> Source: [sk117237](https://support.checkpoint.com/results/sk/sk117237)
# sk117237 - R80.x Pre-Upgrade Verifier notifications and their solutions
| Property | Value |
|----------|-------|
| Solution ID | sk117237 |
| Date Created | 2017-05-08 |
| Last Modified | 2020-07-06 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Gaia |
## Solution
This article describes the notifications received from the Pre-Upgrade verifier and how to address them in order to successfully upgrade to R80.x
"Errors" are issues that must be addressed. "Warnings" are issues that will not fail the upgrade but it is highly recommended to address them. "Information" are notifications that just provide information about actions done by the upgrade process.
**Table of Contents:**
* Errors - Products and features Check Point no longer supports
* Errors - Products and features that are not supported yet in R80.x
* Errors - Configuration issues
* Warnings
* Information
* Multi-Domain Security Management Server
Errors - Products and features Check Point no longer supports {#Errors - Legacy products and features}
------------------------------------------------------------------------------------------------------
**Products and features that are no longer supported in R80.10 / R80.20 / R80.30 / R80.40. Refer to the solution column in order to fix the issues and proceed with the upgrade.**
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Displayed Error | Cause | Solution |
| "*Rule action 'Session Auth' is not supported in R80.30 and higher.* *Rules that use the 'Session Auth' action must be changed to use* *a different action (see sk98263) before upgrade to R80.30*" Issue ID: 01483092 | Firewall rulebase contains rule(s) with the Session Auth action that is no longer supported. | In R77.30 SmartDashboard, refer to the Policy Package listed in the error message: 1. In ***Firewall*** tab, click on ***Policy*** 2. Refer to rules listed in error message 3. Replace ***Session Auth*** action with other supported action 4. Save the changes: go to ***File*** menu - click on ***Save*** 5. Run the upgrade again Or refer to [sk98263](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263). |
| *Objects not supported.* *Some legacy Check Point network objects in this Security Management Server version are no longer supported.* *Please upgrade or remove the following Check Point network objects before proceeding with an upgrade procedure.* *Leaving those unsupported objects in the database may cause error messages and policy installation problems.* Issue ID: 01541341 | The following products are no longer supported in R80.x: * Connectra gateways * DLP-1 appliances * IPS-1 Sensor | Remove these products: 1. In R77.30 SmartDashboard, go to *Manage* menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |
| *UTM-1 Edge X / W Series are no longer supported. Description: The Database includes UTM-1 Edge X / W Series objects. UTM-1 Edge X / W Series are no longer available. If there are UTM-1 Edge X / W Series , upgrade will fail. Delete all UTM-1 Edge X / W Series objects before upgrade.* Issue ID: 01686331 | The Database includes UTM-1 Edge X / W Series objects, which are no longer supported. | Replace these devices with supported devices. If you would like to remove these objects to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***UTM-1 Edge Gateways*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |
| *Rulebase contains unsupported services or group of services that must be removed* Issue ID: 01372828 | The rulebase contains services or group of services which are no longer supported and must be removed. For the list of unsupported services, refer to [sk103766](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103766). | 1. Open the *pre_upgrade_verification_report* 2. Go to the relevant policy and rule number described in the error message. 3. Remove the service from the rulebase. |
Errors - Products and features that are not supported yet {#Errors - Currently unsupported products and features}
-----------------------------------------------------------------------------------------------------------------
**If you are using these products or features, consider upgrading to the relevant release when it is available.** **Otherwise, refer to the solution column to proceed with the upgrade.**
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|
| Displayed Error | Cause | Solution | R80.10 | R80.20 | R80.30 | R80.40 |
| *Modbus is not supported yet* Issue ID: 01730543 | The Modbus feature is enabled, or a Modbus application exists while the upgrade path for this feature is not supported | If you use the Modbus feature, consider deleting the configuration and re-create it in R80.x where it is available via API (see the [ICS User Guide](https://sc1.checkpoint.com/documents/ICS_Security_UserGuide/html_frameset.htm?topic=documents/ICS_Security_UserGuide/201593) for details). Follow the below instructions to disable this feature in order to proceed with the upgrade: 1. Close all SmartConsole windows 2. Connect with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to Security Management Server / Domain Management Server 3. In the upper left pane, go to ***Table*** - ***Global Properties Objects*** - ***properties*** 4. In the upper right pane, click on ***firewall_properties*** 5. Search for **modbus_applications_enabled** 6. In the lower pane, right-click on the ***modbus_applications_enabled*** - select ***Edit...*** - select "***false*** " - click on ***OK*** 7. Save the changes: go to ***File*** menu - click on ***Save All*** 8. Close the GuiDBedit Tool 9. Connect with SmartConsole to Security Management Server / Domain Management Server 10. Go to ***Application \& URL Filtering*** tab 11. Click on ***Applications/Sites*** 12. Delete all applications with Type ***Modbus Application*** 13. Save the changes: go to ***File*** menu - click on ***Save*** 14. Run the upgrade again |  |  |  |  |
| *LSM Profiles are not yet supported in R80.10* Issue ID: 01692823 | The Database includes LSM Profiles that are not supported in the destination version.
