> Source: [sk110315](https://support.checkpoint.com/results/sk/sk110315) # sk110315 - R80 Pre-Upgrade Verifier notifications and their solutions | Property | Value | |----------|-------| | Solution ID | sk110315 | | Date Created | 2016-02-28 | | Last Modified | 2019-04-16 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | | OS | Gaia | ## Solution This article describes the notifications received from the R80 Pre-Upgrade verifier and how to address them in order to successfully upgrade to R80. Errors are issues that must be addressed. Warnings are issues that will not fail the upgrade but it is highly recommended to address them. "Information" are notifications that just provide information about actions done by the upgrade process. **Also see [R80.10 Pre-Upgrade Verifier notifications and their solutions.](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117237)** **Table of Contents:** * Errors - Products and features Check Point no longer supports * Errors - Products and features that are not supported yet in R80 * Errors - Configuration issues * Warnings * Information * R80 Multi-Domain Security Management Server Errors - Products and features Check Point no longer supports {#Errors - Legacy products and features} ------------------------------------------------------------------------------------------------------ **Products and features that are no longer supported in R80. Refer to the solution column in order to fix the issues and proceed with the upgrade to R80** |---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Cause | Solution | | Firewall rule Action is no longer supported | Firewall rulebase contains rule(s) with the 'Session Auth' action that is no longer supported in R80. | In R7X SmartDashboard, refer to the Policy Package listed in the error message 1. Go to ***Firewall*** tab 2. Click on ***Policy*** 3. Refer to rules listed in error message 4. Replace ***Session Auth*** action with other supported action 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again Or refer to [sk98263](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263). | | Access Policy action is not supported | Firewall rules that contain the ***Client Auth*** action when the Sign-On method is set to ***Agent Automatic Sign On*** , ***Fully Automatic*** , or ***Single Sign On*** are no longer supported in R80. | 1. In R7X SmartDashboard, go to ***Firewall*** tab - click on ***Policy*** 2. Locate the rules listed in error message 3. Right-click on ***Client Auth*** action - click on ***Edit properties...*** 4. In ***Sign On Method*** section, replace the method to either ***Manual*** , or ***Partially automatic*** 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | Objects are not supported | The following products are no longer supported in R80: * Connectra Gateways * DLP-1 appliances * IPS-1 Sensor | Remove these products: 1. In R7X SmartDashboard, go to *Manage* menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | UTM-1 Edge X / W Series devices are not supported | The Database includes UTM-1 Edge X / W Series objects, which are no longer supported in R80. | Upgrade your devices to a supported version. In case you would like to remove these objects to proceed with the upgrade: 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***UTM-1 Edge Gateways*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | Services are no longer supported | The rulebase contains services or group of services which are no longer supported. | Refer to [sk103766](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103766). | Errors - Products and features that are not supported yet in R80 {#Errors - Currently unsupported products and features} ------------------------------------------------------------------------------------------------------------------------ **These products or features are not supported yet in R80 and will be supported in an upcoming R80 release.** **If you are using these products or features, consider upgrading to the relevant release when it is available. Otherwise, refer to the solution column to proceed with the upgrade to R80.** |--------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Cause | Solution | | Modbus is not supported yet | The Modbus feature is enabled, or a Modbus application exists while this feature is not supported yet in R80. | If you are using the Modbus feature, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. Before upgrade: 1. Close all SmartConsole windows 2. Connect with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to Security Management Server / Domain Management Server 3. In the upper left pane, go to ***Table*** - ***Global Properties Objects*** - ***properties*** 4. In the upper right pane, click on ***firewall_properties*** 5. Press CTRL+F (or go to ***Search*** menu - ***Find*** ) - paste ***modbus_applications_enabled*** - click on ***Find Next*** 6. In the lower pane, right-click on the ***modbus_applications_enabled*** - select ***Edit...