R80.40 Jumbo Hotfix Take 158

UPDATE:

• Added the "--help" and "-h" flags to "mdsstop", "mdsstart" and "mdsstat".
• It is no longer possible to run the "mdsstop" and "mdsstart" commands with wrong parameters.

After the Management Server restart, the API command "show_tasks" may show some suppressed tasks as "in progress", if before the restart they were cleared in SmartConsole while they were still running.

In rare scenarios, a "Create Domain", "Delete Domain" or "Delete Domain Server" task can be stuck at 5% with the "Task in queue" status.

Deleting a network group may fail because it is being used, although "Where Used" shows no usage.

In rare scenarios, adding a service to a rule in Access Policy:

• may take a long time (more than several seconds)
• may cause SmartConsole to unexpectedly exit

Refer to sk176004.

In rare scenarios, the Management Server may fail to start.

When reassigning Global policy after an IPS update on the Global Domain, the updated IPS version in the Audit Logs view may appear with "-1" value instead of the actual IPS version number.

When searching for tags usage, the "where-used" Management API command may fail with "Requested object not found".

Global Domain Assignment fails with "An internal error has occurred" when there are more than 32K Threat Prevention Overrides in the local Domain. Refer to sk176464.

Policy installation on Gateways R81 and below may fail when there are multiple login options configured with SAML which uses Identity Provider as an authentication method. Refer to sk176725.

If there is a Global Domain Assignment, some results may be missing when searching in Packet Mode. Refer to sk178491.

Policy installation from the Multi-Domain Server level may trigger installation of two policies for the same VS.

The mds_backup script may not collect Multi-Domain Server log files from $MDSDIR/log/.

• Install Policy Preset may invoke policy installation on Gateways different from those that are defined.
• Policy installation on multiple Gateways on MDS level may trigger installation on one Gateway only.

Refer to sk178590.

UPDATE: Added CPInfo Build 914000227. Refer to sk92739.

SmartEvent may not show some of the Anti-Virus logs.

The "Last Update Time" field of a Session Log may show incorrect values.

When configuring an Email alert as an Automatic Reaction in SmartEvent, and the alert contains data from the event, some fields may be missing in the generated email.

In rare scenarios, the LOG_INDEXER process stops working and logs are missing. Refer to sk176403.

Access Policy installation may fail with "Error code 1-2000078".

Security Gateway may unexpectedly reboot and create a vmcore file.

The dlpu process may unexpectedly exit, producing a core dump file.

Access Policy installation may fail with "Error code 1-2000078".

In a rare scenario, the FWD process may unexpectedly exit.

Matched rules on Inline layermay appear as the "Accept'"/ "Drop" action instead of "Inline".

In some scenarios, memory consumption and CPU usage may increase consistently due to large amount of content in CPView tool. Refer to sk176370.

The log_exporter process may consume high CPU.

In a rare scenario, the DLP process leaves open unused file descriptors in the $FWDIR/tmp/dlp directory which may take up a large amount of disk space.

In some scenarios, persistent high CPU is caused by ADQuery due to a large number of authentication requests.

In some scenarios, websites encrypted with SSL are not matched correctly when categorization mode is on Holdand IDA is enabled. Refer to sk176283.

In a rare scenario, the DLP process may not delete temporary files used for scanning.

In rare scenarios, the WSTLSD daemon may unexpectedly restart.

UPDATE: SSL Network Extender was updated to version 800008304. It provides TLS 1.2 cipher suites support on macOS.

Policy installation may fail due to table creation issues.

A redundant message "ACC: Accelerator started. " is printed in dmesg logs.

Handling BGP routes with very long AS paths may cause connectivity issues and the ROUTED daemon may exit with a core dump file.

The routed daemon may unexpectedly exit with core dump when some interfaces lose connection with the PIM router.

The VPND process may unexpectedly exit with a core dump file.

Added VPN improvements for IKEv2 SA re-key.

Improved IKEv2 for working with DAIPs.

When applying Secure Configuration Verification (SCV) VPN client is not able to distinguish between Windows 10 and Windows 11.

In some scenarios, when VPN logs are enabled and DAIP (Dynamically Assigned IP) peer is configured, the VPND daemon may unexpectedly exit.

UPDATE: Shadow bridges will now be automatically disabled on VSX Gateways if the bridges are not in Active/Active mode.

After deleting a warp interface in SmartConsole, the active VSX cluster member may crash.

The "cpopenssl" command may fail with "No such file or directory".

NEW:

• Rule base search in SmartConsole now also matches rules with Data Center Objects.

• In SmartConsole, it is now possible to see IP addresses of all the objects included in:

  • AWS VPC and Availability Zone
  • Azure Virtual Network
  • GCP Network

• In SmartConsole, improved searching objects using tags.

When a Gateway's object name was changed, CloudGuard Central License Tool may fail to distribute licenses to the Gateway.

Added Update 6 of HealthCheck Point (HCP) Release. Refer to sk171436.