> Source: [sk185039](https://support.checkpoint.com/results/sk/sk185039)
# sk185039 - Check Point R82.20 Release
| Property | Value |
|----------|-------|
| Solution ID | sk185039 |
| Date Created | 2026-06-09 |
| Last Modified | 2026-09-09 |
| Technical Level | General |
| Products | Check Point Firewall, Security Management Server |
| Versions | R82.20, R82.20 |
| OS | Gaia |
## Solution
**Check Point Recommended version for all deployments is [R82.10](https://support.checkpoint.com/results/sk/sk183506) with its Recommended [Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) Take** **For more info about all Check Point releases, refer to [Release map](https://support.checkpoint.com/results/sk/sk152052) and [Release Terminology](https://support.checkpoint.com/results/sk/sk95746) articles**
**What's New \| Documentation \| Downloads and Installation \| Revision History**
|---|---|---|
|  |||
|---|---|---|
| What's New in R82.20 {#New} --------------------------- |||
|  AI Security > * [Workforce AI Security](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID089) empowers organizations to safely adopt generative AI tools while protecting sensitive data and ensuring compliance. By inspecting prompts and files uploaded to AI applications, it provides full visibility into how AI is used across your environment. Granular policies help prevent data leakage, reduce risk, and promote responsible, compliant use of AI, so every user in the network can work confidently with AI tools without compromising security. > * Introducing [AI Agent Security](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ThreatPrevention_AdminGuide/Default.htm#cshid=ID013) for Large Language Model (LLM) servers. Check Point Firewalls can now leverage Check Point AI Guardrails to protect generative AI and agentic AI traffic with advanced AI-based security controls, including Prompt Injection protection, Content Moderation, and protection for MCP tool responses. AI Guardrails helps prevent malicious prompts, detect unsafe or non-compliant content, and identify suspicious tool responses before they reach AI applications. *** ** * ** ***
 Threat Prevention > ### Threat Prevention Blades {#Toggle_Threat Prevention} > * SNORT 3.x rules syntax is now [supported in IoC Feeds](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ThreatPrevention_AdminGuide/Default.htm#cshid=ID014). This increases coverage of supported SNORT rules and enables compatibility with the latest threat detection content. > * [DNS Trap](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ThreatPrevention_AdminGuide/Default.htm#cshid=ID001) now supports IPv6 connections, enabling DNS-based threat prevention capabilities in IPv6 environments. > ### HTTPS Inspection > * New [TLS Inspection Block page](https://sc1.checkpoint.com/documents/Log_Exporter/EN/Default.htm#cshid=ID003) - When HTTPS Inspection blocks a TLS connection because of server certificate issues (revoked, expired, or untrusted), a notification page explaining the reason for the block is now displayed. *** ** * ** ***
 Security Hardening > * Enhances Frontier AI protection with an independent IPS engine that safeguards the Check Point Firewall against direct attacks, without requiring IPS activation or an IPS subscription. *** ** * ** ***
 Check Point Firewall > **The term "Security Gateway" was rebranded to "Check Point Firewall".** > ### Identity Awareness {#Toggle_Check_Point_Firewall} > * Check Point Firewalls now [support Cisco SGT (TrustSec) tagged traffic](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_IdentityAwareness_AdminGuide/Default.htm#cshid=ID003) for pass-through and identity enforcement. Access Role objects can now match a specific Cisco SGT for access control directly from the network traffic. > ### Check Point Firewall Enhancements > * Introducing the [FedRAMP mode](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID068) for Check Point Firewalls. This new mode directs cloud-dependent services to use FedRAMP-hosted and authorized endpoints. The supported services are: URL Filtering, Application Control, Anti-Bot, Anti-Virus, Zero Phishing, and Threat Emulation. > Note: Threat Extraction and IPS do not rely on cloud services and are, therefore, compliant by default. > * Introducing **DNS TTL-Aware Domain Enforcement** - Domain object lookups and caching now follow the DNS Time to Live (TTL) value instead of fixed refresh intervals. This improves enforcement accuracy and reduces DNS query load by approximately 80%. This feature is disabled by default. > * Gaia Portal [now allows](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID055) Check Point Firewalls to automatically establish Secure Internal Communication (SIC) to initiate a connection to the Management Servers (both on-premises and Smart-1 Cloud deployments) and fetch a predefined Security Policy. See [sk184397](https://support.checkpoint.com/results/sk/sk184397). > * Check Point Firewalls can now have more than one interface with a Dynamically Assigned IP Address (DAIP). > ### Upgrade > * Introducing a new way to perform major upgrades on your Check Point Firewalls, either locally through CPUSE or centrally through SmartConsole using the Version Upgrade workflow. You can now split the upgrade process into two phases: **Prepare** and **Complete** > * The Prepare phase advances the upgrade process as far as possible without introducing downtime. Depending on the platform and upgrade scenario, this phase can download the upgrade package, verify it, and install it on a parallel partition, stopping just before the actions that require service interruption. > * During the Complete phase, the remaining upgrade steps are performed, including configuration migration and the final reboot into the new version. By separating preparation from completion, administrators can significantly decrease the maintenance window and downtime associated with major upgrades. > ### Hardware Acceleration > * [Hardware Acceleration support](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_PerformanceTuning_AdminGuide/Default.htm#cshid=ID003) is now available for SecureXL "Penalty Box" and "IP Deny List" features, enhancing Check Point Firewall resilience to DDoS attacks. > * Traditional VSX, GRE pass-through traffic, and [IPsec](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SitetoSiteVPN_AdminGuide/Default.htm#cshid=ID010) can now be accelerated in hardware when using 40/100GbE and 10/25GbE acceleration cards, supporting linerate throughput and low latency. > ### Gaia OS > * Gaia OS introduces **[Unified Configuration](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_AdminGuide/Default.htm#cshid=ID165)** , expanding and streamlining advanced configuration management across the platform and related products, and deprecating the use of Expert mode. Advanced system and feature configurations, including kernel parameters and cross-feature settings, are now managed using the Gaia Portal, Gaia Clish, or the Gaia RESTful API, providing consistent access. > A new **Advanced Configuration** **page** in Gaia Portal delivers a simplified, efficient experience for managing commonly used settings across multiple features. All configuration changes are processed through a unified API framework, ensuring configuration persistence across reboots and upgrades, with full auditability and traceability. > * Check Point Firewall 3900 Appliances now support [integrated switching](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_Gaia_AdminGuide/Default.htm#cshid=ID094). Multiple LAN ports can be grouped into Layer 2 segments, allowing traffic between devices in the same segment to be switched directly, improving performance. Traffic between different segments or to external networks continues to be processed by the firewall and enforced according to the configured security policy. > ### Dynamic Routing > Introducing [these enhancements](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm#cshid=ID003): > **OSPFv3 enhancement:** > * OSPFv3 authentication using ESP, providing secure routing exchanges and protection against unauthorized route injection. > **BGP enhancements:** > * BGP support over multiple Virtual Tunnel Interfaces (VTIs) with the same local address, enabling flexible routing across multiple tunnels. > * AS-path prepend on import, allowing control of inbound traffic by influencing path selection. > * BGP peer groups with auto-discovery, simplifying configuration for large-scale BGP deployments. > **General routing enhancements:** > * Wildcard mask support for more flexible route matching and filtering. > * IGMP and MLD blocked groups, preventing joins to restricted multicast groups and improving multicast security. > * Route-map configuration via WebUI, improving usability and simplifying the configuration of the routemaps feature. > * Monitoring of NAT Pools. > * Monitoring of IPv4 static multicast routes (static mroutes). > ### Cluster and Scalability > * [ElasticXL synchronization traffic](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ScalablePlatforms_AdminGuide/Default.htm#cshid=ID006) is now encrypted using Layer 2 encryption (MACsec). This protects all traffic between ElasticXL Cluster Members. > * In VSNext VSLS mode, each Virtual Gateway now has an [independent clustering state](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_VSX_AdminGuide/Default.htm#cshid=ID001). A "Down" cluster state on a specific Virtual Gateway does not affect the other Virtual Gateways in the cluster; they remain "Active" and can continue processing traffic. > * Maestro, ElasticXL, and ClusterXL clustering health status have been refined to include critical states such as high memory, low disk space, or