Support Center > Search Results > SecureKnowledge Details
Changes made in R77 Global Policy in the 'IPSec VPN - Link Selection' in the global Security Gateway object are not exported to R77 Domain Management Servers
Symptoms

  • Changes made in Global Policy in the 'IPSec VPN - Link Selection' in the global Security Gateway object are not exported to Domain Management Servers:

    1. SmartDomain Manager - 'Global Policies' tab.
    2. Right-click on Global Policy - 'Open Selected Global Policy'.
    3. Open the global Security Gateway object.
    4. Go to 'IPSec VPN' pane - go to 'Link Selection'.
    5. In the section 'IP Selection by Remote Peer' - select 'Always use this IP address' - go to 'Selected address from topology table' - select an IP address.
    6. In the section 'Outgoing Route Selection' - click on 'Source IP address settings...' button - select 'Manual' - go to 'Selected address from topology table' - select an IP address.
    7. Save the changes ('File' menu - 'Save').
    8. Right-click on the Global Policy - click on 'Assign/Install Global Policy ...'.
    9. SmartDomain Manager - 'General' tab.
    10. Right-click on the Domain Management Server - 'Launch Application' menu - 'SmartDashboard'.
    11. Open the global Security Gateway object.
    12. Go to 'IPSec VPN' pane - go to 'Link Selection'.
    13. In the section 'IP Selection by Remote Peer' - correct settings appear as were selected in Global Policy: 'Always use this IP address' - 'Selected address from topology table' - the IP correct address appears.
    14. In the section 'Outgoing Route Selection' - wrong settings appear: click on 'Source IP address settings...' button - the 'Automatic' is always selected instead of 'Manual'.
Cause

Relevant information form the Domain level was not exported to the Global SmartDashboard.


Solution

This problem was fixed. The fix is included in:

Check Point recommends to always upgrade to the most recent version (upgrade Security Gateway / upgrade Security Management Server / upgrade Multi-Domain Security Management Server).

 

For R77, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

Hotfix installation instructions:

  1. Hotfix has to be installed on Multi-Domain Security Management Server.

  2. Transfer the hotfix package to the machine (into some directory, e.g., /some_path_to_fix/).

  3. Unpack the hotfix package:

    [Expert@HostName]# cd /some_path_to_fix/
    [Expert@HostName]# tar zxvf fw1_wrapper_HOTFIX_NAME.tgz

  4. Install the hotfix:

    [Expert@HostName]# ./fw1_wrapper_HOTFIX_NAME

    Note: The script will stop all the Check Point services (cpstop) - read the output on the screen.

  5. Reboot the machine.

 

 

Screenshot of the issue:

Applies To:
  • 01322693 , 01336003 , 01336016

Give us Feedback
Please rate this document
[1=Worst,5=Best]
Comment