> Source: [sk97987](https://support.checkpoint.com/results/sk/sk97987) # sk97987 - Some SSL VPN functionality breaks as a result of a Java update to version 7 update 51 (7u51) and higher | Property | Value | |----------|-------| | Solution ID | sk97987 | | Date Created | 2014-01-01 | | Last Modified | 2020-07-07 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Symptoms - After a Java update to version 7 update 51 (7u51) and higher, launch of Check Point Deployment Agent applet fails. As a result, functionality, such as ESOD scan, SNX, Native Application launch, etc., fails. ## Cause Oracle had introduced a change in the security settings, which as a result blocks the Java version of the Check Point Deployment Agent. ## Solution **Note:** To check your current Java version, go to **Table of Contents:** 1. Hotfix availability 2. Hotfix installation instructions 3. Hotfix uninstall instructions 4. Workarounds ### (1) Hotfix availability {#Hotfix availability} This problem was fixed. The fix is included in: * [Check Point R77.20](http://supportcontent.checkpoint.com/solutions?id=sk101208) * [Jumbo Hotfix Accumulator for R77.10](http://supportcontent.checkpoint.com/solutions?id=sk98285) - since *Take_4* * [Jumbo Hotfix Accumulator for R76](http://supportcontent.checkpoint.com/solutions?id=sk96191) - since *Take_61* Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=73) / [upgrade VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)). Note for **600 / 1100 appliances running R75.20.X firmware:** * For *1100 Centrally Managed* appliances, [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for Security Management Server. * For *600 / 1100 Locally Managed* appliances, upgrade to [R75.20.50](http://supportcontent.checkpoint.com/solutions?id=sk98404) to resolve the issue. ### (2) Hotfix *installation* instructions for Security Gateway R77.10 and lower {#Hotfix installation instructions} 1. Hotfix has to be installed on ***Security Gateway***. **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 2. Download the two hotfix packages for your version of Security Gateway: **Note: The "CVPN" part is required only when you are using the Mobile Access Blade.** |-----------------------------|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Version of Security Gateway | Platform | Link to FW-1 part | Link to CVPN part | | R77.10 ^(1)^ | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R77.10 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31144) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R77.10 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31131) (TGZ) | | R77 | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R77 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31127) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R77 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31130) (TGZ) | | R76 ^(2)^ | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R76 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31126) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R76 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31147) (TGZ) | | R75.47 | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.47 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31125) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.47 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31140) (TGZ) | | R75.46 | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.46 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31124) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.46 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31129) (TGZ) | | R75.45 | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.45 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31123) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.45 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31139) (TGZ) | | R75.40 | Gaia / SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.40 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31143) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.40 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31138) (TGZ) | | R75.30 | SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.30 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31142) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.30 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31137) (TGZ) | | R75.20 | SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R75.20 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31122) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R75.20 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31136) (TGZ) | | R71.50 | SecurePlatform OS | [![](https://sc1.checkpoint.com/sc/images/download-m.png "FW-1 hotfix package for R71.50 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31141) (TGZ) | [![](https://sc1.checkpoint.com/sc/images/download-m.png "CVPN hotfix package for R71.50 Security Gateway")](http://supportcontent.checkpoint.com/file_download?id=31128) (TGZ) | Notes: 1. This fix for R77.10 on *Gaia OS* (both FW-1 part and CVPN part) is included in [sk98285 - Jumbo Hotfix Accumulator for R77.10 (gypsy_hf_base_021)](http://supportcontent.checkpoint.com/solutions?id=sk98285) since ***Take_4*** (together with updated SNX client from [sk97702](http://supportcontent.checkpoint.com/solutions?id=sk97702)). 