*** - select "***false*** " - click on ***OK*** 7. Save the changes: go to ***File*** menu - click on ***Save All*** 8. Close the GuiDBedit Tool 9. Connect with SmartDashboard to Security Management Server / Domain Management Server 10. Go to ***Application \& URL Filtering*** tab 11. Click on ***Applications/Sites*** 12. Delete all applications with Type ***Modbus Application*** 13. Save the changes: go to ***File*** menu - click on ***Save*** 14. Run upgrade again | | LSM Profiles are not supported yet | The Database includes LSM Profiles. The LSM product is not supported yet in R80. | If you are using the LSM product, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. To proceed with the upgrade, remove the LSM profiles: 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | Cloud Connector objects are not supported yet | The Cloud Connector product is not supported yet in R80. | If you are using Cloud Connector, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. 1. In R77.30 SmartDashboard, go to ***Application \& URL Filtering*** tab 2. In the left tree, expand ***Advanced*** 3. Click on ***Cloud Connector*** 4. In the displayed view, delete Cloud Connector applications 5. Save the changes: go to ***File*** menu - click on ***Save*** | | LTE Services are not supported yet | LTE is not supported yet in R80. The rulebase contains one of the following LTE services: * GTPv2 * GTP_MM_V2 * GTP_ADDITIONAL_V2 * SCTP * Diameter | If you are using LTE, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. 1. In R77.30 SmartDashboard, go to ***Firewall*** tab 2. Click on ***Policy*** 3. Locate the rules that contain one of the following LTE services in ***Service*** column: * GTPv2 * GTP_MM_V2 * GTP_ADDITIONAL_V2 * SCTP * Diameter 4. Remove these LTE services from the policy (pay attention not to decrease the security of your environment) 5. It is also recommended to delete all instances of the those LTE services that were created by the user (default objects are removed automatically): 1. Go to ***Manage*** menu - click on ***Services...*** 2. In ***Show:*** field, select ***User defined services*** 3. Locate the user-defined LTE services 4. Delete the user-defined LTE services 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run upgrade again | | IoC (Indicators of Compromise) objects are not supported yet | IoC (Indicators of Compromise) objects are not supported yet in R80. | If you are using IoC, consider upgrading to the relevant release when it is available. Otherwise, remove the indicators to proceed with the upgrade to R80. | | Threat Extraction is not supported yet | The Threat Extraction software blade is not supported yet in R80. | If you are using Threat Extraction, consider upgrading to the relevant release when it is available. Otherwise, disable the Threat Extraction blade on the relevant R77.30 Security Gateways to proceed with the upgrade to R80. | | LSV Profile is not supported yet | There is a LSV profile object that is used in a VPN community. | If you are using LSV, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Interoperable Devices*** 3. Locate the LSV profile objects 4. Delete the LSV profile objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | CGNAT and NAT64 are not supported yet | CGNAT or NAT64 rules in NAT policy are not supported yet in R80. | If you are using CGNAT or NAT64 rules, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. 1. In R77.30 SmartDashboard, go to ***Firewall*** tab 2. Click on ***NAT*** 3. Refer to ***Translated Packet*** - check the ***Source*** column 4. Search for objects that are signed with NAT state as ***CG*** (for CGNAT), or ***64*** (for NAT64) 5. Delete the NAT rules that are defined as ***CGNAT*** , or ***NAT64*** 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run upgrade again | | Syslog Server is not supported yet | Use of Syslog server as log destination in the Security Gateway properties is not supported yet in R80. | If you are logging to a Syslog server, consider upgrading to the relevant release when it is available. Otherwise, implement the following instructions to proceed with the upgrade to R80. 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Servers and OPSEC Applications...*** 2. In ***Show:*** field, select ***Syslog servers*** 3. Locate the Syslog servers that are listed in the Pre-Upgrade Verification message 4. Select each listed Syslog server - click on ***Actions...*** button - click on ***Where Used...*** - write down the name of each involved Security Gateway object 5. Close the ***Servers and OPSEC Applications...*** window 6. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Servers and OPSEC Applications...*** 7. In ***Show:*** field, select ***Check Points*** 8. Locate the involved Security Gateway objects 9. Edit the involved Security Gateway objects 10. In Security Gateway properties, go to ***Logs*** pane 11. Remove all Syslog servers 12. Click on OK 13. Now you can delete the Syslog server objects 14. Save the changes: go to ***File*** menu - click on ***Save*** 15. Run upgrade again | | Data Center Objects Are Not Supported | Data Center objects on vSEC Controller R77.30 are not supported yet for upgrade - Data Center objects, Data Center groups, and Virtual Cloud objects. | Refer to [sk109796](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109796) to proceed with the upgrade to R80. | | Error in database | After upgrading from R77.20.01, or R77.30 EA to a newer version, SmartDashboard crashes when navigating to "Mobile Access Blade" -\> "Capsule Workspace Profiles". | Refer to [sk108698](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108698). | Errors - Configuration Issues {#Errors - Adjustments} ----------------------------------------------------- **These issues require a manual adjustment to enable the upgrade to R80.