List of All Resolved Issues and New Features in R81.10 Jumbo Hotfix Accumulator

NEW: Added a new "show-statuses" boolean parameter to the "show lsm-gateway" and "show lsm-cluster" Management API commands. When set to "true", this parameter displays the Security Policy and Provisioning Settings statuses for the LSM Security Gateway or Cluster.

UPDATE: Resolved CVE-2024-3596 - Blast-RADIUS attacks. Refer to sk182516.

UPDATE: Policy installation duration with hundreds of layers is improved by approximately 30%.

UPDATE: Added ability to increase/decrease DNS cache table size.

UPDATE: Added the "trackSettings.forensics" parameter to the "threat-rule" Management API command to enable and disable the "forensics" option in the "Track" column. Syntax example: "mgmt_cli add threat-rule layer 'Standard Threat Prevention' position 1 track-settings.forensics false -r true".

UPDATE: It is now possible to add more than fourteen members per site in a Single Site topology.

UPDATE: Added Update 19 of HealthCheck Point (HCP) Release. Refer to sk171436.

Log queries fail with the error "Problems have occurred during search" when Domain migration is in progress. This occurs specifically during the execution of "export-management" or "import-management" Management API commands.

In rare scenarios, login to SmartView web application using the Domain IP address or Domain name fails.

In rare scenarios, revert to a Database Revision may get stuck on 60% and eventually fail.

SmartConsole may close during login because of repeated attempts to discard a non-existent work session.

If any single Data Center fails to register, the registration of all Data Center assets to the Security Management Server also fails.

In rare scenarios, the Revisions tab in SmartConsole shows "Error retrieving results".

In a Management High Availability environment, the Standby Security Management Server may not update the "Installation date" during policy installation on Security Gateways/Clusters.

In a Multi-Domain Security Management environment, there may be synchronization timeout errors, and automatic revisions purge may fail.

The "show logs" Management API command may show partial information for the fields with multiple values.

The FWD process may exit and cause issues with opening packet capture files on remote members.

RAD error messages may be printed to the fwk.elg file during cpstop - cpstart on the Security Gateway. The issue is cosmetic only.

Outages may occur when the FWD process exits or restarts and Security Group member goes down triggering Scalable Chassis failover.

A buffer overflow may occur in the HTTP flow, affecting the FWK process.

During policy installation, Rule Base internal error drops may be shown in the SmartConsole logs. Logs related to "dynobjs" may be printed in Messages.

SSH Deep Packet Inspection (SSH DPI) fails to start inspection if IPS is enabled while all other threat prevention products are disabled.

When using ICAP, filename handling occasionally fails. As a result, the Threat Emulation Blade may not be able to process this specific file.

The Anti-Bot Blade may generate error logs with the "Failed to Decrypt CP Site Response" reason. Refer to sk182494.

The "citrixStrictTicketEnforcement" parameter set in the configuration file may not work as expected.

In a rare scenario, a memory leak in the adp kernel module may occur during multicast routing assert failures.

When SecureXL User Mode (UPPAK) is enabled, in some scenarios, a VSX Security Gateway with many Virtual Systems may crash.

Dynamic Routing outage in a Security Group during the Zero Downtime (MVC) Upgrade to R81.20, during the Downgrade from R81.20, or during the installation / uninstall of the R81.20 Jumbo Hotfix Accumulator. Refer to sk182556.

A multicast outage may occur during failovers caused by interface flaps.

Remote Desktop Protocol (RDP) connections may frequently disconnect when network traffic is routed through a combination of medium path, Quality of Service (QoS) controls, and VPN.

The FWK process may crash when establishing multiple VPN tunnels simultaneously at peak rates.

The FWK process may exit when Monitor mode is enabled on one of the interfaces.

In Quantum Maestro/Scalable Chassis environments, when using the Threat Prevention Blade in the Security Group, the entitlement_status_collector_db.C files may be inconsistent between the Security Group Members.