2. This fix for R76 on *Gaia OS* (both FW-1 part and CVPN part) is included in [sk96191 - Jumbo Hotfix Accumulator for R76 (gizmo_hf_041_050)](http://supportcontent.checkpoint.com/solutions?id=sk96191) since ***Take_61*** (together with updated SNX client from [sk97702](http://supportcontent.checkpoint.com/solutions?id=sk97702)). 3. Transfer the two hotfix packages to the Security Gateway into two *separate* directories: * FW1 package (*fw1_wrapper_\.tgz* ) into e.g., */path_to_FW1_fix/* * Mobile Access package (*cvpn_\.tgz* ) into e.g., */path_to_cvpn_fix/* 4. Unpack and install the FW1 hotfix package: ***\[Expert@HostName\]# cd /path_to_FW1_fix/*** ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 5. Do **NOT** reboot yet. 6. Unpack and install the Mobile Access CVPN hotfix: ***\[Expert@HostName\]# cd /path_to_cvpn_fix/*** ***\[Expert@HostName\]# tar -zxvf cvpn_\.tgz*** ***\[Expert@HostName\]# ./cvpn_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 7. Reboot the Security Gateway. ### (3) Hotfix *uninstall* instructions for Security Gateway R77.10 and lower {#Hotfix uninstall instructions} 1. Hotfix has to be uninstalled from **Security Gateway**. **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 2. Stop all the Check Point services on Security Gateway: ***\[Expert@HostName\]# cpstop*** 3. UnInstall the FW-1 hotfix: ***\[Expert@HostName\]# cd /opt/CPsuite-\/*** ***\[Expert@HostName\]# ./uninstall_fw1_wrapper_\*** *Example for R77 hotfix* : > > ``` > [Expert@HostName]# cd /opt/CPsuite-R77/ > [Expert@HostName]# ./uninstall_fw1_wrapper_HOTFIX_GULLI_HF_BASE_207 > ``` 4. Do **not** reboot yet. 5. UnInstall the CVPN hotfix (relevant if Mobile Access Blade is used): ***\[Expert@HostName\]# cd /opt/CPcvpn-\/*** ***\[Expert@HostName\]# ./uninstall_cvpn_\*** *Example for R77 hotfix* : > > ``` > [Expert@HostName]# cd /opt/CPcvpn-R77/ > [Expert@HostName]# ./uninstall_cvpn_HOTFIX_GULLI_HF_BASE_207 > ``` 6. Reboot the Security Gateway. ### (4) Workarounds {#Workarounds} If you do not wish to upgrade / install a hotfix, then the following *workarounds* are available: Show All Workarounds * #### Either lower the Java security settings to "Medium" (applies only to Java 7) **Related resource:** * Instructions for Windows OS 1. Go to Start menu. 2. Go to Control Panel. 3. Click on '`Java`'. 4. Go '`Security`' tab. 5. Move the slider to the bottom ('`Medium`'). 6. Click on '`OK`'. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Security_tab_Medium.png)
* Instructions for Mac OS X 1. In the upper left corner of the screen, click on '`Apple`' icon. 2. Go to '`System Preferences`'. 3. Click on '`Java`'. 4. Go '`Security`' tab. 5. Move the slider to the bottom ('`Medium`'). 6. Click on '`OK`'.

* #### Or add the relevant web site to "Exception Site List" (as of the JDK 7u51 release, and Java 8) **Related resources:** and **Note:** The "Exception Site List" feature is available only since the release of **Java 7 Update 51** . To check your current Java version, go to * Instructions for Windows OS 1. Go to Start menu. 2. Go to Control Panel. 3. Click on '`Java`'. 4. Go '`Security`' tab. 5. Click on '`Exception Site List...`' button: |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Java 7 | Java 8 | | [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Security_tab.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Security_tab.png "Click the image to see it in full size in a new tab/window") | [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/Java_81504110141.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/Java_81504110141.png "Click the image to see it in full size in a new tab/window") | 6. Click on '`Add`': ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Exception_Site_List.png) 7. Under '`Location`', type the URL into the empty field (`https://X.X.X.X`): ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Exception_Site_List_Add.png) Note: If you add an HTTP location, then a warning is presented. Click on '`Continue`': ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk97987/sk97987_Java_Control_Panel_Exception_Site_List_HTTP_Security_Warning.png) 8. Continue to click on '`Add`' and enter URLs until your list is complete. 9. Click on '`OK`' to save the URLs that you entered. 10. Click on '`OK`'.

* Instructions for Mac OS X 1. In the upper left corner of the screen, click on '`Apple`' icon. 2. Go to '`System Preferences`'. 3. Click on '`Java`'. 4. Go '`Security`' tab. 5. Click on '`Exception Site List...`' button. 6. Click on '`Add`'. 7. Under '`Location`', type the URL into the empty field (`https://X.X.X.X`). 8. Continue to click on '`Add`' and enter URLs until your list is complete. 9. Click on '`OK`' to save the URLs that you entered. 10. Click on '`OK`'. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content