Endpoint Security E80.30 Localized Version Release Notes 30 September 2013
2013 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR 52.227-19. TRADEMARKS: Refer to the Copyright page (http://www.checkpoint.com/copyright.html) for a list of our trademarks. Refer to the Third Party copyright notices (http://www.checkpoint.com/3rd_party_copyright.html) for a list of relevant copyrights and third-party licenses.
Important Information Latest Software We recommend that you install the most recent software release to stay up-to-date with the latest functional improvements, stability fixes, security enhancements and protection against new and evolving attacks. Latest Documentation The latest version of this document is at: (http://supportcontent.checkpoint.com/documentation_download?id=13086) For more about this release, see the home page at the Check Point Support Center (http://supportcontent.checkpoint.com/solutions?id=sk65921). Revision History Date Description 30 September 2013 Updated home page links 4 December 2012 Updated Supported Client Operating Systems (on page 7) 15 February 2012 Updated WebCheck Supported Browsers (on page 8). 8 February 2012 Added Build Numbers (on page 8) for the release. 1 January 2012 For Media Encryption & Port Protection, the maximum size for the encrypted partition of external hard drives has been increased to 1TB. 24 November 2011 First release - Added support for Endpoint Security Client in non- English languages. Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments (mailto:cp_techpub_feedback@checkpoint.com?subject=feedback on Endpoint Security E80.30 Localized Version Release Notes).
Contents Important Information... 3 Introduction... 5 What's New... 5 Server Side Features... 5 Client Side Features... 5 System Requirements... 6 Supported Server Operating Systems... 6 Server Hardware Requirements... 6 Supported Security Gateways... 6 SmartConsole Supported Platforms... 6 Supported Languages... 7 Supported Client Operating Systems... 7 Client Languages... 7 Client Hardware Requirements... 8 WebCheck Supported Browsers... 8 Build Numbers... 8 Upgrading to this Release... 8 Upgrading Servers... 9 Upgrading Multiple Servers... 9 Deploying Upgraded Clients... 9 Known Limitations and Resolved Issues... 10
Introduction Introduction Thank you for updating your Check Point products with Endpoint Security E80.30 Localized release. The Endpoint Security E80.30 Localized release includes localized Endpoint Security clients and a localized SmartConsole. The Endpoint Security Servers are the same as E80.30. To deploy localized clients, download Endpoint Security E80.30 Client Packages for Administrators and import all client packages to the server. Note - This release continues the Endpoint Security R80 series. From E80.20 and higher, the versions of the series start with E. Find Related Information and Documentation: Endpoint Security E80.30 Localized Home Page: sk65921 (http://supportcontent.checkpoint.com/solutions?id=sk65921) Endpoint Security R80 Home Page: sk59281 (http://supportcontent.checkpoint.com/solutions?id=sk59281) What's New This release includes new features for the server and client. Server Side Features Virtual Groups - A directory that you can use to create and manage groups, users, and computers with the SmartEndpoint. You can use it as an alternative to active directory or with active directory for added flexibility. New configurable permission to delete items from removable devices. Improved Endpoint Security server installation. Client Side Features Pre-boot authentication with Smartcards - Users can authenticate to the Pre-boot with a Smartcard. Users must have a physical card, an associated certificate, and Smartcard drivers installed. New Preboot reports help you manage the Smartcard authentication. Improved Installation Postponement Message - When users postpone an installation or upgrade, they can choose the time interval until the next reminder message. Support for E80.30 Firewall, Anti-malware, and Compliance protection on Windows servers. Media Encryption and Port Protection supports USB 3.0 standard devices. In Media Encryption and Port Protection the maximum size for the encrypted partition of external hard drives has been increased to 1TB. Endpoint Security Release Notes E80.30 Localized Version 5