Memory leak may occur in SecureXL templates. Refer to sk182648.

See the Important Notes section.

• In some scenarios, the FWM process may unexpectedly exit and generate a core dump every few days, when the Compliance Blade is enabled and the scheduled full scan is not configured according to sk182507.

• More core dumps may be generated after following the instructions in Section 1, refer to Section 2 in sk182507.

See the Important Notes section.

NEW: Added the ability to unset a persistent environment variable, using the "-u" flag for the override_server_setting.sh script introduced in sk165938. Upon execution, the specified property is now removed from the $MDS_FWDIR/conf/cpmEnvVars.conf file.

NEW: Threat Emulation Blade in Endpoint Security Clients version E87.60 and higher now supports the ONE, XAR, and WSF file formats.

UPDATE: A patch on top of OpenSSL 1.1.1w to fix CVE-2024-2511. Refer to sk182320.

UPDATE: Modified the content of the https://<ip_adress>/license_management/ page.

UPDATE: When deleting a Secondary Multi-Domain Security Management Server, SmartConsole now shows an "After MDS '<MDS name>' is deleted, you should delete the Secondary Domain Servers from the Domains and revoke their certificates" message.

UPDATE: Enhanced the Access Control log for "Accept" actions with initial matched layers of "IoT" or "Playblocks":

The "Layer Name" field now shows the admin-configured layer, alongside Rule Name and Rule Number, allowing administrators to view their preferred match layer rather than defaulting to the first matched layer or inline rule. This change improves visibility into the specific security policy components responsible for accepting traffic.

UPDATE: The performance of the thread blocker feature (sk180437) is now improved and the feature is re-enabled.

UPDATE: When URL Filtering operates in Background Mode and encounters an unclassified connection, instead of being approved automatically, such connection is now accepted or rejected based on Access Rule Base execution, and listed under the "unknown" category.

UPDATE: VPN connections are now synchronized to all members of the Security Group by default. The default value of the "vpn_sync_to_all" kernel parameter is set to "1".

UPDATE: Removed the ability to delete the "_lldp" internal user in Gaia OS to prevent traffic impact. Refer to sk182026.

UPDATE: Added Update 18 of HealthCheck Point (HCP) Release. Refer to sk171436.

UPDATE: Added Take 21 of Public Cloud CA Bundle. Refer to sk172188.

In rare scenarios, the Management Server upgrade fails during the import stage with "an eclipse error has occurred enable logging on EclipseLinkExceptionHandler to see full error".

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or via the Advanced Upgrade method.

In rare scenarios, an upgrade of a Multi-Domain Security Management Server fails with "Cancelled due to a failure in other domain" in the upgrade report.

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or via the Advanced Upgrade method.

Objects Explorer search fails with "Error retrieving results" when more than twenty thousand IP addresses match the search criteria.

The UPDATE_INSPECT_FILES process of Upgrade Tools may exit with a core dump.

The "domains_tool -report" command may fail if more than sixteen host objects are defined as DNS Servers in the environment.

In some scenarios, the "show-gateways-and-servers" Management API command fails with "generic_err_object_not_found" when running with "details-level full".

In rare scenarios, login to the Security Management Server may fail with timeout and the FWM process on the Management Server may unexpectedly exit, creating a core dump file.

In rare scenarios, the API status shows "Automatic Start: Disabled" even though the automatic start was not disabled manually.

In rare scenarios, publishing a session in SmartConsole fails with the "got at least one duplicate UID in requested list, duplicates UIDs: [XXX]" error.

The "set simple-cluster" Management API command with the "vpn-settings.vpn-domain" parameter succeeds, but the VPN Domain is not set.

Upgrade of the Multi-Domain Security Management Server may fail with the error "Folder object not found".

• The fix requires the upgrade to be done using a Blink image or the Advanced Upgrade method.

