Changes made in R77 Global Policy in the 'IPSec VPN - Link Selection' in the global Security Gateway object are not exported to R77 Domain Management Servers

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk97883
Technical Level
Product	Multi-Domain Security Management
Version	R77 (EOL)
Platform / Model	All
Date Created	27-Dec-2013
Last Modified	16-Nov-2015

Symptoms

Changes made in Global Policy in the 'IPSec VPN - Link Selection' in the global Security Gateway object are not exported to Domain Management Servers:
1. SmartDomain Manager - 'Global Policies' tab.
2. Right-click on Global Policy - 'Open Selected Global Policy'.
3. Open the global Security Gateway object.
4. Go to 'IPSec VPN' pane - go to 'Link Selection'.
5. In the section 'IP Selection by Remote Peer' - select 'Always use this IP address' - go to 'Selected address from topology table' - select an IP address.
6. In the section 'Outgoing Route Selection' - click on 'Source IP address settings...' button - select 'Manual' - go to 'Selected address from topology table' - select an IP address.
7. Save the changes ('File' menu - 'Save').
8. Right-click on the Global Policy - click on 'Assign/Install Global Policy ...'.
9. SmartDomain Manager - 'General' tab.
10. Right-click on the Domain Management Server - 'Launch Application' menu - 'SmartDashboard'.
11. Open the global Security Gateway object.
12. Go to 'IPSec VPN' pane - go to 'Link Selection'.
13. In the section 'IP Selection by Remote Peer' - correct settings appear as were selected in Global Policy: 'Always use this IP address' - 'Selected address from topology table' - the IP correct address appears.
14. In the section 'Outgoing Route Selection' - wrong settings appear: click on 'Source IP address settings...' button - the 'Automatic' is always selected instead of 'Manual'.

Cause

Relevant information form the Domain level was not exported to the Global SmartDashboard.

Solution

This problem was fixed. The fix is included in:

Check Point R77.10

Check Point recommends to always upgrade to the most recent version (upgrade Security Gateway / upgrade Security Management Server / upgrade Multi-Domain Security Management Server).

For R77, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

Hotfix installation instructions:

Hotfix has to be installed on Multi-Domain Security Management Server.
Transfer the hotfix package to the machine (into some directory, e.g., /some_path_to_fix/).
Unpack the hotfix package:

[Expert@HostName]# cd /some_path_to_fix/
[Expert@HostName]# tar zxvf fw1_wrapper_HOTFIX_NAME.tgz
Install the hotfix:

[Expert@HostName]# ./fw1_wrapper_HOTFIX_NAME

Note: The script will stop all the Check Point services (cpstop) - read the output on the screen.
Reboot the machine.

Screenshot of the issue:

This solution is about products that are no longer supported and it will not be updated

Applies To:

01322693 , 01336003 , 01336016

Give us Feedback

Please rate this document

[1=Worst,5=Best]

Comment
	Submitting rating