packet drops because of congestion. This triggers an alert that is visible in SmartConsole. By default, this feature is enabled in monitor mode. > ### IPv6 Enhancements > **Check Point Firewall** > * [Suspicious Activity Monitoring (SAM)](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID009) has been redesigned and integrated with the Gaia API, enabling dynamic, API-driven configuration similar to Dynamic Policy Layers. This enhancement includes full IPv6 support alongside the existing SAM commands. > * You can now configure the Check Point Firewall management interface for IPv4-only, Dual-Stack (both IPv4 and IPv6), or IPv6-only operation during the [Gaia OS installation](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_AdminGuide/Default.htm?cshid=ID109) or in the [Gaia First Time Configuration Wizard](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_AdminGuide/Default.htm?cshid=ID110), supporting single-stack IPv6 deployments from initial setup. > * Added support for IPv6 Dead Peer Detection (DPD)-based [Tunnel Monitoring for Permanent Tunnels](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SitetoSiteVPN_AdminGuide/Default.htm#cshid=ID007) and IPv6 DPD-based Multiple Entry Point (MEP) topology. These enhancements enable reliable VPN resilience and liveness checks over IPv6, including mixed IPv4/IPv6 tunnels in redundant and multi-entry point deployments. > * IPv6 support for identity enforcement in Identity Awareness using Identity Agent [was extended](https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Default.htm#cshid=ID008) to include multiple address types, including link-local, Global Unicast Address (GUA), and Unique Local Address (ULA). It also fully supports Privacy Extension (RFC 8981), ensuring consistent identity-based policies even as IPv6 addresses change dynamically. > * Added support for [Route-based VPN over IPv6](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SitetoSiteVPN_AdminGuide/Default.htm#cshid=ID008). This enables dynamic routing protocols and VTI-based VPN tunnels in IPv6 environments for improved flexibility and compatibility. > **Dynamic Routing** > Added support for IPv6 for: > * Equal-Cost Multi-Path (ECMP) for static and dynamic routing protocols. > * Policy-Based Routing (PBR). This enables administrators to define custom routing decisions for IPv6 traffic based on source, destination, or other packet attributes. > * [Static multicast routes](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm#cshid=ID003) (static mroutes). > * [Multicast Listener Discovery (MLD) group limit](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm#cshid=ID003), protecting against DoS attacks by preventing excessive group joins. > * [MLDv1 SSM mapping](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm#cshid=ID003), bridging legacy MLDv1 hosts to Source-Specific Multicast (SSM). > * [IPv6 PIM Embedded RP](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm#cshid=ID003) eliminating the need for external RP-mapping mechanisms and simplifying IPv6 PIM-SM multicast deployment. > **VoIP** > * Added support for SIP traffic over IPv6. > **Licensing** > * Added support for IPv6 licenses. > ### Tools > * Improved performance of FW Monitor troubleshooting utility on Check Point Firewall 19100, 19200, 29100, and 29200 Appliances. The [new CLI flag](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_CLI_ReferenceGuide/Default.htm#cshid=ID003) provides exclusion filtering capabilities, such as exclusion expression. *** ** * ** ***
 Hybrid Mesh, SASE, and SD-WAN > ### SASE {#Toggle_Hybrid_Mesh} > * Introducing [Unified Management of Internet Access policies](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID010) for Check Point Firewalls and Check Point SASE environments. You can now manage SASE Internet Access directly from SmartConsole, providing a single point of policy management across your hybrid infrastructure. > * Introducing SmartConsole [single-click IPsec tunnel setup](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SitetoSiteVPN_AdminGuide/Default.htm#cshid=ID009) between a Check Point Firewall and Check Point SASE. Providing best practices for both full mesh and hub-andspoke (star) topologies and supporting policy-based and route-based modes. > ### SD-WAN > * [**Dynamic Routing with Equal-Cost Multi-Path (ECMP)**](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Default.htm?cshid=ID053) is now supported. It allows SDWAN to use the best path to a destination out of multiple routes with the same metric. > * **Backhaul Data Center failover for [local breakout](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Content/Topics-SD-WAN/EA/EA-Prioritize-Local-Breakout.htm?cshid=ID051) link degradation** - SD-WAN can fail over to a Data Center backhaul connection upon ISP links quality degradation, and not only when the ISP