When a Domain name (for example, "XXX") is a subset of another Domain name (for example, "XXX-YYY"), the "mdsstop" command may fail to stop a Domain named "XXX-YYY".

In rare scenarios, empty log list may be displayed when selecting a log file to view in SmartConsole.

When adding a table widget to a SmartView report:

• The "Missed Malware Activity" and "Spyware Action" fields may not be possible to pick.

• The "Malware Action" filter may appear twice in the picker.

In some scenarios, in Multi-Domain Security Management environments with over 300,000 network objects, the LOG_INDEXER process repeatedly exits if the procedure from sk164452 is not applied.

In SmartView, filtering logs by "event_type" may fail with the "Query failed" error.

The traffic field in the SmartEvent "Application and URL Filtering" report, specifically in the "High Bandwidth Applications" section, is incorrectly displaying data in petabytes (PB) instead of the expected gigabytes (GB).

In some scenarios, websites that use HTTP2 protocol do not load properly.

In some scenarios, adding sequential IP addresses as MDPS task addresses may fail.

The CPWD daemon does not restart automatically.

Security Gateway running in SecureXL User Mode (UPPAK) may crash during driver removal showing "m_free: mbuf doublefree" in the backtrace.

Kernel Memory usage increases persistently each day on a Security Gateway/Security Group when CGNAT is enabled. Refer to sk182140.

The "asg monitor" command may show the Security Gateway in the "during upgrade" state although a major downgrade is complete.

CRL fetch may fail when passing through a Security Gateway with deep inspection, even if the connection hold is quickly released. CPCA closes the connection prematurely.

In rare scenarios, when the Anti-Virus, Threat Extraction and Threat Emulation Blades are enabled, some connections that were on hold are dropped.

In some scenarios, the PEPD process may consume a high CPU because of a high rate of identity propagation. Refer to sk182588.

Microsoft Azure Active Directory does not fetch users in the Access Role object and shows "The user directory is still initializing". Refer to sk175983.

The DLPU process may unexpectedly exit due to uninitialized memory when the Anti-Virus Blade scans files. Refer to sk182030.

The Anti-Virus Blade may enforce observables from IoC feeds although they were deactivated in SmartConsole.

Enabling the "cvpnd" debug causes the reverseproxy_ssl_debug.log file size to continue growing even after the "reverse proxy" debug is off.

In rare scenarios, in a cluster environment, the CPDiag tool may crash.

In some scenarios, traffic with Passive or Active Streaming configuration may not correctly pass through a Virtual Router on a VSX Security Gateway.

The duration of each "stop" and "start" API call for the LightSpeed Acceleration interfaces may take several seconds. Refer to sk182585.

In some scenarios, the VSX Security Gateway does not initialize the Virtual System correctly when connected to a Virtual Router or Virtual Switch.

Routing BFD sessions using IPv6 global addresses on single-hop interfaces fail to recover after the network interface is administratively disabled and re-enabled.

SNMP query for OID 1.3.6.1.4.1.2620.1.6.7.5.1.5 (CPU utilization per CPU core) and the "cpstat os -f cpu" command may return an incorrect value. Refer to sk182447.

SNMP queries show a different number of connected RA VPN users than what is shown in CPView and from CLI. RaUserState information is missing in the SNMP MIB file.

Configuring a Large Scale VPN (LSV) with IPv6 and establishing a VPN tunnel may cause the FWK process to exit.

Under a special routing configuration, an active Cluster member may accept portal traffic (on TCP ports 80 and 443) destined to a Standby member IP address.

In a VSX Cluster with IPv6 enabled, after an upgrade, VS's without IPv6 address may fail to install the Access policy.

When configuring backup-scheduled/snapshot recurrence via gClish shell with "The <name> job already exists. Please choose another name. Backup schedule failed. The backup will not be scheduled".

Site to Site VPN traffic may be interrupted after installing policy with VSLS.

When the Compliance Blade is enabled, the FWM process may unexpectedly exit and generate a core dump. Refer to sk182507.

