Take 220 - General Availability

In rare scenarios, the Management Server may fail to start due to incorrect session handling.

When a Security Gateway is removed from a VPN community, it may still be seen under the permanent tunnel configuration. The issue is scoped to the Management side and does not impact the Gateway.

In rare scenarios, Global Domain Assignment may fail with the "class name not found for object" error message.

The FWM process on the Management Server may unexpectedly exit creating a core dump file.

Install Policy Verification may fail with the "Rule has security zone objects that are not attached to any interface used" error when configuring cluster's interfaces on only one member. Refer to sk177129.

In some scenarios, the Management API command "show-packages" with "details-level full" may fail with the "Could not commit JPA transaction" error.

UPDATE: SmartView reports will now show the new Check Point logo.

In some scenarios, Logs related to Content Awareness are missing.

Recurring "Unable to open '/dev/fw0': No such file or directory" may be printed in the fwd.elg file.

When running CPinfo in a large scale environment, the SmartEventCollectLogs process may get stuck..

When SmartConsole is connected to a Domain Management Server, in the Logs&Monitor view:

• When filtering logs with the query "service:", SmartConsole does not show a drop-down list with available services.

• When filtering logs with the query "origin: <Name of Security Gateway Object>", SmartConsole shows "No matches found for your search".

Refer to sk178904.

When running the "cp_log_export filter-Blade-in" command with the value "Endpoint" and restarting the LOG_EXPORTER process, LOG_EXPORTER may fail to start.

The log for the NAT second rule match shows an incorrect rule number.

Cluster failover may trigger the FWK process to exit, with no traffic impact.

UPDATE: In SmartConsole, added an alert to inform that the ICA certificate will be expired in less than one year. Refer sk158096.

The PEP process may unexpectedly exit

Improved detection in some IPS protections.

A memory leak related to TLS probe may occur in the WSTLSD process.

There may be connectivity issues for multicast traffic in PIM Sparse Mode.

In Virtual Device Status table, in vs0 context, the output shows the Active-Active status on two members instead of Active-Standby.

NEW: In some scenarios, the Security Gateway may not forward traffic to a client if its IP address is changed by DHCP. Added a global parameter "cphwd_refresh_nh", disabled by default. It determines whether or not the Security Gateway will invoke its own refresh ARP mechanism after a successful route lookup. Refer to sk175603.

SYN Defender may change MSS in an SYN packet to a larger value, potentially causing traffic drop.

Connectivity issues may occur after configuration of route based VPN (VTI interface). Refer to sk176368.

UPDATE: The "vsx_util reconfigure" operation is not supported on a VSX cluster member or VSX Gateway which has no virtual systems configured. The operation will now alert about the absence of virtual systems.

The "vsx_util reconfigure" command may fail without printing the cause of the error.

When deleting a physical interface that was added with a VLAN trunk to a VSX cluster or a VSX Gateway, it is not removed correctly from the management side and may still be seen if running the "vsx_util show_interfaces" command.

In some scenarios, the "vsx_util reconfigure" command cannot fetch the policy installed previously.

Latency and packet loss issues may occur when traffic goes through external VS connected to Virtual switch (VSW). Refer to sk177344.

In some scenarios, if VSX Gateway creation fails and rollback is done, the default route of the Security Gateway that was configured via clish is deleted without validation

The FWM process may unexpectedly exit after using the VSX Provisioning tool.

The FWK process of Virtual Switch (VSW) may consume a high CPU.

VSX Cluster Internal Communication Network IP address is shown in ifconfig after changing the name or VLAN of a VR physical interface.

In some scenarios, it is not possible to start a vsx_util upgrade/downgrade after a failed attempt.

UPDATE: It is now possible to use Gaia proxy addresses with more than 16 characters.

When adding and deleting a neighbor-entry ipv6-address, an error message is displayed, although the operation is successful.

In some scenarios, like defected LOM card, or when LOM port exists, but no LOM is connected, the CONFD process may stop working.

When running the "save configuration" command on a VSX device, other interfaces besides the Management interface are still presented. This is a cosmetic issue.

When static NAT is configured, VoIP calls may not work.

Added Take 21 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.