links are completely unavailable. > * [**Layer 2 Overlay Support**](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Content/Topics-SD-WAN/EA/EA-Prioritize-Local-Breakout.htm?cshid=ID050) - Overlay networks can now operate without requiring a nexthop configuration, enabling direct peer-to-peer VPN connections between Check Point Firewalls on the same local network, such as in VPLS deployments. > * **Simplified Carrier Grade NAT (CGNAT) Configuration** - CGNAT no longer requires Dynamic IP object configuration when a Management Server can reach a Check Point Firewall directly, enabling ClusterXL support and simplified Smart-1 Cloud deployments. > * **[IPv6](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Default.htm?cshid=ID054)**- SD-WAN can now intelligently route IPv6 traffic to the local internet breakout and VPN Overlay. > * [**Link Quality Threshold now includes bandwidth**](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Default.htm?cshid=ID006) - Configuring bandwidth requirements per application is now optional to ensure SD-WAN selects interfaces that meet traffic capacity needs. Set minimum bandwidth threshold alongside latency, jitter, and packet loss requirements for interface selection. > * **[Symmetric Return for Gateway Traffic](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Default.htm?cshid=ID037)** - Traffic destined to a Check Point Firewall, such as SSH sessions and policy installations, now returns through the same interface it arrived on, ensuring compatibility with ISP policies that restrict traffic with external IP addresses. > * [**Application-Based Quality of Service**](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Quantum-SD-WAN-Admin-Guide/Default.htm?cshid=ID052) - Define bandwidth guarantees and limits per application in SD-WAN policies. Prioritize critical applications with minimum bandwidth reservations while capping less important traffic, with automatic traffic shaping across both overlay and local breakout paths. *** ** * ** ***
 Cloud Firewall > * Introducing **Unified Management with Native AWS Network Firewall** that enables administrators to manage cloud-native Firewall policies directly from SmartConsole alongside the existing Access Control Policy. After connecting an AWS account, administrators can create, install, and monitor Cloud Policy across AWS Network Firewalls from a single console, with direct access to the AWS Console for additional firewall details, logs, and AWS resources. > ### Cloud Firewall Controller {#Toggle_Cloud_FW} > Cloud Firewall Controller now supports: > * [Sending identities to VSNext](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Cloud_Firewall_Controller_AdminGuide/Default.htm#cshid=ID020) Check Point Firewalls where the PDP Check Point Firewall is part of the VSNext and operates as one of the Virtual Systems. > * Azure Managed Identity authentication method for [Azure Data Centers](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Cloud_Firewall_Controller_AdminGuide/Default.htm#cshid=ID010). > * [Network CIDRs for Data Center Objects](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Cloud_Firewall_Controller_AdminGuide/Default.htm#cshid=ID020) such as VPCs, VNets, and NSGroups. When these assets are used in the rule base, the Cloud Firewall Controller sends the entire CIDR to the Check Point Firewall in a single update and improves policy enforcement coverage by matching the full CIDR to a specific policy rule. Supported Data Centers: AWS, Azure, GCP, VMware NSX-T, VMware Global NSX-T, Cisco ACI, and Oracle OCI. *** ** * ** ***
 Smart-1 and Smart-1 Cloud Management > ### Management Enhancements {#Toggle_Management} > * Introducing [these features in the AI Auditor (formerly Policy Auditor)](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm#cshid=ID108) : > * **Assigned Global Policy** - Enables AI Auditor guidelines to seamlessly work with Global Policy, incorporating global rules for enhanced functionality. > * **Allowed/Non-Violating Services** - Provides the ability to define services within each Guideline cell that are exempt from causing violations. > * **Enhanced Audit Log \& Change Report** - Delivers improved accuracy in reflecting changes made to Guidelines, ensuring a more reliable audit trail. > * Support of **IPv6 network objects**. > * Introducing new integrations: > * **Configuration Management Database (CMDB) Integration** - An integration between the Security Management Server and ServiceNow CMDB that enables the import of Configuration Items (CIs) and tags into SmartConsole for direct use in the Access Control Policy. > * **Micro-Segmentation Integration** - An integration between the Security Management Server and Illumio or Akamai Guardicore that enables the import of workloads, assets, and segmentation labels into SmartConsole for direct use in the Access