Configuring Firmware in a Provisioning Profile for Small Office Appliances

When you configure firmware settings on a ProvisioningClosed Check Point Software Blade on a Management Server that manages large-scale deployments of Check Point Security Gateways using configuration profiles. Synonyms: SmartProvisioning, SmartLSM, Large-Scale Management, LSM. Profile, you give the configuration for all Small Office Appliances assigned to this profile.

The Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. version must match its SmartLSM profile's version as defined in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. for correct policy behavior. In some instances, it is necessary to define exceptions for the default SmartLSM security profile that replaces the security profiles you have now, after installation of the firmware image. For example, if you do not want all gateways to use the specified default SmartLSM profile after installation, you can customize different security profiles to replace known security profiles.

  • The default SmartLSM profile after installation is configured to use a SmartLSM profile called "NewLSM".

  • After firmware installation, you want the "NewLSM" profile to be installed on all Security Gateways except for gateways that currently use the "GroupA_LSM" profile.

  • You want to replace the "GroupA_LSM" profile with a profile called "GroupA_NewLSM".

In such a scenario, you add an exception that replaces the "GroupA_LSM" profile with the "GroupA_NewLSM" profile.

  • Immediately - Downloads and installs the firmware immediately after you save these settings in the next synchronization with a Security Gateway assigned to this profile.

  • According to time ranges - You can define download and installation time ranges for the firmware image. You can limit the download and installation time to a specified list of time ranges in the week. They start at the nearest time range after firmware settings are applied. For example, if the firmware installation settings are applied on Sunday and there are two time ranges:

    • One range is set to Friday 00:00 to Saturday 00:00

    • One range is set to Wednesday 23:00 to Thursday 06:0

      The firmware will be installed between Wednesday 23:00 and Thursday 06:00.

      If the Security Gateway does not succeed to download or install the firmware during the nearest time range, it tries again in the next time range.

  1. Open the Security Gateway Profile window, and select the Firmware tab.

  2. Select Manage firmware centrally from this application.

  3. Click Advanced. The Profile Settings window is displayed.

  4. Select one of these override profile settings:

    • Allowed

    • Denied

    • Mandatory

    For more information about override profile settings, see .

  5. In Firmware image, click Select to select a firmware image that was uploaded through SmartUpdateClosed Legacy Check Point GUI client used to manage licenses and contracts in a Check Point environment. (see Uploading Packages to the Repository).

  6. In Default SmartLSM Profile after installation, select the new SmartLSM profile of the Security Gateway (the Security Gateway version must match its SmartLSM profile's version as defined in SmartConsole for correct policy behavior). The Security Gateway will replace its SmartLSM profile after successful firmware installation and only if the new firmware version is different from the version you have now.

  7. If necessary, click Exceptions to select a new SmartLSM profile for Security Gateways with a specified SmartLSM profile.

    • Add/Edit - Click Add or Edit to open the Exceptions window to define or change an exception for a SmartLSM profile replacement.

      • Current SmartLSM Profile - Select a SmartLSM profile from the list. Make sure you installed policy for the SmartLSM profile in SmartConsole.

      • SmartLSM Profile after installation - Select a SmartLSM profile to replace the SmartLSM profile after the firmware image installation. A SmartLSM profile is shown only if the version is the same as the selected firmware version. Make sure you installed policy for the SmartLSM profile in SmartConsole.

    • Remove - Click to remove a SmartLSM profile exception setting.

  8. Select one of these options to install the firmware:

    1. Immediately

    2. According to these time ranges - Select to use the Security Gateway time or local time.

      • Add/Edit - Click Add or Edit to open the Time Range window to define or change the weekdays and times for download and installation of the firmware image. Select the days and times. Click OK.

      • Remove - Select a range from the list and click Remove to delete a time range.

      • Download image immediately - Click this option to download the firmware image immediately but install the image during one of the set time ranges.

  9. Click Show profile settings - to see the settings of the Provisioning Profile that this gateway references.

  10. Click OK.