| **Consider upgrading to R80.20** **and higher** , where the LSM product is supported (see [sk117159](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117159) for details). Otherwise, follow the below instructions to remove the LSM profiles and proceed with the upgrade. 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate the unsupported objects (open the object - look at the type at the top) 4. Delete the unsupported objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |  |  |  |  |
| *Cloud Connector is not supported yet* Issue ID: 01730543 | The Database includes one or more Cloud connectors which are not supported. | Follow the below instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Application \& URL Filtering*** tab 2. In the left tree, expand ***Advanced*** 3. Click on ***Cloud Connector*** 4. In the displayed view, delete Cloud Connector applications 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |  |  |  |  |
| *LTE is not supported yet* Issue ID: 01730543 | The rulebase contains one of the following GTP services: * GTPv2 * GTP_MM_V2 * GTP_ADDITIONAL_V2 * SCTP * Diameter | Follow the below instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Firewall*** tab and click on ***Policy*** 2. Locate the rules that contain one of the following LTE services in ***Service*** column: * GTPv2 * GTP_MM_V2 * GTP_ADDITIONAL_V2 * SCTP * Diameter 3. Remove these LTE services from the policy (pay attention not to decrease the security of your environment) 4. It is also recommended to delete all instances of the those LTE services that were created by the user (default objects are removed automatically): 1. Go to ***Manage*** menu - click on ***Services...*** 2. In ***Show:*** field, select ***User defined services*** 3. Locate the user-defined LTE services 4. Delete the user-defined LTE services 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |  |  |  |  |
| *Large Scale VPN (LSV) Profiles are not yet supported* Issue ID: 01730543 | There is an LSV profile object that is used in a VPN community which is not supported yet. | Follow the below instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Interoperable Devices*** 3. Locate the LSV profile objects 4. Delete the LSV profile objects 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |  |  |  |  |
| *CGNAT and NAT64 are not yet supported* Issue ID: 01730543 | There are CGNAT rules in the NAT policy | Follow the below instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Firewall*** tab 2. Click on ***NAT*** 3. Refer to ***Translated Packet*** - check the ***Source*** column 4. Search for objects that are signed with NAT state as***CG*** (for CGNAT) 5. Delete the NAT rules that are defined as ***CGNAT.*** 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run the upgrade again |  |  |  |  |
| *CGNAT and NAT64 are not yet supported* Issue ID: 01730543 | There are NAT64 rules in the NAT policy | Consider upgrading to R80.20 or higher, where NAT64 rules are supported. Otherwise, follow the below instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to ***Firewall*** tab 2. Click on ***NAT*** 3. Refer to ***Translated Packet*** - check the ***Source*** column 4. Search for objects that are signed with NAT state as ***64*** (for NAT64) 5. Delete the NAT rules that are defined as ***NAT64*** 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run the upgrade again |  |  |  |  |
| *Syslog Server is temporarily not supported* Issue ID: 01730543 | Use of Syslog server as log destination in the Security Gateway properties is not supported in R80.x. | If you are logging to a Syslog server, consider upgrading to R80.20 or higher, where it is available (see [sk117159](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117159) for details). Otherwise, implement the following instructions to proceed with the upgrade. 1. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Servers and OPSEC Applications...*** 2. In ***Show:*** field, select ***Syslog servers*** 3. Locate the Syslog servers that are listed in the Pre-Upgrade Verification message 4. Select each listed Syslog server - click on ***Actions...*** button - click on ***Where Used...*** - write down the name of each involved Security Gateway object 5. Close the ***Servers and OPSEC Applications...*** window 6. In R77.30 SmartDashboard, go to ***Manage*** menu - click on ***Servers and OPSEC Applications...*** 7. In ***Show:*** field, select ***Check Points*** 8. Locate the involved Security Gateway objects 9. Edit the involved Security Gateway objects 10. In Security Gateway properties, go to ***Logs*** pane 11. Remove all Syslog servers 12. Click on OK 13. Now you can delete the Syslog server objects 14. Save the changes: go to ***File*** menu - click on ***Save*** 15. Run the upgrade again |  |  |  |  |
