Take 117 - Ongoing

Added ability to automatically determine the API process memory allocation to avoid "Out of memory" errors. Refer to sk119553.

In some scenarios, user cannot discard or publish a worksession, receiving the general message "Internal error".

In some scenarios, size of the shadow_object.C file increases after each policy installation, eventually causing a failure in installing a policy.

Cannot export a .pdf file from the Licence inventory view after Jumbo HotFix installation on the Management server.

When many users are connected to and actively working in the same domain in SmartConsole, they may experience:

• Slowness in SmartConsole responses
• Long duration of operations
• High load on the Management Server

In some scenarios, policy verification process fails after reaching memory size of 4GB. Refer to sk161412.

In a rare scenario, the Security Management server does not start due to a missing object, or a duplication of objects.

In some scenarios, upgrade from R80 fails due to an internal error related to deprecated application objects. Refer to sk157752.

Running views and reports with a filter fails if the filter contains a "NOT" operator combined with parentheses.

In some scenarios, when running mdsstart, the following error message is shown: "/opt/CPSmartLog-R80.20/bin/smartlogstop: line 65: /opt/CPmds-R80.20/customers/<name>/CPSmartLog-R80.20/log/smartlogRun.log: No such file or directory".

In the Logs & Monitor view, the "File size" field is missing from the logs generated by Media Encryption & Port Protection Blade. Refer to sk157952.

In some scenarios, when SAM activity is defined and a Log server receives a high amount of packets, the FWD process on the Log server unexpectedly exits.

In some scenarios, Administrator does not see that a revision was created in its Domain (on Domain level) after a Global policy was assigned to it.

"dleserver.utils.UidManager" errors on cma_migrate failure on Multi-Domain Server upgraded from R80.

In some scenarios, user cannot delete a VS object since it is referenced by an automatically generated exception rule. Refer to sk167272.

In some scenarios, when there is a large quantity of unused permission profiles in the system, the CPM server takes a long time to start.

In setups with a large quantity of network object, users may experience slowness when editing the HTTPS Inspection policy. Refer to sk147134.

• This fix requires R80.20 SmartConsole Build 081 to be installed.

In a rare scenario, when user clicks on Mail Transfer Agent (MTA) options in the Security gateway settings or on 'Next hop' column inside MTA settings, SmartConsole shows "Not Responding" and freezes. Refer to sk161232

• This fix requires R80.20 SmartConsole Build 081 to be installed.

SmartUpdate generates audit log even when no action was taken.

In some scenarios, fw monitor on Security gateway shows some packets that are handled by SecureXL and not FireWall-1.

In some scenarios, fw monitor fails to show IPv6 traffic in SecureXL.

In a rare scenario, Secure Network Distributor (SND) consumes high CPU when running fw monitor.

In some scenarios, incorrect chain number and name are displayed by "fw monitor -p all".

In some scenarios, a remote client disconnects after one hour although the session is not idle. Refer to sk160213.

Some Web sites cannot be opened when Content Awareness or Anti-Virus/Anti-Bot is enabled, and Security gateway is configured as proxy.

In some scenarios, VoIP traffic is dropped with "allocate_port_impl: could not find a free port;" error in dmesg.

In a rare scenario, changing the xmit-hash-policy of the bonding group while machine handling traffic, causes it to crash. Refer to sk154573.

In some scenarios, packets with TTL1 are dropped when using security zones in the Access rulebase.

In some scenarios, IPS update fails as a result of error in management server installation.

Improved TLS implementation for TLS Inspection and Categorization - Server Name Indications (SNI).

TLS 1.2 support for additional cipher suites:

• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• X25519 Elliptic Curve
• P-521 Elliptic Curve
• Full ECDSA support

In addition, improved the fail open/close mechanism and logging for validations.

For the complete list of supported cipher suites, see sk104562.

Deleting a Threat Prevention profile may fail if the IPS profile has many overrides. Refer to sk136552.

Added support for Cluster Load Sharing without IPSec VPN. To enable the support, refer to sk162637.

In some scenarios, when changing cluster topology and installing the policy, the cluster fails over. Refer to sk156335.

In some scenarios, the xmit-hash-policy of a Bond interface with the vlan causes the cluster member to go down. Refer to sk151412.

In some scenarios, Policy Based Routing (PBR) does not work properly when acceleration is enabled.

In some scenarios, packets with IP options are not forwarded across bridge interfaces. Refer to Issue #3 in sk154892.

In a rare scenario, the Standby member of ClusterXL incorrectly calculates the routing protocol priorities, causing the routes to be synchronized in the wrong way.

Enhancement: Improved the memory handling mechanism in Routed.

Enhancement: The maximum size of the arp table was increased to 4096.

On Smart-1 525/5050/5150, user cannot open the iDRAC without installing a dedicated Hotfix.

Changing the xmit-hash-policy of the bond may cause all static arp entries to disappear from the arp -a output. Refer to sk152892.

In some scenarios, the Phase-2 negotiation fails with "Reason: Wrong value for: Encapsulation Mode" after upgrade. Refer to sk157092.

Remote Access client randomly disconnect / unable to connect when DHCP multi-homed server is configured.

Running fw monitor with -v flag on a VSX gateway may cause the fw monitor to quit with the "Segmentation fault" error. Refer to sk162402.

In a rare scenario, machine crashes when using VSX with Virtual Switch (VSW).

In some scenarios, running the "fw vsx resctrl monitor disable" command or disabling VSX Resource Monitor via CPView causes crash of the VSX Gateway. Refer to sk144432.