** |---------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Cause | Solution | | Protocols are not supported | Database contains services with unsupported protocol type. | For unsupported protocols refer to [sk103595](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103595). | | Application is not supported in application group | Upgrade is blocked due to existence of application groups that contain deprecated applications that will be replaced with a service. The listed applications were removed from the Application Control package. | Before upgrade: 1. In R7X SmartDashboard, go to ***Application \& URL Filtering*** tab 2. Click on ***Applications/Sites*** 3. Locate the application groups mentioned in the Pre-Upgrade Verification message 4. Remove the deprecated applications from from the application groups mentioned in the Pre-Upgrade Verification message 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | Users database needs to be fixed | Objects that are referenced in the *$FWDIR/conf/fwauth.NDB* file do not exist in the *$FWDIR/conf/objects_5_0.C* file. | Refer to [sk106158](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106158). | | Cluster member that is not part of a cluster is not supported | Database contains cluster members which are not part of a cluster (unused). | These cluster members are not used in your current deployment and can safely be deleted. Delete these objects before upgrade - either in SmartDashboard, or in [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009). Refer to [sk108612](http://supportcontent.checkpoint.com/solutions?id=sk108612). | | Standby Management Server | Standby Management Server should not be upgraded. It should synchronize with the Active Management Server after it is upgraded. | * Either: 1. Perform clean install of R80 2. Set it as Secondary Management Server in the First Time Wizard 3. Synchronize the Secondary Management Server with the Primary Management Server * Or: * Promote the Standby Management Server to be Active. | | Empty SIC | The SIC name with the Management Server has been lost. | Reset SIC on R7X Security Management Server: 1. ***\[Expert@HostName:0\]# fwm sic_reset*** 2. ***\[Expert@HostName:0\]# cp_conf ca init*** | | Empty IPv4 address | The Management Server has no IPv4 address defined. | 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate and edit the object of the Management Server 4. Define the IPv4 address and click on OK 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again | | Duplicate object IDs | There are duplicate objects with the same object ID. | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance, or follow these steps on R7X Management Server: 1. Collect complete backup (refer to [sk108902](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902)). At the very least, backup the *$FWDIR/conf/objects_5_0.C* file 2. Generate a new UID using the following online generator: [http://www.guidgen.com](http://www.guidgen.com/) 3. Edit the ***$FWDIR/conf/objects_5_0.C*** file using and advanced text editor (Vi, Notepad++, etc.) 4. Change the duplicate UID to the generated UID | | Corrupted object IDs | There are objects with corrupted UID. For example: * UID string length is not 38 * UID string does not start with "{", does not end with "}" * hyphens are not in the right places * hex digits are not in the right places | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance, or follow the below procedure: **Background** > The Object's UID should look like this: > `{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}` > The length of the entire string is 38 characters: > * 2 brackets - positions 1 and 38 > * 4 hyphens - positions 10, 15, 20 and 25 > * 8 hex digits - positions 2 - 9 > * 4 hex digits - positions 11 - 14 > * 4 hex digits - positions 16 - 19 > * 4 hex digits - positions 21 - 24 > * 8 hex digits - positions 26 - 37 > * allowed hex digits - 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f **Procedure** 1. Collect complete backup (refer to [sk108902](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902)). At the very least, backup the *$FWDIR/conf/objects_5_0.C* file 2. Generate a new UID using the following online generator: [http://www.guidgen.com](http://www.guidgen.com/) 3. Edit the ***$FWDIR/conf/objects_5_0.C*** file using and advanced text editor (Vi, Notepad++, etc.) 4. Change the corrupted UID to the generated UID | | GUI Clients | There is more than one client called "Any". | Delete the user ***Any*** by using ***cpconfig*** / ***msdconfig*** command. | | Objects with non-Unicode characters | Database contains objects with non-Unicode characters. | Follow [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795) - define encoding used for non-Unicode characters. | | Unsupported character encoding | User did not follow steps in [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795) correctly and defined unsupported encoding | Follow [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795). | | HTTPS Inspection policy contains unsupported objects | HTTPS Inspection policy contains the listed objects, which are no longer supported. | 1. In R7X SmartDashboard, go to ***Application \& URL Filtering*** tab. 2. In the left pane, expand ***Advanced*** 3. Expand ***HTTPS Inspection*** 4. Click on ***Policy*** 5. Remove the listed objects from the policy | | Unsupported NAT rules | 'Source' / 'Destination' address column in the Manual NAT rule either has corrupted values, or is empty | 1. In R7X SmartDashboard, go to ***File*** menu - click on ***Open...