Control Policy. > Supported objects include Illumio workloads and labels, as well as Akamai Guardicore assets and labels. > * **Operational Technology (OT) Integration** - An integration between the Security Management Server and Nozomi or Claroty CTD that extends Check Point OT capabilities by importing OT assets and associated metadata into SmartConsole for direct use in the Access Control Policy. > Supported objects include Nozomi assets and tags, and Claroty CTD assets. > These integrations simplify policy management, improve visibility into application and workload segmentation, reduce object maintenance, and enable automatic policy enforcement on the Check Point Firewall without requiring an additional policy installation. > * **Centralized .def File Management** - `.def` file settings can now be configured directly through SmartConsole and APIs. The settings are stored centrally in the database, enabling full auditing and revision history, centralized management, and seamless persistence across upgrades and backups. > ### Web SmartConsole > * Added support for these features and capabilities: > * Full support for **[Remote Access VPN Community](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_RemoteAccessVPN_AdminGuide/Default.htm#cshid=ID002)**. including Advanced Encryption settings, User groups, and the VPN Domain. > * **Threat Prevention** - Profiles and Protections. > * **Firewall Settings** - HTTPS Inspection, Logs, Fetch Policy, IPS, NAT, and Proxy. > * **Manage Setting** - Administrators, Permission Profiles, Sessions. > * **Additional capabilities** - Install/Uninstall of Jumbo Hotfix Accumulators, Manage Policies, Changes Report, Clone Objects. > For the updated list, see [sk170314](https://support.checkpoint.com/results/sk/sk170314) > * **Natural Language Rule Base Search** - You can now enter search requests in natural language. The AI will automatically convert your input into a tructured Rule Base query and apply the relevant filter, streamlining the search process. > * **Object Assistant** - Easy interaction with AI to inquire about objects and configure them directly using natural language. This functionality is integrated into the object editor to provide a smoother, more intuitive experience within the editor context. > ### Upgrade > * Introducing a [new background upgrade capability](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm#cshid=ID001) designed to significantly minimize downtime to a few minutes during Management Server upgrades. > The "Prepare Upgrade" phase runs seamlessly in the background, allowing administrators to continue working in SmartConsole, Web SmartConsole, or API without disruption. > The "Complete Upgrade" phase then finalizes the changes, significantly reducing downtime compared to traditional upgrade methods. > ### Logging and Monitoring > * **New Logs and Dashboard Views** - Introducing a modern, intuitive interface designed to make security monitoring faster, easier, and more effective. This new feature includes AI-powered search and advanced capabilities, enabling users to investigate events, uncover insights, and take actions more efficiently. > > * Log Exporter can be configured to export only the first and/or the latest update per event or connection. This enables more efficient log processing by external SIEM (Security Information and Event Management) tools. > * Log Exporter can now be configured with the Management API. This enables you to automate Log Exporter deployment and configuration within your infrastructure-as-code workflows. > * Log Exporter can now be configured [to send logs directly to AWS S3 buckets](https://sc1.checkpoint.com/documents/Log_Exporter/EN/Default.htm#cshid=ID003). This enables seamless integration with your existing cloud storage and log analytics workflows. > * In the SmartConsole **Gateways \& Servers** view, the Check Point Firewall status now changes to warning (yellow triangle icon) if the Check Point Firewall is writing logs locally for more than 5 minutes. This helps you quickly identify connectivity issues between the Check Point Firewall and its Log Server. |||
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Documentation {#Documentation} ------------------------------ ||||
|  [**Release Notes**](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_RN/Default.htm) |  **Administration Guides** |  **[Resolved Issues](https://support.checkpoint.com/results/sk/sk185041)** |  **[Known Limitations](https://support.checkpoint.com/results/sk/sk185040)** |
