🚀 go-pugleaf

Hi,

I would like to share with you my experience of working with FW1 & might
like to hear yours.

New installations of FW1 NG are working better than 4.x except integration
problems with Win2k AD & OPSEC . The performance, licensing, SecureUpdate,
logging, policy editor are worth praise. But all is not well if you are to
upgrade from 4.x to NG.

As NG is heavily relying upon SIC and internal CA for inter module
communication. The object.c file is not downward compatible either and
firewall objects contain references to internal CA. The first problem we
encountered was that the installation process never asked about role of the
server the only way to let it ask you is uninstall existing 4.x. The
critical upgrade steps  'fw confmerge', 'fw checkobj' and 'fw cpmi_upgrade'
are not well documented. Also if one have had ver 4.1 with vpn & internal CA
then the upgraded NG will not run well and there will always be a problem in
uploading the policy as is someway relies on old poor internal CA. Same is
true about the converted firewall objects which will be carrying old
object.c definition. Although conf directory contains multiple versions of
object.c & rulebases.fws files still these files are also at other places
(may be database,..) because simply replacing conf with a backed up conf
(also NG) does not restore the old configuration.
I also experiences that upgrading and existing NG object rulebase file with
steps 'fw confmerge', 'fw checkobj' and 'fw cpmi_upgrade' is not possible. I
even tried uninstalling all but conf directory without any success.

I tried all different possible configuration for whole the week in
non-production time but every time the upgraded NG was not working well and
I had to rely on backup & second inst. of Win2k on the same system (thanks
to Windows 2000  on disk backup option). The last night I had to do all the
objects and rulebase Manually by going through old objects.c and snapshot
bitmaps of old policy & NAT. And even then there are problems setting up
SecuRemote through hybrid IKE and SMTP using NG security server and
resources definition (for avoidinging spamming)

So Checkpoint has lot of work to do if they want their customers to upgrade
to NG.


Regards,
AK