*** - select the Policy Package listed in the error message 2. Go to ***Firewall*** tab - in the left pane, click on ***NAT*** 3. Locate the NAT rules listed in the error message 4. Re-assign the Source / Destination address values as listed in the error message | Warnings {#Warnings} -------------------- Warnings are issues that will not fail the upgrade but it is highly recommended to address them. |------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Symptom (user experience) | Cause | Solution | | Names conflicts with new default objects | * Before upgrade: Warning that lists all the services and services groups whose names conflict with the new default objects added by Check Point and should be changed to another name * After upgrade: The name of the services and services group whose names were not changed before upgrade will contain underscore character ('_') as post-fix. | New services and protocols were added to the default database. If there are services with the same names, the user can change the service / service group name before upgrade. Otherwise, the upgrade process will append to the user services the underscore character ('_') as post-fix. | If there are naming conflicts with the new default objects and you would like to change the names rather than using our default "_" appendix to the name: * Before upgrade: 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Services...*** 2. Locate the services and services groups that are listed in the Pre-Upgrade Verification message 3. Change the names of the listed services and services groups * After upgrade: 1. In R80 SmartConsole, go to the Object Explorer 2. Locate for the services and services groups that are listed in the Pre-Upgrade Verification message 3. Change the names of the listed services and services groups (their names will contain '_' as postfix) | | Other Services are not supported | * Warning during upgrade of Security Management Server to R80 that *Other Services* are not supported: * "`At least one of the services contains invalid Match expression`" * "`To resolve, fix the Match expression of the unsupported service(s) (Other Service Properties > Advanced) or delete them`" * Error during policy installation on R80.10 Security Gateway that *Other Service* is unknown: `Error: Rule in Network Security policy will not be enforced, because service has unknown match/action` | The database contains *Other Service* objects with non-empty *Match* field (open *Other Service* properties - click on *Advanced...* button), which are not part of Check Point default services. In R80, the *Other Service* object definition has been modified - the *Match* field has been split into two fields: *Match* and *Action*. Conversion of objects from R77 (and lower) version to R80 is done automatically, but for user-defined services it may be incorrect. Therefore, the user is warned. | After a successful Upgrade, verify the objects were converted correctly, or manually convert the user-defined *Other Service* objects per [sk109195](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109195). | | Unsupported IPS protections | The unsupported IPS protections will be removed from the "Protections" view | Some IPS protections are no longer available in R80. | Refer to [sk103766](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103766). | | Deactivate IPS protections by categories | Deactivating IPS protections by categories in Threat Prevention profile will not take effect in *IPS Protections* view and will not be enforced on Security Gateway running R80.X. | Deactivating IPS protections by categories will be supported only for Security Gateways R77.X and lower. | We recommend to use the enhanced R80 tag based activation for IPS protections. | | Administrators in user group are not supported | "*pre_upgrade_verifier* " command on R80 during pre-upgrade verification prints a warning with "*Administrators in user group are not supported*" | User group contains an administrator user. | The upgrade operation will remove those administrators. | | Legacy Default Profiles are not supported | "*pre_upgrade_verifier* " command on R80 during pre-upgrade verification prints a warning with "*Legacy Default Profiles are not supported*" | Legacy default EndPoint profiles and legacy default profiles that are not used will be deleted. | The upgrade operation will remove those profiles. | | Check Point Gateway Objects - Permissions