| *Data Center Objects Are Not yet Supported* Issue ID: 01932943 | Data Center objects, Data Center groups and Virtual Cloud objects on vSEC Controller R77.30 are supported only for upgrade to R80.10 + Jumbo Hotfix Accumulator for R80.10 Take 53 or later. | Upgrade to R80.20 or higher |  |  |  |  |
| *Error in database Inconsistency found in the database - the table mobile_push_notifications.C should be removed.* Issue ID: 01817921 | After upgrading from R77.20.01, or R77.30 to a newer version, SmartDashboard crashes when navigating to "Mobile Access Blade" tab -\> "Capsule Workspace Settings". | Refer to [sk108698](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108698). |  |  |  |  |
| *Log Servers on Domain Management Server level are not yet supported* Issue ID: 02437834 | Log Servers is configured on one or more of of the Multi-Domain Management Server Domains. | Follow the below instructions to proceed with the upgrade: 1. Connect with the R77.30 SmartDashboard to the relevant Domain Management Server 2. Locate the the unsupported objects listed in the error message 3. Delete the the unsupported objects listed in the error message 4. Save the changes: go to the File menu - click on the Save 5. Run the upgrade again |  |  |  |  |
| *Backup Security Management Server on Domain Management Server level is not yet supported* Issue ID: 02437834 | Backup Security Management is configured on one or more of of the Multi-Domain Management Server Domains. | Follow the below instructions to proceed with the upgrade: 1. Connect with the R77.30 SmartDashboard to the relevant Domain Management Server 2. Locate the the unsupported objects listed in the error message 3. Delete the the unsupported objects listed in the error message 4. Save the changes: go to the File menu - click on the Save 5. Run the upgrade again |  |  |  |  |
| *Threat Emulation not yet supported in R80.10 on the 61000 and 41000 Security Systems* Issue ID: 02509476 | There is one or more 41000 / 44000 / 61000 / 64000 R76SP.40 Gateway with enabled threat emulation blade. | If you are using Threat Emulation blade on the 60000 / 40000 Security Systems, consider upgrading to the relevant release when it is available (see [sk117159](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117159)). Otherwise, implement the following instructions to proceed with the upgrade: 1. In R77.30 SmartDashboard, go to the Manage menu - click on the Network Objects... 2. In the Show: field, select the Check Points 3. Locate the 60000 / 40000 Security System object 4. Disable the Threat Emulation blade in the 60000 / 40000 Security System object (or delete this objects) 5. Save the changes: go to the File menu - click on the Save 6. Run the upgrade again |  |  |  |  |
Errors - Configuration Issues {#Errors - Adjustments}
-----------------------------------------------------
**These issues require a manual adjustment to enable the upgrade to R80.10 / R80.20 / R80.30 / R80.40**
|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Displayed Error | Cause | Solution |
| *Application is not supported in application group* | Upgrade is blocked due to existence of application groups that contain deprecated applications that will be replaced with a service. The listed applications were removed from the Application Control package. | Before upgrade: 1. In R7X SmartDashboard, go to ***Application \& URL Filtering*** tab 2. Click on ***Applications/Sites*** 3. Locate the application groups mentioned in the Pre-Upgrade Verification message 4. Remove the deprecated applications from from the application groups mentioned in the Pre-Upgrade Verification message 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |
| *Users database needs to be fixed* | Objects that are referenced in the *$FWDIR/conf/fwauth.NDB* file do not exist in the *$FWDIR/conf/objects_5_0.C* file. | Refer to [sk106158](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106158). |
| *Cluster member that is not part of a cluster is not supported* | Database contains cluster members which are not part of a cluster (unused). | These cluster members are not used in your current deployment and can safely be deleted. Delete these objects before upgrade - either in SmartDashboard, or in [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009). Refer to [sk108612](http://supportcontent.checkpoint.com/solutions?id=sk108612). |
