Take 221 - Ongoing

NEW: The $MDS_FWDIR/scripts/cpm_status.sh script will show if the CPM process fails to start.

Upgrade from R80.10 may take many hours when there are hundreds or more Administrators and dozens or more Permission Profiles defined.

In rare scenarios, a Management server may become inaccessible and requires a reboot. Refer to sk170634.

NEW:

• Global object deletion will be blocked if used in Domains on the Multi Domain Server.
• The "Unused Objects" filter in the Global Domain will show objects only if not used by all of the Domains on the Multi-Domain Server.

On MDS environment with Global VPN Community usage, policy installation mail fail with "internal error" message after upgrade. Refer to sk169157.

In rare scenarios, the FWM process may unexpectedly exit and fail the Multi-Domain Management server upgrade.

In some scenarios, Domain appears in the System Domain without any Domain Servers.

In some scenarios, a Global Administrator connected to the Logging and Monitoring view in MDS cannot see auto-complete suggestions when typing in the logs search box. Refer to sk166752.

In some scenarios, Management API commands with "details-level":"full" Payload return a truncated output and fail to complete. Refer to sk170414.

When creating SecuRemote DNS object with more than 6 characters as Domain suffix, it fails with the "Domain suffix contains illegal characters" error.

In some scenarios, certain Gateways do not appear in the IPS Core protections list. Refer to sk168474.

Update corporate Gateway procedure takes a long time and may cause login issues and general slowness in the Provisioning GUI.

In SmartView's GDPR Report, some of the text appears in German although the selected language is not German.

UPDATE: Added ability to filter Threat Prevention and Endpoint logs by file size on a Log server machine via Logs & Monitor view in SmartConsole.

Leef format is not certified with IBM causing the following issues:

• Wrong header and wrong value in "cat" field.
• Duplicate product values in "cat" field
• Exported logs contain fields with the same name.

Refer to sk170199.

In some scenarios, policy installation fails with "Error code 0-2000121".

Proxy arp change is applied only after the second policy installation.

In rare scenarios, a memory leak may appear on Security Gateway in gconn table.

ICAP block page displays virus name as "Unknown" instead of the virus name as it appears in the logs.

In some scenarios, a timeout occurs when the user enables resource separation via Clish. Refer to sk170372.

• Fix is relevant for Gaia 3.10 only.

Security Gateway running in USFW mode (User-Mode Firewall) may crash with fwk core dump. Refer to sk169119.

In some scenarios, user cannot authenticate to Captive Portal as a Guest User.

In some scenarios, deprecated applications are not removed/replaced during an upgrade from R77.30 to R80.x. Refer to sk131372.

Watermark insertion may fail in spreadsheet files where the column range is not defined.

Support bypass SMBv3 multi-channel when SMB feature is enabled for Anti-Virus or Threat Extraction (see sk101606).

In some scenarios, UserCheck agent notifications may be blocked.

Browser based applications cannot be opened in MAB portal.

In a rare scenario, the Security Gateway may crash when deleting certain non-TCP connections.

In a rare scenario, Security gateway may crash when receiving packets from an MDPS management interface.

In some scenarios, CPView may show incorrect statistics for VPN encrypted/decrypted packets.

In some scenarios, the routed daemon may unexpectedly exit with BGP.

NEW: Performance improvement of VPN tunnel when using SHA-384. Refer to sk168336.

• Fix is relevant for Gaia 3.10 only.

Improved usability of VPN tunnel monitoring "vpn tu" command.

• Fix is relevant for Gaia 3.10 only.

In rare scenarios, the Security Gateway may crash after VPN users connect to the network.

When a Gateway does not recognize the SPI, it sometimes sends the "Invalid SPI" notification in clear. As a result, the peer may ignore it, resulting in an outage.

The VPND process may unexpectedly exit when the user runs the "vpn tu" command.

Added VPN IKEv2 improvements.

The VPND process may unexpectedly exit during IKEv2 negotiation.

Latency and/or packet loss may occur for traffic which passes through a Virtual Switch in a VSX Gateway. Refer to sk168592.

UPDATE: CPView Network -> Top-Protocols and Network -> Top-Connections tabs were added back. Refer to sk167903.

• Fix is relevant for Gaia 3.10 only.

A Timestamp in Unix/Epoch time may not be updated when the user changes a password using hash.

The confd process may unexpectedly exit when the user runs the "show/set/add interface" long command. Refer to sk167635.

In the Management Data Plane Separation (MDPS) environment, the output for the "show asset network" command may not report some line cards if they have mixed management/data plane interfaces.

• Fix is relevant for Gaia 3.10 only.

In some scenarios, when the user tries to return to the factory default, the machine reverts to a different snapshot.

Creating LOM users for Smart-1 525/625/5050/5150 appliances may fail if the username length is shorter then 4 characters.

In some scenarios, when the RADIUS user enables bash logging (as per sk99134) and moves to expert mode, the username in the log files appears as admin instead of RADIUS.

NEW: Added new AWS regions af-south-1, ap-northeast-3, and eu-south-1.