to Install | Warning during export. After upgrade, the 'Permissions to Install' page was removed in the Security Gateway properties. (it still exists in the schema, but ignored) | In R80, administrator group permissions can not be set to install policy on a specific Security Gateway. | The Security Gateway property 'Permissions to Install' is ignored. | | Snort protections are not yet supported | | Snort protections are not yet supported in R80. | Snort protections will be removed from database. | | Mobile applications with unsupported ports | * Before upgrade: Warning that lists all objects of type "ActiveSync" and "Business Mail", which contain different ports from the default ones (443, 80, 8080). * After upgrade: Objects that were listed before upgrade now contain service '`https`' with port 443 (navigate to the object in the objects bar - open the object's editor - service '`https`' appears in service's combo box) | In R80, those objects contain a service, which holds the port. ActiveSync and Business Mail applications with one of the default ports will get the appropriate service, which contains the same port. All of the applications that hold a different port, will get the service 'https' as default. | If you would like to use a different port than the default: * Before upgrade (optional): 1. In R77.30 SmartDashboard, go to ***Mobile Access*** tab 2. Click on ***Applications*** 3. Locate the objects that are listed in the Pre-Upgrade Verification message 4. Edit the listed objects 5. Change their port to one of the defaults: 443, 80, 8080 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run upgrade again * After upgrade: 1. In R80 SmartConsole, open Object Explorer 2. Create a new service, which contains the desired port 3. Navigate to objects bar (right pane) 4. Locate the objects that are listed in the Pre-Upgrade Verification message 5. Edit the listed objects 6. In service's combo box, select the new service - click on OK | Information {#Information} -------------------------- Notifications about actions done during the upgrade process. No action is required. |---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Symptom (user experience) | Cause | Solution | | Deprecated categories in Application Control | * Before upgrade: All the categories that are deprecated and will be changed in the upgrade process, and the categories that are deprecated and should be deleted before/after upgrade. * After upgrade: Categories that were listed in the Pre-Upgrade Verification message as those that should be deleted, will be found in the rulebase, but they have no affect on the Security Gateway after policy installation. These categories should be deleted. | The listed categories were removed from / replaced in the Application Control package. | For unsupported categories refer to [sk106783](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106783). * Before upgrade (optional): 1. In R7x SmartDashboard, go to the ***Application \& URL Filtering*** tab 2. Click on ***Policy*** 3. Search for the categories listed in the Pre-Upgrade Verification message 4. Delete those categories from the rules 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again * After upgrade: 1. In R80 SmartConsole, go to ***Application*** layer 2. Search for the categories listed as those that should be deleted 3. Delete them from the rulebase | | '`Send error page`' option is no longer supported | '`Send error page`' UI configuration was removed from protections. | Database contains protections with '`Send error page`' enabled. | This is no longer supported and will be disabled. | R80 Multi-Domain Security Management Server {#R80 Multi-Domain Security Management Server} ------------------------------------------------------------------------------------------ |--------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Title | Symptom (user experience) | Cause | Solution | | **Errors - Products and features Check Point no longer supports**Products and features that are no longer supported in R80 and need to be removed to proceed with the upgrade to R80 |||| | Global IPS Modes Detector | *The following Domains are subscribed to Global IPS* | Subscription to Global IPS using Merge or Override modes is no longer supported. | 1. Domains which are subscribed to these legacy Global IPS modes, will now use Exclusive mode (for more information about Exclusive mode, refer to the SmartDomain Manager Administration Guide). 2. After the upgrade is completed, make sure to re-assign the Global Policy to all Domain Management Servers that are subscribed to Global IPS and have an assigned Global Policy. | | **Errors - Configuration issues**These issues require a manual adjustment to enable the upgrade to R80 |||| | Source Version Upgrade Path Checker | *Migrate is not supported from version R65* The Supported Upgrade Paths are documented in the R80 Release Notes. | Upgrade from the source version to the target version is not allowed. | 1. Upgrade to one of the listed versions that can be upgraded to R80 and then upgrade to R80. | | Test for Domains without Domain Management Servers | *Found domains without management servers* | There are domains without any management servers | 1. Stop the export. 