| *Standby Management Server* | R77X Standby Management Server should not be upgraded. It should synchronize with the Active Management Server after it is upgraded. | Either: * Perform clean install of R80.10/R80.20/R80.30 * Set it as Secondary Management Server in the First Time Wizard * Synchronize the Secondary Management Server with the Primary Management Server Or: * Promote the Standby Management Server to be Active. |
| *Empty SIC* | The SIC name with the Management Server has been lost. | Reset SIC on R7X Security Management Server: 1. *\[Expert@HostName:0\]# fwm sic_reset* 2. *\[Expert@HostName:0\]# cp_conf ca init* |
| *Empty IPv4 address* | The Management Server has no IPv4 address defined. | 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Network Objects...*** 2. In ***Show:*** field, select ***Check Points*** 3. Locate and edit the object of the Management Server 4. Define the IPv4 address and click on OK 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run the upgrade again |
| *Duplicate object IDs* | There are duplicate objects with the same object ID. | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance, or follow these steps on R7X Management Server: 1. Collect complete backup (refer to [sk108902](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902)). At the very least, backup the *$FWDIR/conf/objects_5_0.C* file 2. Generate a new UID using the following online generator: [http://www.guidgen.com](http://www.guidgen.com/) 3. Edit the ***$FWDIR/conf/objects_5_0.C*** file using and advanced text editor (Vi, Notepad++, etc.) 4. Change the duplicate UID to the generated UID |
| *Corrupted object IDs* | There are objects with corrupted UID. For example: * UID string length is not 38 * UID string does not start with "{", does not end with "}" * hyphens are not in the right places * hex digits are not in the right places | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance, or follow the below procedure: **Background** > The Object's UID should look like this: > `{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}` > The length of the entire string is 38 characters: > * 2 brackets - positions 1 and 38 > * 4 hyphens - positions 10, 15, 20 and 25 > * 8 hex digits - positions 2 - 9 > * 4 hex digits - positions 11 - 14 > * 4 hex digits - positions 16 - 19 > * 4 hex digits - positions 21 - 24 > * 8 hex digits - positions 26 - 37 > * allowed hex digits - 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f **Procedure** 1. Collect complete backup (refer to [sk108902](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902)). At the very least, backup the *$FWDIR/conf/objects_5_0.C* file 2. Generate a new UID using the following online generator: [http://www.guidgen.com](http://www.guidgen.com/) 3. Edit the ***$FWDIR/conf/objects_5_0.C*** file using and advanced text editor (Vi, Notepad++, etc.) 4. Change the corrupted UID to the generated UID |
| *Duplicate GUI Clients* | GUI Clients are configured more than once | Edit the *$FWDIR/conf/gui-clients* file and delete the duplicate lines listed in the error message. |
| *Objects with non-Unicode characters* | Database contains objects with non-Unicode characters. | Follow [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795) - define encoding used for non-Unicode characters. |
| *Unsupported character encoding* | User did not follow steps in [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795) correctly and defined unsupported encoding | Follow [sk109795](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109795). |
| *HTTPS Inspection policy contains unsupported objects* | HTTPS Inspection policy contains the listed objects, which are no longer supported. | 1. In R7X SmartDashboard, go to ***Application \& URL Filtering*** tab. 2. In the left pane, expand ***Advanced*** 3. Expand ***HTTPS Inspection*** 4. Click on ***Policy*** 5. Remove the listed objects from the policy |
| *Unsupported NAT rules* | 'Source' / 'Destination' address column in the Manual NAT rule either has corrupted values, or is empty | 1. In R7X SmartDashboard, go to ***File*** menu - click on ***Open...*** - select the Policy Package listed in the error message 2. Go to ***Firewall*** tab - in the left pane, click on ***NAT*** 3. Locate the NAT rules listed in the error message 4. Re-assign the Source / Destination address values as listed in the error message |
| *IPS package version is not supported* | Database contains an unsupported IPS version | 1. In R7X SmartDashboard, go to the IPS tab 2. In the left pane, click on ***Download Updates*** 3. Click on the ***Update Now*** to perform the IPS Update 4. Save the changes: go to the ***File*** menu - click on the ***Save*** |
