I have had a lot of questions regarding the new Daylight Saving Time (DST) for North America. Traditionally, DST takes place in the first week of April. However starting in 2007 that has been moved to to March. Check out this link for a description of the change.
This of course will have an effect on computing and networking gear in North America. Check Point firewalls are no exception as the time value is important. If you are maintaining Check Point products, there are three options for you:
- The first is to use Coordinated Universal Time (UTC). UTC does not use Daylight Saving, and is probably what you should have your clocks set to anyway. If you are using UTC, there is nothing more that needs be done.
- Do nothing and continue your current time zone setting. This will not break anything, VPNs will still work as well. Be aware though by doing this you will have to accept that your SmartView Tracker logs will be off by 23 hours. Probably not the best approach, but you can get by on this.
- Apply the appropriate OS or Check Point Hotfix if you are using a DST Time Zone (PST, MST, CST, EST). This next section will discuss those patches and Hotfixes.
The following SPlat versions are DST compliant:
R61 Take 56*
* Note if you are running R61, run the ‘ver’ command. If it shows “Build 139” then you have the Take 56 build.
Only Windows XP SP2, Windows 2003 Server and Vista versions will be fixed. Apply the the appropriate Service Pack.
The following IPSO builds are certified:
3.8 build 058
3.8.1 build 044
3.9 build 052
4.0 build 040
4.1 – all builds
4.2 – all builds
The above three scenarios should give you a start for what you should be considering for the DST change. The best solution of the three is actually a combination of one and three. Any good Check Point Firewall architecture should be using UTC as well as be regularly patched.