R80.40 Jumbo Hotfix Take 91

NEW: The upgrade process is being monitored dynamically and will be stopped if it cannot be completed, not basing on a timeout.

In some scenarios, HA synchronization may fill up the disk space of a standby Management Server. Refer to sk168492.

Management HA synchronization between Multi-Domain Management Servers may fail with "Failed to import data" error due to manual or automatic updates of contracts.

In rare scenarios, FWM process may unexpectedly exit after a login attempt to the Management server.

Domain Servers may disappear from Multi-Domain view after running the Solr Cure utility.

In some scenarios, HA temporary sub-directories under $FWDIR/tmp are not deleted if sync fails. Refer to sk170972.

In rare scenarios, the CPU and memory usage of CPM process may be abnormally high. Refer to sk170672.

• Exports of views and reports may fail when they are initiated while connected to SmartEvent with a new administrator.
• Assign and Install Global Policy feature may fail with the "Timeout during task progress: Could not get information regarding task completion" error message.

For more information, refer to sk170632.

When logging into SmartConsole directly to a Domain using RADIUS or TACACS, the Authentication method in the audit log may show as "Internal Password". Refer to sk168716.

Database installation to the newly created Domain Log Server may fail.

Migration of Domain Server between different Multi-Domain Servers may fail due to incorrect internal values of default objects.

In rare scenarios, a Domain is shown in the Domains view without any Domain Server or a Domain is shown with Domain Server that was deleted and does not exist anymore. Refer to sk170556.

NEW: Added support for Python 3 in Management API scripts.

In some scenarios, when using the "set simple-gateway" API command with "logs-settings.forward-logs-to-log-server", it fails with "Generic server error". Refer to sk170352.

In a rare scenario, when user clicks on Mail Transfer Agent (MTA) options in the Security gateway settings or on 'Next hop' column inside MTA settings, SmartConsole shows "Not Responding" and freezes. Refer to sk161232.

• Requires R80.40 SmartConsole Build 415 (or higher).

In some scenarios, running an action on a ROBO Gateway behind NAT does not work during sync on SMB appliances.

In some scenarios, after a successful IPS update, the new IPS version does not appear under 'switch version' window.

After enabling the Endpoint Policy Management Blade on the Security Management Server, some views on SmartConsole may not load properly and SmartClient may disconnect.

In some scenarios, Staging mode IPS protections activation in the Local domain does not match the activation in the Global domain after a Global Threat Prevention policy assignment. Refer to sk170322.

Enabling Threat Prevention policy may fail with validation errors when the policy's targets include cluster members running a version lower than R80.10.

Search in Threat Prevention Exceptions in Protection/Site/File/Blade column may not return all expected results.

Exception group may be incorrectly deleted in the following scenarios:

1. "Apply On" in exception group is changed from "Automatically attached to each rule with profile" to "Automatically attached to all rules".
2. A profile that was attached to the exception group, is deleted.
3. The group is removed from the exception groups list, however it remains in the Threat Prevention rulebase.

In some scenarios, when recreating a ROBO object with the same name, the new object receives the previous status.

UPDATE: Added ability to select 'Any' in the Service column when creating a custom firewall Best practice.

• Requires R80.40 SmartConsole Build 415 (or higher).

In rare scenarios, "Critical attacks allowed by policy widgets" in "General Overview" view may show no results while actual data exists. Refer to sk171001.

In rare scenarios, the log_indexer process may unexpectedly exit when reading a specific log format. Refer to sk116117.

UPDATE: Added a message informing that to enable Dynamic Balancing on models with less than 8 cores, GNAT must be enabled.

Connections distribution may get unbalanced on VSX environment. Refer to sk169352.

Half-closed accelerated TCP connections may take too long time to expire.

The SSH Deep Packet Inspection (SSH DPI) configuration may be lost after upgrade.

In some scenarios, policy installation fails with "Error code 0-2000077".

The TCP State Logging feature may not work as expected. Refer to sk101221.

After changing 'pdp nested_groups __set_state 2', flat groups are fetched correctly, but nested groups are not fetched. Refer to sk166199.

NEW: Added Identity Sharing performance and functionality improvements. Refer to sk170516.

NEW: Added ability to send connection log per application match for ATM transactions identification.

The functionality is disabled by default and can be enabled by using the "up_duplicate_connection_log_on_packet_matched_app_enabled" kernel parameter.

The get_ips_statistics.sh script on VSX may fail with "/bin/cat: /proc/self/vrf: No such file or directory" error.

Connectivity issue may appear for inbound HTTPS Inspection when HTTP/2 is proposed by the client. Refer to sk169375.

In a rare scenario, Security gateway may crash while processing SMB3 multi-channel when Anti-Virus Blade is enabled.

In rare scenarios, after downloading files, Anti-Virus prevent logs appear with "Strict hold is not possible failure - Write to other side occurred" error message.

In some scenarios, UserCheck agent notifications may be blocked.

In rare scenarios, the DynamicID Certificate validation may fail.

NEW: Added support for Cluster AA/LS.

NEW: Added support for 1570R and 1600 / 1800 SMB appliances.

"cphaprob -h" shows wrong explanation for "cphaprob show_bond [<bond_name>]" command.

Security Gateway may stop forwarding the Multicast stream when PIM is configured on it. Refer to sk169774.

SNMP queries for bgpPeerFsmEstablishedTime return an incorrect constant value. Refer to sk170074.

NEW: Added Remote Access VPN performance improvement for USFW mode (User-Space Firewall).

DynamicID via SMTP does no work when an HTTP proxy server is defined.

In some scenarios, userspace cores may appear on Security gateways with enabled AES-GCM-256 and AES-256 VPN encryption. Refer to sk169417.

An exception may be displayed in SmartEndpoint when uploading an offline group software deployment package. Refer to sk165852.