Take 76 - Ongoing

Added GUI support for Check Point 26000 and 16000 appliances. Refer to sk162832.

Added a pre-upgrade verification that Global network objects with NAT configuration are not supported.

Added ability to automatically determine the API process memory allocation to avoid "Out of memory" errors. Refer to sk119553.

After deleting a network object that is part of a network group, the audit log of the group modification does not show who is the removed member. Refer to sk164057.

Added a mechanism to prevent the Management Server from starting if an import process was interrupted.

Due to a failed full sync, FWM was restarted unexpectedly and obsolete domain sessions were used in the global policy assignment.

In some scenarios, size of the shadow_object.C file increases after each policy installation, eventually causing a failure in installing a policy.

In some scenarios, traffic is dropped with "network_classifier_get_dynobjs_for_ip: failed to get UUIDs for IP 0.0.0.0" and "kfunc_ip_ranges_to_dynobj: network_classifier_get_dynobjs_for_ip failed" errors in dmesg when dynamic object is used in access policy.

In some rare scenarios CPM server does not start after a failure in delete domain.

Cannot export a .pdf file from the License inventory view after Jumbo HotFix installation on the Management server.

New policy creation may fail when there are no installation targets defined in this policy.

In some scenarios, a validation incident about Invalid Email Address is presented in SmartConsole after upgrade from R77.

In some scenarios, Multi-Domain Server upgrade from R80 fails due to an internal error related to deprecated application objects. Refer to sk157752.

In some scenarios, some of the Best Practices show "N\A" status in the Compliance Blade dashboard.

In a rare scenario, a specific log fails to be written and an alert informing on this is displayed in SmartConsole.

In a rare scenario, SmartConsole does not show indexed logs because the LOG_INDEXER process stopped working. Refer to sk152934.

In some scenarios, when exporting logs with "Visible columns" option selected from SmartView, some columns return empty record. Refer to sk161712.

In some scenarios, Administrator does not see that a revision was created in its Domain (on Domain level) after a Global policy was assigned to it.

Objects on Domain level that should be shown on the Multi-Domain Server level, sometimes are not shown correctly.

In some scenarios, logs are not saved under $MDS_FWDIR/log/failed_tasks directory.

Deletion of Domain failed with "Could not send message" error when having large amount of gateways in the Domain. The Domain remain without Domain Servers.

In some scenarios, gateways are missing in the 'Gateways and Servers' view in SmartConsole on the MDS level.

In a specific scenario, Global policy rules may change order after Multi-Domain Server upgrade. Refer to sk155432.

In setups with a large quantity of network object, users may experience slowness when editing the HTTPS Inspection policy.
Refer to sk147134.

• To fully resolve the issue, R80.30 SmartConsole Build 20 (or higher) should be installed.

In some scenarios, upgrade fails with "com.checkpoint.management.classes.dle.triggers.internal.VersionInfo.VersionInfo" exception in cpm.elg file.

Pre-shared keys are missing after upgrade.

Management API command "put file" can be used for command execution with certain permissions.

In some scenarios, Client certificate is removed when deleting Domain that is included in certificate's permissions.

In VPN Community managed by SmartProvisioining:

• When adding SMB gateway to the VPN community, VPN tunnel may not been established.
• When changing security profile in VPN community, the VPN settings are not changed.
• Policy installation fails for cluster member of CO Gateway.

SmartUpdate generates audit log even when no action was taken.

In some scenarios, a remote client disconnects after one hour although the session is not idle. Refer to sk160213.

In a rare scenario, Security gateway crashes during QoS policy installation.

In a rare scenario, Security gateway may crash due to NULL pointer reference.

• Fix is relevant for Gaia 3.10 only.

Improved scalability and resiliency of URL Filtering service.

• Fix is relevant for Gaia 3.10 only.

CMA migration may take a long time when there are many IPS protections local overrides.

Management Server upgrade may fail in these scenarios:

• There are Threat Emulation settings, which remained from Security Gateway objects that were already removed.
• There are Threat Emulation settings, which are configured in the cluster member objects and not in the cluster object.

Refer to sk150793.

Upgrade fails due to invalid Threat Emulation settings connected to gateways that no longer exist or to cluster members.

• Fix will affect only Advanced upgrade

Security hardening for Identity Awareness Agent (IDA) enforcement according to XFF IP.

In a rare scenario, identities are missing from all connected Identity Gateways (PEPs).

Users are not propagated from the PDP to the PEP on a specific network due to a rare race condition between register and unregister requests triggered by different instances or cluster members.

Users are not authenticated when an identity source provides the login name in an 'User Principal Name' format "user@domain". Refer to sk147417.

In some scenarios, unable to connect to the Standby Cluster member from a non-local subnet via SSH or WebUI. Refer to sk147493.

In a rare scenario, Custom affinity configuration is overwritten when HT is enabled. Refer to sk158112.

"fwmutlik_do_sequence_accounting_on_entry: bad dir" errors are mistakenly printed in dmesg output. Refer to sk158312.

In some scenarios, latency is observed on the Security gateway. Refer to sk162914.

In some scenarios, SecureXL drops the TCP traffic for the particular connection for invalid state reasons. Refer to sk147093.

In some scenarios, Policy Based Routing (PBR) does not work properly when acceleration is enabled.

In some scenarios, multicast traffic is not forwarded across bridge interfaces.

In a rare scenario, a VSX gateway may crash. Refer to sk160912.

The restore backup operation fails if the machine was installed via ISO during the backup, and via CPUSE during the restore.

In some scenarios, the IGB driver interfaces are occasionally down after reboot of a Management machine. Refer to sk135532.

Added support for LOM (iDRAC) interfaces.

When running "service vmtoolsd restart" command on Gaia installation with VMware, the "Installing memory driver: FATAL: Module vmmemctl not found. [FAILED]" error is displayed although the vmw_balloon.ko driver is loaded.
Note: this issue is only cosmetic.

In some scenarios, legitimate subnets of 0.0.0.0 (for example 0.0.0.0/1) cannot be configured for certain routing features, like static routes, PBR, routemaps, etc.

In some scenarios, the fwk process may crash when VSX gateway is upgraded to R80.30.

Improved the VPN connectivity for VSX and User-Space Firewall gateways.

In some scenarios with acceleration enabled, traffic through VR for a VPN setup does not pass.