| View |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | General | Check Point Firewall | | [R82.20 Installation and Upgrade Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm) | [R82.20 Check Point Firewall Admin Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Firewall_Guide/Default.htm) | | [R82.20 Carrier Security Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_CarrierSecurity_AdminGuide/Default.htm) | [R82.20 ClusterXL Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ClusterXL_AdminGuide/Default.htm) | | [R82.20 CLI Reference Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_CLI_ReferenceGuide/Default.htm) | [R82.20 Threat Prevention Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ThreatPrevention_AdminGuide/Default.htm) | | [R82.20 Gaia Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_AdminGuide/Default.htm) | [R82.20 Data Loss Prevention Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_DataLossPrevention_AdminGuide/Default.htm) | | Security Management | [R82.20 Gaia Advanced Routing Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_Advanced_Routing_AdminGuide/Default.htm) | | [R82.20 Security Management Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm) | [R82.20 Identity Awareness Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_IdentityAwareness_AdminGuide/Default.htm) | | [R82.20 Multi-Domain Security Management Admin Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Multi-DomainSecurityManagement_AdminGuide/Default.htm) | [R82.20 Performance Tuning Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_PerformanceTuning_AdminGuide/Default.htm) | | [R82.20 SmartProvisioning Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SmartProvisioning_AdminGuide/Default.htm) | [R82.20 QoS Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_QoS_AdminGuide/Default.htm) | | [R82.20 Cloud Firewall Controller Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Cloud_Firewall_Controller_AdminGuide/Default.htm) | [R82.20 Remote Access VPN Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_RemoteAccessVPN_AdminGuide/Default.htm) | | [Cloud Management Extension (CME) Administration Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CME/Default.htm) | [R82.20 Mobile Access Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_MobileAccess_AdminGuide/Default.htm) | | [R82.20 Logging and Monitoring Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_LoggingAndMonitoring_AdminGuide/Default.htm) | [R82.20 Site to Site VPN Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SitetoSiteVPN_AdminGuide/Default.htm) | | Endpoint Security | [SSL Network Extender (SNX) Administration Guide](https://sc1.checkpoint.com/documents/SSL_Network_Extender_AdminGuide/Default.htm) | | [R82.10 and higher Endpoint Security Server Admin Guide](https://sc1.checkpoint.com/documents/R82.10/SmartEndpoint_OLH/EN/Default.htm) | [R82.20 VoIP Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_VoIP_AdminGuide/Default.htm) | | [R82.10 and higher Endpoint Security Web Management Admin Guide](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_HarmonyEndpointWebManagement_AdminGuide/index.html) | [R82.20 VSX Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_VSX_AdminGuide/Default.htm) | | SmartConsole | Scalable Platforms | | [R82.20 SmartConsole Help](https://sc1.checkpoint.com/documents/R82.20/SmartConsole_OLH/EN/default.htm) | [R82.20 Scalable Platforms Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ScalablePlatforms_AdminGuide/Default.htm) | | [R82.20 SmartConsole Help](https://sc1.checkpoint.com/documents/R82.20/SmartConsole_OLH/EN/default.htm) | [Maestro Getting Started Guide](https://sc1.checkpoint.com/documents/Appliances/GSG_Maestro/EN/Default.htm) | ||||
{#Installation_SmartConsole}{#Tools}
|---------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| Downloads and Installation {#Installation} ------------------------------------------ ||||
|  Upgrading Security Management and Multi-Domain Security Management > **If your Security Management Server / Multi-Domain Security Management is connected to the Internet (the common case):** > > 1. Connect to **Gaia Portal**. > > 2. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 3. Expand the section **Major Versions**. > > 4. In the applicable row, click **Upgrade**. > **If your Security Management Server / Multi-Domain Security Management is not connected to the Internet, click to see instructions:** > > 1. Download and install the latest [Upgrade Tools package](https://support.checkpoint.com/results/sk/sk135172) and [Gaia Deployment Agent (CPUSE)](https://support.checkpoint.com/results/sk/sk92449). > > 2. Download the **Fast Deployment Package (TGZ)** > > [](https://support.checkpoint.com/results/download/143700) [](https://support.checkpoint.com/results/download/143702) > > Note: On Multi-Domain Security Management, upgrade using Fast Deployment is supported starting from R81.10. > > OR > > Download the **CPUSE Offline Upgrade Package (TAR)** > > [](https://support.checkpoint.com/results/download/143573) > > 3. Connect to **Gaia Portal**. > > 4. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 5. Import the Fast Deployment or the CPUSE Offline Package. > > 6. Expand the section **Major Versions**. > > 7. In the applicable row, click **Upgrade**. >