| *Missing IP address for network objects* | Network objects were created in previous version(s) without an IP address (e.g., using GuiDBedit Tool, or dbedit) | For each network object with no IP address: 1. In R7X SmartDashboard, locate the problematic network object 2. Either edit the object and define an IP address, or delete it (if it is not used) 3. Save the changes: go to the ***File*** menu - click on the ***Save*** 4. Run the upgrade again |
| *Firewall policies with Traditional VPN mode* | Firewall policies with Traditional VPN mode should not include '*Encrypt* ' or '*Client Encrypt*' actions | Before upgrade: * Either convert the listed Firewall policies from the Traditional VPN mode to the Simplified VPN mode * Or replace the '*Encrypt* ' / '*Client Encrypt*' actions |
| *Malformed entities found in Threat Prevention rulebase* | Threat Prevention policy contains an invalid reference | For R80.10: refer to [sk117167](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117167) For R80.20 and higher: adjusted automatically |
Warnings {#Warnings}
--------------------
**Warnings are issues that will not fail the upgrade but it is highly recommended to address them.**
**The below table is relevant for R80.10 / R80.20 / R80.30 / R80.40**
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Displayed Warning | Cause | Solution |
| **Before upgrade**: Warning that lists all the services and services groups, whose names conflict with the new default objects added by Check Point and should be changed to another name **After upgrade**: The name of the services and services group, whose names were not changed before upgrade will contain underscore character ('_') as post-fix. Issue ID: 01843066 | New services and protocols were added to the default database. If there are services with the same names, the user can change the service / service group name before upgrade. Otherwise, the upgrade process will append to the user services the underscore character ('_') as post-fix. | If there are naming conflicts with the new default objects and you would like to change the names rather than using our default "_" appendix to the name: * Before upgrade: 1. In R7X SmartDashboard, go to ***Manage*** menu - click on ***Services...*** 2. Locate the services and services groups that are listed in the Pre-Upgrade Verification message 3. Change the names of the listed services and services groups * After upgrade: 1. In R80.x SmartConsole, go to the Object Explorer 2. Locate for the services and services groups that are listed in the Pre-Upgrade Verification message 3. Change the names of the listed services and services groups (their names will contain '_' as postfix) |
| **Warning during upgrade** of Security Management Server to R80.x: * "`At least one of the services contains invalid Match expression`" * "`To resolve, fix the Match expression of the unsupported service(s) (Other Service Properties > Advanced) or delete them`" **Error during policy installation** on R80.x Security Gateway: `Rule in Network Security policy will not be enforced, because service has unknown match/action` Issue ID: 01854373 | The database contains *Other Service* objects with non-empty *Match* field (open *Other Service* properties - click on *Advanced...* button), which are not part of Check Point default services. In R80.x, the *Other Service* object definition has been modified - the *Match* field has been split into two fields: *Match* and *Action*. Conversion of objects from R77 (and lower) version to R80.x is done automatically, but for user-defined services it may be incorrect. Therefore, the user is warned. | After a successful Upgrade to R80.x, verify the objects were converted correctly, or manually convert the user-defined *Other Service* objects per [sk109195](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109195). |
| "*The unsupported IPS protections will be removed from the "Protections" view*" | Some IPS protections are no longer available. | Refer to [sk103766](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103766). |
| *Deactivating IPS protections by categories in a Threat Prevention profile will not take effect in IPS Protections view, and will not be enforced on Security Gateway running R80.X* Issue ID: 01564375 | Deactivating IPS protections by categories are supported only for Security Gateways R75.X / R76 / R77.X | It is recommended to use the enhanced R80.x tag based activation for IPS protections. Refer to Threat Prevention Administration Guide for more info. |
| *Administrators in user group are not supported* Issue ID: 01679646 | User group contains an administrator user. | The upgrade operation will remove those administrators. |
| *Legacy Default Profiles are not supported* Issue ID: 01621844 | Legacy default EndPoint profiles and legacy default profiles that are not used will be deleted | The upgrade operation will remove those profiles. |
