Take 195 - Ongoing

Upgrade from R80.20 to R80.30 may fail with messages related to cmsobfuscationkey.

NEW: Performance enhancements while the Management Server is under high load.

Security hardening: The Management Server will block connection requests with a TLS version below 1.2 on port 19009.

In some scenarios, when the user modifies a policy rule and creates a section above it in the same session, the log tracker shows that the rule was created instead of modified.

In some scenarios, Check Point services fail to start and the CPM log shows that there are duplicate session aggregators.

In a rare scenario, when viewing the Layer History, some revisions not relevant to the selected Layer may be shown.

Upgrade of Multi-Domain Server may fail when the source version is R80.10 and there is no license configured on the target machine.

The cpm_solr process may unexpectedly exit and cause one of the following:

• The upgrade of a Management machine may stuck on 58%
• The Management HA synchronization may fail with "NGM failed to import data" error
• Users may not be able to log in.

In some scenarios, SmartView Monitor unexpectedly terminates when the user selects the Specific QoS Rules option in Top QoS Rules.

In some scenarios, an unclear error appears when the user imports a global policy on a Multi-Domain Management Server. The error is caused by a mismatch between the leading interface defined on the machine and the one defined in the database.

The "Unused Objects" filter in Object Explorer may display a failure message if there are more than 20000 unused objects.

• A limit was added so that only the first 5000 objects will be displayed.

NEW: Performance improvement for Multi-Domain environments in which many administrators are connected.

In some scenarios, policy installation from the Domain Management Server fails after mds_backup procedure that was interrupted. Refer to sk165559.

In some scenarios, Full synchronization fails in the Global Domain with "Full sync with peer '[Peer Name]' NGM failed to import data" error. Refer to sk145972.

In a rare scenario, synchronization between Multi-Domain Management Servers breaks after revisions purge operation.

In some scenarios, secondary MDS or MLM fail to renew a management certificate. Refer to sk164732.

MLM may open a connection to the reversed IP address of the Multi-Domain Server.

NEW: Enhancement: Two new flags were added for the performance improvement of Threat Protection API commands: 'show-profiles' and 'show-ips-additional-properties'. The default value for both flags is false.

In some scenarios, when the user attempts to delete a Gateway / Cluster member, an error message may appear and the operation may not complete successfully.

In some scenarios, the Management Server may unexpectedly exit following authenticated API commands to create or update objects with extremely long comments.

In some scenarios, the api.elg log is flooded with the the "Returning default standard reply class" message.

When performing Backup and Restore, user may get a misleading message that these operations are supported only for Gaia.

Deletion of LSM Robo cluster may cause the FWM process to unexpectedly exit.

"The process <process-name> which is monitored by watchdog restarted more than once in the last half an hour" error may appear in the SmartEvent GUI status window even though the process has been up for more than 30 minutes.

In SmartView, when filtering a view using special characters in the search bar and exporting to Excel, the file may be generated empty.

In some scenarios, automatic reactions in SmartEvent are sent with the "Destination address" field containing the resolved country name instead of the raw IP value. Refer to sk146992.

In a rare scenario, after upgrading a Security Gateway to R80.30, the LOG_INDEXER process running on the Log server may consume 100% CPU and cause the indexing backlog.

In a rare scenario, fast accel configuration may be deleted after an upgrade from R80.20

Traffic may be dropped on DAIP gateway after the gateway IP address is changed or the gateway is rebooted. Refer to sk165176.

ICAP Client may not working properly when Threat Extraction blade is enabled.

• To enable the fix, set the enable_icap_with_strict_hold parameter to 1

In a rare scenario, a memory leak may appear when SSL inspection is enabled.

In some scenarios, wrong certificate is shown by HTTPS Inspection for some websites, including certificates issued by "CloudFlare Inc ECC CA-2". Refer to sk118392.

Policy installation process has been improved.

Improvements in HTTP chunked encoding inspection.

Link to the original file in Threat Extraction may not function properly (in cleaned files only).

Following changes in correlation unit settings, new logs may not be read by SmartEvent until the log_indexer process is restarted.

When restarting the FWD process on the Log server, the syslogd process (syslog daemon), may unexpectedly exit.

In some scenarios, when the user creates a table widget in SmartView, there is no option to add the "hostname" field. Refer to sk162752.

In SmartView, when the user exports logs to CSV using the "visible columns" option, the following fields may be missing from the CSV file: Resource, Application Risk, Application Name, and Application Category.

In SmartEvent, when the user customizes an event to accumulate logs by the field UUID, logs with UUID equal to 0 may not be correlated.

In a Multi-Domain environment, one or more CMA's SMARTLOG_SERVER processes may fail to start after upgrade. Refer to sk165262.

In some scenarios, asymmetric traffic is dropped on Security gateway with several Bridge interfaces. Refer to sk114976.

• This fix adds a feature to support certain types of asymmetric bridged configurations.

When PIM-SM multicast routing transitions from RPT to SPT, packets may be dropped or become out-of-order.

In some scenarios, a general traffic latency is observed on the Security Gateway. Refer to sk165652.

In a rare scenario, Security gateway may crash under heavy load.

In some scenarios, a corrupted BGP AS4_PATH attribute value may result in an invalid, long BGP update that is rejected by the BGP peer. Refer to sk167157.

Resource Monitor Control may cause segmentation fault when there are more than 64 CPUs. Refer to sk125112.

In the menu of 'vsx_util vsls' #1 (Display current VS Load sharing configuration), the table shows cut names of VSs (original names are longer).

Added L2TP Remote Access client connectivity improvements. Refer to Scenario 2 in sk145895.

• Fix is relevant for Gaia 2.6.18 only.

In some scenarios, VPN traffic distribution change may cause high CPU consumption on one CPU core. Refer to sk165853.

• Fix is relevant for Gaia 2.6.18 only.

In some scenarios, when NAT is enabled, Route Based VPN traffic may be dropped.

NEW: Added the /proc/sys/net/bridge/bpdu_forwarding flag to block BPDU packets per bridge setup on Gaia 3.10.

The log description of the "Media Encryption & Port Protection" blade may state that the "Media Storage" is encrypted even though it is not. The details in the log show the correct value. Refer to sk162812.