R80.40 Jumbo Hotfix Take 83

Upgrade from R80.10 to R80.40 may fail with messages related to cmsobfuscationkey. Refer to sk168933.

NEW: The "cma_migrate" command will continue working if the SSH connection with the Multi-Domain Server was lost.

If the user presses "Ctrl+C" while cma_migrate is running, the user will be asked whether to stop cma_migrate or to continue.

$MDS_FWDIR/scripts/solr_start.sh script may fail to start Solr Cure if sk123417 is applied.

The Purge Revisions operation may not clean deleted objects of previous revisions

In rare scenarios, Install Policy Presets are not triggered.

In some scenarios, exporting the Security Management Server in order to migrate it to Domain in Multi-Domain Environment fails.

NEW:

• Global object deletion will be blocked if used in Domains on the Multi Domain Server.
• The "Unused Objects" filter in the Global Domain will show objects only if not used by all of the Domains on the Multi-Domain Server.

When the user attempts to add/change the Leading Interface through mdsconfig, it may fail with the "no external interfaces found on this machine" error. Refer to sk168319.

After upgrading a Multi-Domain Management Server, the object version of the Domain Management Servers or Domain Log Servers in the MDS SmartConsole may not have changed.

Global Policy reassign in MDS may fail with "An internal error has occurred" message after adding overrides to Snort protections.

The "Get Interfaces" operation fails when admin creates a new cluster and decides to remove one of the members before he selects "Get Interfaces".

Setting or creating HTTPS layer (add-https-layer) with the "shared" parameter using the API may fail with the "Unrecognized parameter [shared]" error.

In some scenarios, Management API commands with "details-level":"full" Payload return a truncated output and fail to complete. Refer to sk170414.

Compliance Partial Scans in Multi-Domain environments using Global Policies may lead to SmartConsole freeze or long publish times. Refer to sk170562.

In SmartView, when the user sends a generated report via email in a language with non-standard English letters (Accented, Cyrillic, Chinese, Japanese, etc), some of the text may appear as question marks (?).

UPDATE: Added the latest fixes and security improvements to OpenSSL.

In some scenarios, Dynamic Balancing is unable to configure MQ setting for some interfaces.

In some scenarios, compilation errors during policy installation are ignored instead of immediately failing the policy. This may cause drops on the Security Gateway.

In a rare scenario, Security gateway may crash due to NULL pointer reference.

An interface name with more than 15 characters may cause the policy installation to fail. Refer to sk167955.

In some scenarios, when VPN Blade or ISP Redundancy are used, traffic may be routed to the wrong interface. Refer to sk168881.

After policy installation, the output of the "cphaprob stat" command may show "HA module not started" when a large number of non-monitored Cluster interfaces are configured in SmartConsole.

• This fix adds support for multiple non-monitored interfaces in SmartConsole.

In some scenarios, large number of interfaces defined on Security gateway may cause high CPU utilization by CPD process. Refer to sk168674.

Enabling both Dynamic Balancing and MDPS causes Dynamic Balancing to stop.

SXL drop due to routing configuration when using security zone on bridge (layer2).

In some scenarios, there may be sporadic connectivity issues in the Anti-Malware/URLF service (RAD).

In some scenarios, a CRL timeout may occur, which may cause slowness in HTTPS Inspection. Refer to sk169876.

In some scenarios, deprecated applications are not removed/replaced during an upgrade from R77.30 to R80.x. Refer to sk131372.

In rare scenarios, Security Gateway may crash due to memory allocation failure.

Mobile Access Secure Workspace feature does not work with SAML/IDP-based authentication when running Secure Workspace is optional.

Mobile Access portal may become unresponsive after Jumbo Hotfix uninstallation. Refer to sk169152.

In a rare scenario, Security gateway may crash when receiving packets from an MDPS management interface.

In some scenarios, SecureXL makes an offload decision to not accelerate multicast traffic for route-based VPN.

BGP fails to establish with high MTU setting on Gaia 3.10.

In some scenarios, the routed daemon may unexpectedly exit with BGP.

The "vpn tu tlist" command shows the wrong number of clients connected in Visitor mode.

In some scenarios, Remote Access VPN traffic may be dropped when XFF is enabled.

IP compression may not work in some scenarios when IKEv2 is configured.

Improved NAT Detection with 3rd party peers in IKEv1 and IKEv2. Refer to sk165003.

When IKEv2 is configured, traffic that originated from the DAIP external interface may fail to pass.

In rare scenarios, Remote Access clients may not be able to re-connect after a failover.

Reduced the logging of vague messages when the user adds a known host in Clish.

It is not allowed to create usernames with reserved words, such as 'eval', 'apply' etc., in the middle of the username in WebUI. Refer to sk170681.

Restore backup may fail due to unmatched upgrade tools.

In a rare scenario, the "Allowed-clients" feature does not work as expected for SSH.

In some scenarios, when the user tries to return to the factory default, the machine reverts to a different snapshot.

When enlarging the partition via lvm_manager from a small partition to a larger partition, the user may reach an internal filesystem settings limit. As a result, some filesystem monitoring commands unexpectedly exit. Refer to sk165258.

Setting LACP rate does not survive a reboot on Gaia 3.10.

"An unexpected error occurred" message may appear when the user clicks on 'View Current Status' in SmartEndpoint's 'Overview' tab. Refer to sk167176.

NEW: Added new AWS regions af-south-1, ap-northeast-3, and eu-south-1.

Scanning of GCP Data Center may fail when instance does not have disks.

Azure Data Center scan may fail and no updated are sent to the Security gateway.