| *In this version, you cannot set administrator group permissions to install policy on a specific gateway. The gateway property 'Permissions to Install' is ignored.* Issue ID: 01869271 | In R80.x, administrator group permissions cannot be set to install policy on a specific Security Gateway. | The Security Gateway property 'Permissions to Install' is ignored. |
| *"The following Snort protections will be removed:"* Issue ID: 01912816 | Snort protections are not supported in the destination version. | Snort protections will be removed from the database. |
| **Before upgrade**: Warning that lists all objects of type "ActiveSync" and "Business Mail", which contain different ports from the default ones (443, 80, 8080). **After upgrade**: Objects that were listed before upgrade now contain service '`https`' with port 443 (navigate to the object in the objects bar - open the object's editor - service '`https`' appears in service's combo box) Issue ID: 01920887 | In R80.x, those objects contain a service, which holds the port. ActiveSync and Business Mail applications with one of the default ports will get the appropriate service, which contains the same port. All of the applications that hold a different port, will get the service 'https' as default. | If you would like to use a different port than the default: * Before upgrade (optional): 1. In R77.30 SmartDashboard, go to ***Mobile Access*** tab 2. Click on ***Applications*** 3. Locate the objects that are listed in the Pre-Upgrade Verification message 4. Edit the listed objects 5. Change their port to one of the defaults: 443, 80, 8080 6. Save the changes: go to ***File*** menu - click on ***Save*** 7. Run upgrade again * After upgrade: 1. In R80.x SmartConsole, open Object Explorer 2. Create a new service, which contains the desired port 3. Navigate to objects bar (right pane) 4. Locate the objects that are listed in the Pre-Upgrade Verification message 5. Edit the listed objects 6. In service's combo box, select the new service - click OK |
| Log indexing is not activated after upgrade: In LOGS \& MONITOR view, when clicking on the Logs tab, a yellow strip with the following message is displayed: "*Searches might be slow when working with log files*" Issue ID: 02015620 | Log indexing is disabled by default, when upgrading to R80.x in order to improve performance | To enable it again: 1. In SmartConsole, edit the Management Server network object 2. Go to the ***Logs*** pane 3. Select ***Enable Log Indexing*** 4. Click OK |
| **Before upgrade** : Warning that lists all the profiles that deactivate IPS protections by Client/Server type **After Upgrade**: Deactivating IPS protections by Client/Server types will not take effect in the IPS 'Protections' view and will not be enforced on Security Gateway running R80.x Issue ID: TPM-47 | Deactivating IPS protections by type (Client/Server) is not supported for Security Gateway R80.x and higher. Use tag based activations instead. | After upgrade: 1. In R80.10 SmartConsole, go to the ***SECURITY POLICIES*** app 2. In the upper section, click ***Threat Prevention*** 3. In the lower section ***Threat Tools*** , click ***Profiles*** 4. Right-click on the relevant profile - select Edit... 5. Go to the ***IPS*** pane 6. Select the checkbox ***Activate IPS protections according to the following additional properties*** 7. In the ***Protections to deactivate section*** , add the ***Protected Asset*** - ***Client*** tag / ***Protected Asset - Server*** tag to protections that should be deactivated 8. Click on OK 9. Publish the changes 10. Install the policy |
| **After upgrade**: Applications and categories from [sk110778](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110778), which were selected in the Application Control \& URL Filtering policy may be replaced to new services. Deprecated applications and categories may not be available for adding new instances after application update. Issue ID: 02471697 | Applications and categories are replaced by Firewall services with protocol signatures and their default ports | After a successful upgrade to R80.x, verify that the objects were converted correctly, or manually convert the user-defined objects |
| **After upgrade:** *Application widgets can not be selected in the Application Control \& URL Filtering policy - widgets that are used, will be enforced after the upgrade* Issue ID: 02508608 | Creating new Application widgets or adding them to Access Policy rule is not supported since R80.10 | Remove the widgets before the upgrade, or after the successful upgrade. Widgets that used, will be enforced after the upgrade. |
