Take 210 - Ongoing

NEW: Significant performance improvement for policy installation time when many groups are defined on the Management Server.

NEW: Added ability for R80.30 Security Management or Multi-Domain Server to manage 7000 and 28000 Check Point appliances.

• Requires R80.30 SmartConsole Build 86 (or higher).

"Policy installation had failed due to an internal error. If the problem persists please contact Check Point support" message may be displayed on policy installation failure. Refer to sk149093.

When the user runs the 'add-domain' Web API command on an existing Domain, the original Domain is deleted.

In a rare scenario, export from the previous version does not complete because the Postgres dump_all process gets stuck.

The FWM process of domains may not stop after the user runs mdsstop or mdsstop_customer.

In rare scenarios, certain domain level objects may not be visible in SmartConsole at the MDS level.

Unable to delete Snort protections in Multi-Domain environment - they still exist after deletion.

When running Management API commands, the default values for 'dereference-group-members' and 'show-membership' flags may change from "True" to "False".

Packets to the broadcast IP address (255.255.255.255) may cause dmesg to fill with "fg_classify_and_offload_all_ifdirs: fglogRulename Failed." messages.

NEW: Added DNS Passive Learning feature for enhanced non-FQDN domain objects & updatable objects matching. Refer to sk161612.

In a rare scenario, Security gateway may crash when activating a web parsing debug.

In a rare scenario, Security gateway may crash while connection is closed while being held.

DCE-RPC traffic may be dropped because of a drop template that is incorrectly created for the ALL_DCE_RPC service.

When ISP Redundancy is configured on a cluster, the backup ISP link status may show as down even though the link is up.

In some scenarios, a standby cluster member may crash when it starts handling the IPv6 traffic. Refer to sk166655.

• Fix is relevant for Gaia 3.10 only.

In some scenarios, there may be connectivity problems with DHCP traffic.

In a rare scenario, Security Gateway may crash due to NULL pointer reference.

In some scenarios, Threat Prevention policy installation may fail when the Threat Prevention profile performance impact is configured to "Very Low".

After an upgrade, policy installation may not update the IPS version on the gateway if the "IPS scheduled update" option was changed before the upgrade.

In some scenarios, SmartConsole shows "No license" and "Contract is expired" for IPS blade in VSX. Refer to sk164917.

NEW: Added Terminal Server agent v2 (aka MUH2) support for R80.30 Security Gateway. For more information, see sk134312.

In a rare scenario, there is a memory leak in the IDA daemon pepd.

In a rare scenario, identity session groups and access roles may disappear following a policy installation.

In some scenarios, dmesg shows many "cmik_loader_fw_context_match_cb: match_cb for CMI APP 11 failed on context 249" messages.

In some scenarios, when the minimum version of HTTPS Inspection is set to TLS 1.1, some websites may unexpectedly exit. Refer to sk165555.

NEW: Reading and sending files from the registry by DLP was optimized.

In some scenarios, DLP prints wrong error message in the log.

In some scenarios for SMTP, when an internal user sends an email, the DLP logs may show the topology as "external to external" instead of as "internal to internal".

DLP stability for some scenarios was improved.

Logging view may show results from the wrong day if the server Time Zone is configured to use half/quarter hour deviations from standard time.

In some scenarios, it may not be possible to filter logs by the field "IKE IDs:" when searching the log files directly.

"Problem has occurred during search < External Log server > Disconnected" error may appear in "Logs & Monitor" tab after creating dummy object for NAT.

After synchronization, MLM / Secondary MDM may have different log policy configuration. Refer to sk165692.

In a rare scenario, the CPD process on a Security Management Server that manages R77.30 Security Gateway may unexpectedly exit.

NEW: Added acceleration support for Ethernet Over IP Tunneling (EOIP). EOIP is RFC 3378 protocol # 97 used between Wireless AP and Wireless Cisco controller.

Policy installation may fail with "Error code 0-2000240" when Drop templates option is enabled. Refer to sk165716.

In some scenarios, held packets are incorrectly reported to the penalty box.

In some scenarios, SecureXL drops the TCP traffic for the particular connection for invalid state reasons. This fix enables the new property per specific gateway. Refer to sk147093.

In some scenarios, DOS/Rate Limiting drops too few (or too many) packets for "concurrent-conns" fw samp rules. Refer to sk112454.

Improved TCP state inspection for "Smart Connection Reuse" feature.

SCTP Stateful inspection and payload NAT (INIT Chunks) may not work correctly.

SNMP Response for OID .1.3.6.1.4.1.2620.1.5.6 ("haState") is "Active" on all members of ClusterXL High Availability mode. Refer to sk106291.

• Logical servers will have global table for lookups to prevent the race condition where two instances has different decisions because local sync is flushed every 0.1 sec.
• Added 'fw balance' command for visibility.

NEW: Improved policy installation performance when the MAB blade is enabled with Legacy Policy and Native Application rules. Refer to sk175105.

Added Stability improvement for Remote Access VPN.

In some scenarios, a connectivity issue appears when working with Capsule Connect.

• Fix is relevant for Gaia 3.10 only.

Server-to-Server and Client-to-Server VPN may fail when using Wire Mode while SecureXL is enabled.

In some scenarios, VPN traffic distribution change may cause high CPU consumption on one CPU core. Refer to sk165853.

• Fix is relevant for Gaia 3.10 only.

Improved IKEv2 negotiation flow.

In a rare scenario, vpnd process unexpectedly exits due to issue in IKEv2 flow.

In a rare scenario, a memory leak in VPND may occur during the TLS key exchange in HTTPS portals.

Added connectivity improvement for VPN over NAT traversal (UDP 4500). Refer to sk155953.

In some scenarios, the vpnd process unexpectedly exits on cluster members.

Although only OSPFv2 with Graceful Restart Helper is configured, the Critical Device OSPF3 Graceful Restart may show the "OSPF3 Graceful Restart PROBLEM Master -> Standby. Waiting for GR" message during the cluster failover.

In some scenarios, routed unexpectedly exits and traffic is lost after a failover in ClusterXL when BGP and ECMP are enabled. Refer to sk166175.

In some scenarios, H323 connections are dropped after "Virtual session timeout" is configured. Refer to sk156372.

In some scenarios, MGCP traffic may be dropped by the Security Gateway with the following message in fw ctl zdebug drop:

fw_mgcp_undo_earlynat: the needed early_nat request entry (with natted src) not found, dropping;

fw_conn_post_inspect Reason: Handler 'mgcp_manager' drop;

In a rare scenario, portals are not reachable after the fwk process unexpectedly exits.

NEW: Added the ability to configure an IPv6 address for a LOM interface on Smart 1-525/5050/5150 appliances.

Apache API was updated.

Smart-1 625 appliances may show RAID syncing on both RAID disks.

In some scenarios, latency issues may occur in Clish and in the WebUI when using web scanning tools (Qualys). Refer to sk164153.

'#', '=' and '+' characters cannot be used in "Banner" and "Message of the day" features.

SNMP Trap may not be sent even though a failover occurred. Refer to sk166100.

In some scenarios, transmit queues may stop, causing packet loss.

In SmartEndpoint, Anti-Malware's "Top Infections" report has an empty infection name. Refer to sk166232.

Endpoint Management may incorrectly show that no local Anti-Malware signatures updater is installed on the DHS-complaint engine.

NEW: Added support for Google Cloud Platform projects with Shared VPC. Refer to sk164139.

When an Azure Virtual Network Interface is missing its properties' primary attribute, the Microsoft Azure Data Center may fail to poll data, resulting in a loss of updates to the Security Gateway.