Take 232 - Ongoing

NEW: Improved FWM process performance during Security policy or database installation.

UPDATE: When purging revisions, task notifications will also be purged if created before the last revision to purge was published.

Management Server upgrade from R80.20 to R80.40 may fail if a Network Interface object refers to a Gateway object that does not exist.

In rare scenarios, logout from a session fails with "An internal error has occurred" message.

Although the Access Settings of the Management API is set to "All IP addresses", the API server does not accept requests from any IP address unless the IP is defined explicitly as a Trusted Client.

In rare scenarios, the CPM Solr process may not be stopped when running cpstop or mdsstop.

In rare scenarios, the initiation of the Management server may take a long time.

In some scenarios, deleting a Domain Server may fail with "Got at least one duplicate UID in requested list" error.

When migrating a Domain Management Server to a Security Management Server:

• SmartEvent Blade cannot be activated on the migrated domain.
• If the Domain had standby Domain Servers, it may cause inconsistencies in the database, that may result in different failures. For example, policy installation may fail.

In some scenarios, updating a Domain Server may fail with the "<IP> already in use" message. Refer to sk171916.

After importing two (or more) Security Management servers into a Multi-Domain Server, the Gateway objects may not be functional:

• The editor may not show configuration correctly
• Security Gateway update may fail.

When running many Reassign Global Domain operations for Domains that are not active on the current Multi-Domain Server, the load on the Server may increase and result in slowness of user and automation work.

Slowness may be observed in some SmartProvisioning operations (like open SmartProvisioning GUI, create a new LSM object, open an LSM object editor, etc.).

In some scenarios, the "show gateways-and-servers" Management API command fails when running it with details-level full and when connected to the Global Domain. Refer to sk170895.

In some scenarios, the "add-user" API command with authentication method TACACS+ or Radius server fails with "object not found" message. Refer to sk170325.

In rare scenarios, a log may display incorrect values in the Action and Rule field. Refer to sk170676.

FWM and\or log_indexer processes may repeatedly stop when there are more than ~500K network objects declared. Refer to sk164452.

In rare scenarios, the FWD process on the Security gateway may be blocked for several seconds due to processing of log attachments.

In some scenarios, an incorrect Compliance status for Gaia OS Best Practices is displayed.

Authentication may fail when LDAP branch name contains "\".

In some scenarios, a Security policy installation fails during high CPU utilization.

After upgrading to R80.20, it is not possible to configure an OSPF interface to have a priority of 0.

In rare scenarios, high memory consumption in CPD may occur due to a memory leak in authentication flow with an LDAP server.

In some scenarios, a memory leak may appear after sending a packet from the kernel.

In some scenarios, "email_unified_cmi_get_attribs: not valid caller: up_log_get_user_hash" error appears in dmesg for SMTP traffic.

Improved the policy enforcement of the ZIP archive inner files

Traffic may be dropped when the Hide NAT is configured on IPv6 host.

• Fix is relevant for Gaia 3.10 only.

In a rare scenario, the Security Gateway may crash when the Threat Prevention Forensics feature is enabled.

In a rare scenario, Security Gateway may crash when CPcode is running within Content Awareness or parser flow.

In some scenarios, running pdpd commands results in "daemon did not respond or not running!" error. Refer to sk171136.

In Identity Awareness Captive portal, the default Check Point logo is displayed even if the user-defined logo is configured. Refer to sk133492.

• Fix is relevant for Gaia 3.10 only.

UPDATE: Added support for multi-part data to DLP.

In rare scenarios, a memory leak may occur during policy installation.

UPDATE: Added the option to display only monitored interfaces to "show cluster members <option>" command:

• In Gaia Clish, run "show cluster members monitored"
• In Expert mode, run "cphaprob -m tablestat"

"set router active-active-mode" settings do not survive a reboot.

• Fix is relevant for Gaia 3.10 only.

In some scenarios, connections are dropped when SYN Defender and ISN Defender are both enabled on the same interface.

In some scenarios, PPTP or GRE traffic may be dropped. Refer to sk170293.

NEW: The ARP cache size limit on Clish was increased to 131072 hosts.

• Fix is relevant for Gaia 3.10 only.

UPDATE: Added the option to bind IP addresses to sockets using the "udp_connect" API. Refer to sk171019.

UPDATE: Added support for multiple commands definition in Dynamic CLI feature.

• Fix is relevant for Gaia 3.10 only.

Sensitive Information Disclosure may appear in the output of "show file *" CLI command.

• Fix is relevant for Gaia 3.10 only.

In some scenarios, the "rhost" value may be missing from logs when the user tries to access the WebUI.

Several features are duplicated (both in WebUI and Clish) in RBA roles configuration/settings.

• This is a cosmetic issue. Fix is relevant for Gaia 3.10 only.

Read-Only users may run Dynamic CLI command with UUID other than 0.

• Fix is relevant for Gaia 3.10 only.

ip-reachability-detection ping marks a target IP address as "unreachable" if the path goes via a VPN tunnel, although pinging this IP address directly works.

In some scenarios, L2TP clients disconnect from the Security Gateway after 10 minutes of the connection.

In IKEv2 renegotiation scenario, IPSec SAs may be deleted on a standby cluster member during post sync causing a VPN traffic outage.

Added VPN Remote Access stability improvement.

When IKEv2 and pre-shared-key is configured, VPN may fail on the second IKE SA re-key. Refer to sk171756.

• Fix is relevant for Gaia 3.10 only.

When clicking "View..." in Trusted CA object's OPSEC PKI tab, this may show the "Failed to get a certificate of <object name> from keyset" error. Refer to sk166496.

The vpnd daemon may unexpectedly exit during policy installation when the Mobile Access Blade is used.

Access roles do not recognize Remote Access SNX CLI clients.

The VPND process on a standby cluster member may unexpectedly exit when VPN peer has a probing link selection configured. Refer to sk170136.

In rare scenarios, some interfaces remain in "Down" state after reboot.

• Fix is relevant for Gaia 3.10 only.

In some scenarios, there may be high CPU utilization in a VSX environment with several instances.

There may be a delay when connecting to HTTPS based SMS portal over a non-standard proxy port. Refer to sk170497.