| Warning during database export: *Legacy DHCP Relay services were found in the security rule base. Action is required in order for DHCP Relay to function properly post-upgrade* *There are two possible options to solve the problem:* 1. *Remove all legacy DHCP Relay services and add new ones instead. See sk104114 for instructions. This is the recommended action for managing R77.20 gateways and higher.* 2. *Keep the legacy DHCP Relay services and change the Gateways and the Security Management Servers accordingly. See sk98839 for instructions. Do this for gateways which are older than R77.20* Issue ID: PMTR-2392 | Legacy DHCP Relay services were found in the security rule base. Action is required in order for DHCP Relay to function properly post-upgrade | Two possible options to solve the problem: 1. Remove legacy DHCP Relay services and add new DHCP Relay services. See [sk104114](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104114) for instructions. This is the recommended action if managing only R77.20 gateways and higher 2. Keep legacy DHCP Relay services and make changes to the Gateways and the Security Management Servers. See [sk98839](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98839) for instructions. Do this if managing any gateways which are older than R77.20 |
| **Before upgrade:** All the categories that are deprecated and will be changed in the upgrade process, and the categories that are deprecated and should be deleted before/after upgrade. **After upgrade:** Categories that were listed in the Pre-Upgrade Verification message as those that should be deleted, will be found in the rulebase, but they have no affect on the Security Gateway after policy installation. These categories should be deleted. Issue ID: 01690538 | The listed categories were removed from / replaced in the Application Control package. | For unsupported categories refer to [sk106783](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106783). * Before upgrade (optional): 1. In R77.30 SmartDashboard, go to the ***Application \& URL Filtering*** tab 2. Click on ***Policy*** 3. Search for the categories listed in the Pre-Upgrade Verification message 4. Delete those categories from the rules 5. Save the changes: go to ***File*** menu - click on ***Save*** 6. Run upgrade again * After upgrade: 1. In R80.x SmartConsole, go to ***Application*** layer 2. Search for the categories listed as those that should be deleted 3. Delete them from the rulebase 4. Publish the changes |
Information {#Information}
--------------------------
**Notifications about actions done during the upgrade process. No action is required.**
|--------------------------------------------------------------------------------------|--------------------------------------------------------------|--------------------------------------------------|
| Displayed Message | Cause | Solution |
| *'Send error page' UI configuration was removed from protections* Issue ID: 01555668 | Database contains protections with enabled 'Send error page' | This is no longer supported and will be disabled |
Multi-Domain Security Management Server {#R80 Multi-Domain Security Management Server}
--------------------------------------------------------------------------------------
**Errors and Configuration issues**
**These issues require a manual adjustment to enable the upgrade to R80.x**
|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Pre-upgrade verification error | Cause | Solution |
| *Migrate is not supported from version R65* Issue ID: 00434025 | Upgrade from the source version to the target version is not allowed. The Supported Upgrade Paths are documented in the Release Notes for each version. | 1. Upgrade to one of the listed versions that can be upgraded to R80.x 2. Upgrade to R80.x |
| *Found domains without management servers* Issue ID: 01638801 | There are Domains without any Domain Management Servers | 1. Stop the database export. 2. Connect with SmartDomain Manager to the Multi-Domain Server. 3. Remove the Domains listed in the message. |
| *Found Domain Server hosted by non existing Multi Domain servers* Issue ID: 01638801 | There are Domains that are not hosted on any Multi-Domain Server | Refer to [sk106077](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106077) |
| *Found Domains with out of date Global Policies* Issue ID: 01724190 | Global Policy was edited and was not installed | Install Global Policy for the mentioned Domains |