> For more information and other upgrade methods, see the [R82.20 Installation and Upgrade Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm). *** ** * ** *** ||||
|  Upgrading Check Point Firewall > **The term "Security Gateway" was rebranded to "Check Point Firewall". > Best Practice:** Use Central Deployment in SmartConsole to upgrade one or more Security Gateways: > > **SmartConsole** \> **Gateways \& Servers** \> right-click a **Security Gateway or Cluster object** \> click **Actions** > > For more information, see the [R82.20 Security Management Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_SecurityManagement_AdminGuide/Default.htm) - Chapter "Managing Gateways" \> Section "Central Deployment of Hotfixes and Version Upgrades". > **If your Check Point Firewall is connected to the Internet (the common case):** > > 1. Connect to **Gaia Portal**. > > 2. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 3. Expand the section **Major Versions**. > > 4. In the applicable row, click **Upgrade**. > **For large scale fully automated Check Point Firewall upgrade using CDT, click to see instructions:** > > Upgrade your Check Point Firewall using [Central Deployment Tool (CDT)](https://support.checkpoint.com/results/sk/sk111158). > > Central Deployment Tool (CDT) is a utility that lets you manage a deployment of software packages from your Management Server to the multiple managed Check Point Firewalls and cluster members at the same time. > **If your Check Point Firewall is not connected to the Internet, click to see instructions:** > > 1. Download the **Fast Deployment Package (TGZ)** > > [](https://support.checkpoint.com/results/download/143696) > > OR > > Download the **CPUSE Offline Upgrade package (TAR)** > > [](https://support.checkpoint.com/results/download/143573) > > 2. Connect to **Gaia Portal**. > > 3. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 4. Import the downloaded Fast Deployment or the CPUSE Offline Package. > > 5. Expand the section **Major Versions**. > > 6. In the applicable row, click **Upgrade**. >
>
> **For Check Point Firewall 3900 Appliances, click to see instructions:** > > 1. Download the **Fast Deployment Package (TGZ)** > > [](https://support.checkpoint.com/results/download/143697) > > OR > > Download the **CPUSE Offline Upgrade Package (TAR)** > > [](https://support.checkpoint.com/results/download/143690) > > 2. Connect to Gaia Portal. > > 3. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 4. Import the downloaded Fast Deployment or the CPUSE Offline Package. > > 5. Expand the section **Major Versions**. > > 6. In the applicable row, click **Upgrade**. >
>
> For more information and other upgrade methods, see the [R82.20 Installation and Upgrade Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm). *** ** * ** *** ||||
|  Clean Install of Check Point Firewall and Management Server > **The term "Security Gateway" was rebranded to "Check Point Firewall".** > For **Check Point Firewall** , **Security Management** , or **Multi-Domain Management Server** > > 1. Download the **Fast Deployment Package (TGZ)** : > > [](https://support.checkpoint.com/results/download/143696) [](https://support.checkpoint.com/results/download/143700) [](https://support.checkpoint.com/results/download/143702) > > OR > > Download this **CPUSE** **Offline Upgrade Package (TAR)** : > > [](https://support.checkpoint.com/results/download/143573) > > 2. Connect to **Gaia Portal**. > > 3. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 4. Import the downloaded Fast Deployment or the CPUSE Offline Package. > > 5. Expand the section **Major Versions**. > > 6. Click the three dots on the right and select **Clean Install**. > **If you use Bootable USB device:** > > 1. Download the **Gaia OS Clean Install ISO file** : > > [](https://support.checkpoint.com/results/download/143497) > > 2. See [sk65205](https://support.checkpoint.com/results/sk/sk65205) to create a bootable USB device. > > 3. Run the Gaia First Time Configuration Wizard. > > For more information, see the [R82.20 Installation and Upgrade Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm) . > **For Check Point Firewall 3900 Appliances** > > 1. Download the **Fast Deployment Package(TGZ)** > > [](https://support.checkpoint.com/results/download/143697) > > OR > > Download this **Offline Upgrade Package (TAR):** > > [](https://support.checkpoint.com/results/download/143690) > > 2. Connect to **Gaia Portal**. > > 3. In the left navigation tree, click **Software Updates** \> **Available Updates**. > > 4. Import the downloaded Fast Deployment or the CPUSE Offline Package. > > 5. Expand the section **Major Versions**. > > 6. Click the three dots on the right and select **Clean Install**. > >