System Requirements System Requirements This section shows supported operating systems, gateways, and hardware requirements. Supported Server Operating Systems All editions of Microsoft Windows Server 2003 and 2008 are supported. Note - *If you use Windows 2008 Server R2, you must install.net 3.5.1 using the Server Manager before you start the installation. See sk63803 (http://supportcontent.checkpoint.com/solutions?id=sk63803) for details. VMware: VMware ESX 3.5 VMware vsphere 4.0, 4.1 VMware ESXi 4.1.0 Server Hardware Requirements Component Processor Memory Disk Space (for installation) Minimum Requirement Intel Pentium Processor E2140 or 2GHz equivalent processor 2GB 4GB Resource consumption is based on the scale of your deployment. The larger the deployment, the more disk space, memory, and CPU are required. Supported Security Gateways This version of Endpoint Security works with Check Point Security Management Server R70. For information on requirements and supported Security Gateways for R70, see the R70 Release Notes (http://supportcontent.checkpoint.com/documentation_download?id=8712). SmartConsole Supported Platforms Microsoft Windows Server 2003 32 bit, SP1 and SP2 Microsoft Windows Server 2003 R2 32/64 bit, SP1 and SP2 Microsoft Windows Server 2008 32 bit Microsoft Windows Server 2008 R2 Microsoft Windows XP Professional 32 bit, SP3 Microsoft Windows Vista 32 bit, SP1 Microsoft Windows 7 Enterprise, Professional, Ultimate editions 32/64 bit, SP1 Endpoint Security Release Notes E80.30 Localized Version 6
System Requirements Supported Languages The Endpoint Security Management Console is available in English and Native Japanese on Microsoft Windows Server 2003/2008 32-bit, SP2. The Endpoint Security Management Console is supported in operating systems of additional languages but the Console will be in English. These operating systems are: French German Spanish Italian Supported Client Operating Systems This release supports the Endpoint Security client on: Microsoft Windows XP Professional 32 bit, SP3 Microsoft Vista 32/64 bit, SP1 Microsoft Windows 7 Enterprise, Professional, Ultimate editions 32/64 bit and SP1 This release also supports specified blades on these Windows servers: Windows Server 2008 32/64 bit Windows Server 2008 R2 Starting with the E80.30 release, these blades can be installed on supported servers in the same way that they are installed on workstations: Anti-Malware Firewall Compliance If you install a client package that includes blades that are not supported on the server, the installation succeeds and only the appropriate blades are installed. Important - Application Control is not supported on Windows Server. To disable Application Control on servers: a) Assign the server group or members to a new application control policy. b) Disable application control in the policy. c) Install the policy. Client Languages The Endpoint Security client is available in these languages: English French German Japanese Russian Czech Endpoint Security Release Notes E80.30 Localized Version 7
Build Numbers Client Hardware Requirements The minimum hardware requirements for client computers that run the Total Endpoint Security Package are: Windows XP - 512 MB RAM and 1 GB free space Vista and Windows 7-1 GB RAM and 1 GB free Disk space WebCheck Supported Browsers WebCheck supports these browsers: Internet Explorer, versions 6, 7, 8, 9 Mozilla Firefox, version 10 Build Numbers These build numbers are included in the release: Component Version Core Components 8.0.995 Compliance 8.10.8.6961 Media Encryption and Port Protection 8.10.0.6833 Anti-Malware 8.2.9.88 Network & Application Firewall 8.1.000.850 Endpoint Connect 836001511 Full Disk Encryption 80.1.20.43 WebCheck 1.6.323.0 Upgrading to this Release Supported upgrade paths for this release are shown here. HFAs or Hotfixes on top of each version are also supported. R80.x E80.x R73 Pointsec FDE 6.3.x FDE7.x If you are upgrading from E80.30, it is not necessary to upgrade the Endpoint Security servers. Upgrade the client packages and SmartConsole. Endpoint Security Release Notes E80.30 Localized Version 8