| *There are gateways enabled for Global Use* Issue ID: 01606491 | Either one or more of the following files contains an empty set: * $MDSDIR/conf/mdsdb/exported.C * $MDSDIR/conf/mdsdb/exported_domains.C * $MDSDIR/conf/exported.C * $MDSDIR/conf/exported_domains.C Or there are gateways enabled for Global Use. | On R80.10: 1. Log in to the Multi-Domain Server 2. In the ***General*** tab, under 'Domain Contents', sort the contents of the table by the "***Global Name***" column 3. For each object that has a global name, right-click and select ***Disable Global Use*** **Resolved starting from R80.20** |
| *cma migrate* command on R80.x prints a warning during pre-upgrade verification: *Global policy was detected on the source database* | The Domain Management Server after migration will have Global rules and/or objects, but there will be no indication that a Global Policy is assigned to it | After migration, to have a Global Policy assigned on this Domain, use either the *Assign Global Policy* option, or the *Stop the migration process and remove the global policy from the source database* |
| *Non updated renamed global objects were detected on the source database* Issue ID: 00766013 | Some of the Global objects in the Global Policy were renamed and were not assigned to the Domains | Stop the migration process and reassign the Global Policy on the source database |
| *You configured these Domains to get only the global objects of their assigned global policies:...* Issue ID: 01606491 | Assigning of used global objects is no longer supported | Remove the objects that should be segregated from the Global Domain |
| *You are about to import a database which contains a CA key that is identical to another Domain's CA key* | Duplicate CA key. | If you choose to continue the import operation, you should re-create the Domain Management Server's CA database by executing the '*sic_reset* ' as described in [sk17197](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk17197). |
| *A Domain Management Server/Security Management database that contains references to the SmartUpdate Package Repository can not be migrated* | The referenced object is not present on the original Security Management Server / Domain Management Server - neither in the SmartDashboard, nor in the SmartUpdate GUI | Refer to [sk106640](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106640). |
| *Management with VSX objects detected.* | Database contains object of type *vs_netobj* , or *vs_cluster_netobj* - importing those objects without their "twin objects" *vs_slot_obj* at the Main Domain will cause database corruption. | Follow the instructions in [How to VSX Migration for Multi-Domain Management](http://downloads.checkpoint.com/dc/download.htm?ID=35084) document. |
| *Found Corrupted Domain Management Servers* | There are Domain directories that do not exist in the database. | Delete the Domain directories from the *$FWDIR/* directory |
| *Found corrupted domain management servers* | The */conf/mdsdb/objects_5_0.C* file contains references to Domains that do not exist in the *customers.C* file | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance |
| *The High Availability state of the Global database on your Multi-Domain Server is in Standby mode* Issue ID: 01906025 | The High Availability state of the Global database on your Multi-Domain Server is in Standby mode | 1. Import the Active Multi-Domain Server. 2. Then, import this server with the "*-secondary*" flag, or switch it to Active before export. |
| *Found Domain Management Servers with non-existent global policies* Issue ID: 01948068 | A Global Policy assigned to a Domain does not exist | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for assistance |
| *Found Domain Management Server IP which is different than defined in MDS database* Issue ID: ACM-1227 | One or more Domain Servers have different IP than the one defined in MDS database | Modify the IP address of the Domain object in the Management database on Domain Management Server - *$FWDIR/conf/objects_5_0.C* (use [dbedit](http://supportcontent.checkpoint.com/solutions?id=skI3301), [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009), or Vi editor) |
| *Not all domains are active* Issue ID: 01906025 | One or more Domain Servers is in Standby mode while Global gateway is assigned to them. | On the Primary MDS, either disable the globally used on the gateways or activate the standby domains. To disable the globally used on the gateways, connect to the Multi-Domain Server General view, then right-click on the gateways and click 'Disable global use'. On the Secondary MDS: After fixing the Primary MDS errors, this message shouldn't be shown on the Secondary MDS. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) if you still see this error message. |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content