2. Connect with SmartDomain Manager to the Multi-Domain Server. 3. Remove the mentioned Domains. | | Test for Domains with no Hosting Multi-Domain Servers | *Found Domain Server hosted by non existing Multi Domain servers* | There are domains that are not hosted in any Multi Domain server. | Follow [sk106077](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106077). | | Test for Domains with Out of Date Global Policies | *Found domains with out of date global policies* | Global Policy was edited and was not installed. | Install Global Policy for the mentioned Domains. | | Test for "Enable for Global Use" Feature | *There are gateways enabled for Global Use* | Either one or more of the following files contains an empty set: * $MDSDIR/conf/mdsdb/exported.C * $MDSDIR/conf/mdsdb/exported_domains.C * $MDSDIR/conf/exported.C * $MDSDIR/conf/exported_domains.C Or there are gateways enabled for Global Use. | Disable Global Use for all network objects before upgrade. | | Global Policy on Source Database Detector | "*cma migrate*" command on R80 prints a warning during pre-upgrade verification: *Global policy was detected on the source database* | The Domain Management Server after migration will have global rules and/or objects, but there will be no indication that a Global Policy is assigned to it. | After migration, in order to have a Global Policy assigned on this Domain, use "Assign Global Policy", or "Stop the migration process and remove the global policy from the source database". | | Renamed Global Objects Detector | *Non updated renamed global objects were detected on the source database* | Some of the global objects in the Global Policy were renamed and were not assigned to the Domains. | Stop the migration process and reassign the Global Policy on the source database. | | Assign Only Used Global Objects Feature Detector | *If you want to make sure that administrators can use only objects in assigned Global Policies,* *you must manually separate the global objects and global policies to multiple global Domains* | Assigning of used global objects is no longer supported. | Remove the objects that should be segregated from the Global Domain. | | Multiple Domain Management Servers with the same ICA Keys Detector | *You are about to import a database which contains a CA key* *that is identical to another Domain's CA key.* | Duplicate CA key. | If you choose to continue the import operation, you should re-create the Domain Management Server's CA database by executing '`sic_reset`' as described in [sk17197](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk17197). | | Firmware References Detector | *A Domain Management Server/Security Management database that contains references to the SmartUpdate Package Repository can not be migrated.* | The referenced object is not present on the original Security Management Server / Domain Management Server - neither in the SmartDashboard, nor in the SmartUpdate GUI. | Follow [sk106640](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106640). | | VSX Objects Detector | *Management with VSX objects detected.* | Database contains object of type *vs_netobj* , or *vs_cluster_netobj* - importing those objects without their "twin objects" *vs_slot_obj* at the Main Domain will cause database corruption. | Follow the instructions in [How to VSX Migration for Multi-Domain Management](http://downloads.checkpoint.com/dc/download.htm?ID=35084) document. | | Test for Domain Servers Missing from Database | *Found Corrupted Domain Management Servers* | There are Domain directories that do not exist in the database. | Remove the Domain directories from *$FWDIR/*. | | Test for Physically Deleted Domain Management Servers | *Found corrupted domain management servers* | The */conf/mdsdb/objects_5_0.C* file contains references to Domains that do not exist in *customers.C* file. | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance or remove the object from the management database - *$FWDIR/conf/objects_5_0.C* (use [dbedit](http://supportcontent.checkpoint.com/solutions?id=skI3301), [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009), or Vi editor). | | Test for High Availability state of the Global database | *The High Availability state of the Global database on your Multi-Domain Server is in Standby mode.* | The High Availability state of the Global database on your Multi-Domain Server is in "Standby" mode. | 1. Import the Active Multi-Domain Server. 2. Then, import this server with the "*-secondary*" flag, or switch it to Active before export. | | Test for Non Existent Assigned Global Policies | *Found Domain Management Servers with non-existent global policies* | A Global Policy assigned to a Domain does not exist. | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance, or remove the relevant policy from the management database on Domain Management Server - *$FWDIR/conf/objects_5_0.C* (use [dbedit](http://supportcontent.checkpoint.com/solutions?id=skI3301), [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009), or Vi editor) - find "*gp_name*" attribute with the relevant policy and delete it. | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content