Upgrading to this Release Upgrading Servers Install this release on all Endpoint Security Management Servers and Endpoint Policy Servers. They all must be upgraded before you deploy new clients or upgrade existing clients. When you upgrade the Endpoint Security Management Server, all saved Full Disk Encryption policies are re-installed on the clients that they were assigned to. If you saved changes to Full Disk Encryption policies but do not want the changes to be installed on clients, delete the policies or revert the changes before you upgrade the server. Get all files from sk65921 (http://supportcontent.checkpoint.com/solutions?id=sk65921). To upgrade an Endpoint Security Server to this version: 1. Download the Endpoint Security Server Upgrade package. 2. Extract the tgz file locally on the Server. 3. Run Setup.exe. A command prompt window opens asking if you want to continue. 4. Type: y 5. Reboot when prompted. 6. Download the E80.30 Localized SmartConsole. 7. Double-click setup.exe. 8. When prompted, click Remove to uninstall the R80 or E80.x SmartConsole that you have installed. 9. When it completes, double-click setup.exe again to install the E80.30 Localized SmartConsole. After a server is upgraded to this version, the server modifies existing Media Encryption and Port Protection policies. This adds new versions of Check Point GO to work with Media Encryption and Port Protection. To see which policies were modified: 1. In the SmartEndpoint, click Install Policies. 2. Go to Policies > Media Encryption and Port Protection. The Modified column of changed policies shows Server upgrade. Upgrading Multiple Servers In an environment with multiple Endpoint Security servers that includes High Availability Endpoint Security Management Servers or Endpoint Policy Servers, do the upgrade in this sequence: 1. Upgrade all Endpoint Security Management Servers. a) Upgrade the Active Endpoint Security Management Server. b) Before you restart the Active Endpoint Security Management Server, run cpstop on all Standby Endpoint Security Management Servers. c) Restart the Active Endpoint Security Management Server. d) Upgrade all Standby Endpoint Security Management Servers and restart them. 2. Upgrade each Endpoint Policy Server immediately after you upgrade the Endpoint Security Management Servers. Note - An Endpoint Policy Server with a version lower than the Endpoint Security Management Server continues to communicate with clients, but will not synchronize with the newer Endpoint Security Management Server. Deploying Upgraded Clients To deploy localized clients, download Endpoint Security Client Packages for Administrators from sk65921 (http://supportcontent.checkpoint.com/solutions?id=sk65921) and import all client packages to the server. To import the client packages to your server: 1. In the Endpoint Security Management Console, open the Software Deployment tab. Endpoint Security Release Notes E80.30 Localized Version 9
2. In the Common Tasks area, select Add new Endpoint installation package. 3. Click Add from file and choose one package. 4. Repeat step #3 to add all packages. To deploy new client packages, the workflow is: Upgrade the Profiles. Distribute the profile packages automatically or with an exported package. Upgraded clients and non-upgraded clients can connect to the same upgraded server To upgrade a Profile: 1. Go to the Software Deployment tab of the SmartEndpoint. 2. Select each profile and click Upgrade Profile. To deploy using Software Deployment Assignments: Known Limitations and Resolved Issues If you deployed the previous client packages with Software Deployment Assignments, the upgrade occurs automatically when you install policies on the clients. The sequence is: 1. Upgrade the Profiles. 2. Select File > Install Policies. All computers that have one of those profiles installed will automatically receive the upgrade when the Endpoint Security client connects to the server. To deploy using exported packages: 1. Upgrade the Profiles. 2. For each package, click Export Package. To upgrade more gradually, you can create a new package and distribute it only to specified computers. Note - For an exported package, save the new package in a different location than the previous package. When you are prepared to upgrade all clients, upgrade all packages. For full details on upgrading clients, see the Endpoint Security Administration Guide (http://supportcontent.checkpoint.com/solutions?id=sk65921). Known Limitations and Resolved Issues Known limitations for this release are in sk65377 (http://supportcontent.checkpoint.com/solutions?id=sk65377). Issues resolved by this release are in sk65378 (http://supportcontent.checkpoint.com/solutions?id=sk65378). Endpoint Security Release Notes E80.30 Localized Version 10