> > **If you use Bootable USB device on Check Point Firewall 3900 Appliances:** > > 1. Download the **Gaia OS Clean Install ISO file** : > > [](https://support.checkpoint.com/results/download/143533) > > 2. See [sk65205](https://support.checkpoint.com/results/sk/sk65205) to create a bootable USB device. > > 3. Run the Gaia First Time Configuration Wizard. > > For more information, see the [R82.20 Installation and Upgrade Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Installation_and_Upgrade_Guide/Default.htm) . *** ** * ** *** ||||
|  ElasticXL and Maestro Hyperscale Firewall > **In a Maestro environment, you must follow this upgrade order:** > 1. Upgrade the Management Server that manages the Maestro Security > Group. > 2. Upgrade the Maestro Orchestrators on each Maestro Site. > Note: There is no requirement for a minimum Take of Jumbo Hotfix Accumulator before you upgrade. > 3. Upgrade the Maestro Security Groups on each Maestro Site. >
> **To upgrade a Scalable Platform from R81.10, R81.20, R82, or R82.10:** > 1. Install the required Jumbo Hotfix Accumulator: > * **On R82.10 ElasticXL and Maestro in Gateway mode / VSNext mode OR Maestro in Traditional VSX mode** - Install the [R82.10 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) Take 19 or higher. > * **On ElasticXL and Maestro in Gateway mode / VSNext mode OR Maestro in Traditional VSX mode** - Install the [R82 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) Take 103 or higher. > * **On R81.20 Maestro in Gateway or** **Traditional VSX mode** - Install the [R81.20 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) Take 120 or higher. > * **On R81.10 Maestro in Gateway or Traditional VSX mode** - Install the [R81.10 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) Take 183 or higher. > 2. Install the latest CPUSE Deployment Agent from [sk92449](https://support.checkpoint.com/results/sk/sk92449). > 3. Download and import this **Offline Upgrade Package (TAR)** : > [](https://support.checkpoint.com/results/download/143573) > For upgrade procedures, see [R82.20 Scalable Platforms Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ScalablePlatforms_AdminGuide/Default.htm). >
> **Clean install** > * Download and import this **Installation Image (ISO)** : > [](https://support.checkpoint.com/results/download/143497) > For installation procedure, see the [R82.20 Scalable Platforms Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_ScalablePlatforms_AdminGuide/Default.htm). *** ** * ** *** ||||
|  Cloud Firewall > ### Deploying Cloud Firewall Gateway {#Toggle_Installation_CGNetwork} > > Coming soon >
> ### Upgrading Cloud Firewall Gateway > 1. Download the relevant Fast Deployment Package from [sk177714 - In-Place Upgrade packages for Cloud Firewall](https://support.checkpoint.com/results/sk/sk177714). > 2. Import it into the SmartConsole package repository. > 3. Right-click the Fast Deployment Package and click **Upgrade**. *** ** * ** *** ||||
|  SmartConsole > 1. Download the SmartConsole **installation EXE file** : > [](https://support.checkpoint.com/results/download/139466) > 2. Transfer the SmartConsole installation file to a Windows-based computer you wish to use as a SmartConsole Client. > 3. Run the SmartConsole installation file with Administrator privileges and follow the on-screen instructions. > * For Web SmartConsole, see [sk170314](https://support.checkpoint.com/results/sk/sk170314) > * For Portable SmartConsole, see [sk116158](https://support.checkpoint.com/results/sk/sk116158) *** ** * ** *** ||||
|  Additional Downloads and Products > |-------------------------------------|---|---|---|---|---|---| > | Product | Download |||||| > | **Fast Deployment Package (Blink)** | See [sk120193](https://support.checkpoint.com/results/sk/sk120193) |||||| > | **Upgrade Tools package** | See [sk135172](https://support.checkpoint.com/results/sk/sk135172) |||||| > | **DLP Agent for Exchange Server** | [](https://support.checkpoint.com/results/download/135043) For Windows (MSI) |||||| ||||
| **[Release map](https://support.checkpoint.com/results/sk/sk152052) \| [Upgrade and Backward Compatibility maps](https://support.checkpoint.com/results/sk/sk113113) \| [Releases Terminology](https://support.checkpoint.com/results/sk/sk95746)**
||||
|  |  |  |  |
| **[Check Point CheckMates Community](https://community.checkpoint.com)** | [**Early Availability (EA) Programs**](https://support.checkpoint.com/results/sk/sk183058) | [**Security Advisories**](https://support.checkpoint.com/security-advisories) | **[Education and Training](https://support.checkpoint.com/results/sk/sk163417)** |
| Revision History {#History} --------------------------- ||||
| Show / Hide
|-------------|---------------------------------| | Date | Description | | 08 Sep 2026 | First release of this document. | ||||
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content