Take 103 - General Availability

"Runtime error: java.lang.String incompatible with com.checkpoint.management.web_api_is.common.multi_values.objects.MultiStringForSet" error when trying to set a tag to ICMP and ICMP6 services or set those services into a group with API command.

Support for Internal CA certificate replacement.

Deletion of Domain failed with "Could not send message" error when having large amount of gateways in the domain. The Domain remain without Domain Servers.

After opening and searching in pickers for a few times, the "error retrieving results" message appears when opening a picker.

In some scenarios, traffic is dropped with "network_classifier_get_dynobjs_for_ip: failed to get UUIDs for IP 0.0.0.0" and "kfunc_ip_ranges_to_dynobj: network_classifier_get_dynobjs_for_ip failed" errors in dmesg when dynamic object is used in access policy.

Inline layers are not verified when there are no selected targets in the 'install on' column.

In some cases on Multi-Domain environments with several servers, tasks still appear in progress after restart of the server even though they are not really running.

Due to a failed full sync, FWM was restarted unexpectedly and obsolete domain sessions were used in the global policy assignment.

When running the 'add-domain' Web API command on an existing Domain, the original Domain is deleted.

In rare cases, if Domain deletion failed in the past, and following MDS Upgrade or MDS Restore - some objects are missing on Domain or Global level in SmartConsole.

This is relevant specifically under the following cases:

• Multi-Domain Server upgrade from R80.10 to R80.20.
• Multi-Domain Server upgrade from R80.10 to R80.20.
• Multi-Domain Server Restore in any R80.x

Multi-Domain Server processes must be stopped before running cma_migrate.

The mds_backup command will generate an output file of format .tar instead of .tgz to improve the duration time of backup (mds_backup) and restore (mds_restore) of Multi-Domain Server. Refer to sk163300.

VPN tunnel of LSM gateway can not be established when CO gateway is managed by Security Management of higher version. Refer to sk106628.

In some scenarios, SmartConsole terminates when installing policy on many targets at once.

In rare scenarios, upgrade fails with "com.checkpoint.management.classes.dle.triggers.internal.VersionInfo.VersionInfo" NPE in cpm.elg file.

In a specific scenario, Global policy rules may change order after Multi-Domain Server upgrade. Refer to sk155432.

Security hardening for IDA enforcement according to XFF IP.

In a rare scenario, identities are missing from all connected Identity Gateways (PEPs).

Users are not propagated from the PDP to the PEP on a specific network due to a rare race condition between register and unregister requests triggered by different instances or cluster members.

Users are not authenticated when an identity source provides the login name in an 'User Principal Name' format "user@domain". Refer to sk147417

In some scenarios, when a connection is accelerated and ICMP packet is sent from a server to a client, it is being dropped by Security gateway.

In a rare scenario, ROUTED process unexpectedly exits when ECMP is enabled for both IBGP and EBGP. Refer to sk162547.

Possible performance impact on NAT port exhaustion scenarios.

The Fast Acceleration feature lets you define trusted connections to allow bypassing deep packet inspection. This feature significantly improves throughput for these trusted high volume connections and reduces CPU consumption.

Issue with categorization of HTTPS sites over IPv6.

Running views or reports that contain the attack / attack_info fields may fail or not be completed.

In a rare scenario, when an environment has many gateways (dozens), FWM on the log server may crash when reaching to 4 GB memory.

Many "fwldbcast_new: too many hosts : 0" kernel messages appear in /var/log/messages file. Refer to sk153253.

Enable the user to use CLISH commands related to LOM at (Smart-1 3150).

In a rare scenario, crash on Active member when accessing Standby member via IPv6. Refer to sk159635.

The message "fwlddist_debug_update_op: resetting to avoid overflow" should be printed only in debug mode since it's not an error.

Debug for the adp module in host Performance Pack does not work.

When IPS is enabled on VS connected to VR, HTTP traffic is not passing out of the internal Host.

In a rare scenario, multicast routing lookup may lead to SIM crash.

Host destination entries memory leaking when neighbor entry is incomplete state.

R80.20 JHF failed to install when using Anti-Malware E2 engine for signatures update.

After running "cpca_client re_sign_ca" and "mcc replace", SmartConsole shows the same Internal CA certificate.