See the Important Notes section.

NEW: Added ability to import PKCS#12 files using AES-256-CBC encryption with PBKDF2-HMAC-SHA-256. This enhancement is designed for use in multi-portal environments and HTTPS Inspection scenarios.

NEW: Added support for 3072 bits key size in IKE certificates. To use 3072 bits key size, refer to "HTTPS Portals (Multi-Portal) Certificate, VPN Certificate" section in sk96591.

UPDATE: Added SHA256 fingerprints to certificate objects to mitigate the risk of hash collisions and enhance trust when utilizing the fingerprint, encoded with English words, as a verification mechanism.

UPDATE: Added the "SecureXL" filter to the "cpview -m -f" command, which allows to extract to Skyline all the information related to SecureXL drops. Refer to the Skyline Metrics Repository.

UPDATE: If inspection logging is configured, the "Inspect" log now displays the negotiated ciphers and TLS version used for successful inspections, both between the client and the Security Gateway, and between the Security Gateway and the Server.

UPDATE: Added Multi-Queue support for Microsoft Azure Network Adapter (MANA) accelerated network interfaces.

UPDATE: New features and improvements are released in Take 100, Take 102, Take 104 and Take 111 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 34 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

UPDATE: Added Python 3.11.4.

Enabling automatic updates of Trusted CAs as described in sk173629 may fail.

When using the "set simple-gateway" Management API command to edit interfaces, the operation is only performed on fifty interfaces at a time.

Login to SmartConsole fails if the "Read_Write_All_Profile" permission profile is deleted.

Global Assignment fails with "Locked for editing by another administrator and need to be published or discarded before the operation can take place". Refer to sk181807.

There may be synchronization failure and, as a result, corrupted Domain policies on the Multi-Domain Security Server when a newly created local administrator on the backup Security Management Server makes changes to rules or objects, after the Active role is switched to that Security Management Server.

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit or not start, creating a core dump file.

In rare scenarios, after an upgrade or a Domain migration:

• Policy installation might fail with "ERROR: Duplicate keys xxxxxxxx in table 'gw_properties".

• DAIP Gateway objects will have duplicate IP addresses.

  Refer to sk181834.

Changes Report may allow to list certain directory contents.

In rare scenarios, policy installation on R77.30 Security Gateway fails with "Operation failed, install/uninstall has been improperly terminated". Refer to sk180448.

After a Multi-Domain Security Management upgrade to R81.10 version, some Infinity Portal Services may stop working.

In some scenarios, SmartConsole may close unexpectedly when clicking the "View Changes" option in the Install Policy view.

It may not be possible to add/set a Threat Prevention Exception with a protection-or-site UID.

The revisions purge process may get stuck due to an incomplete purge operation from a previous attempt.

In a Multi-Domain Security Management environment, the "show simple-gateway" and "show simple-cluster" Management API commands may fail with "Runtime error: An internal error has occurred"

In Multi-Domain Security Management environments, if there are more than three hundred forty Domains, login to SmartConsole fails.

The "show-lsm-gateways" Management API command returns LSM cluster objects besides the LSM Security Gateways.

In the "cpview -m" command output on the Security Gateway which is an Active Cluster member, "metrics system.network.nat.ports" and "system.network.nat.ports.limit" may not be displayed in the list of available metrics.

When Identity Awareness blade is enabled, the "Src User Dn" and "Dst User Dn" fields in ICMP Logs are not masked for users without "Identities" permissions. Refer to sk181677.

When the "IP Options drop" tracking Global Properties setting is configured to "Log" and the policy is installed, the Security Gateway drops traffic with disallowed IPv4 options or IPv6 extension headers, but no log is shown in SmartConsole.

In rare scenarios, the FWD process on the Security Gateway may reach out of memory and produce a core dump file of around 3GB.

A highly utilized Security Gateway may crash during policy installation.

Some debug messages may appear in the /var/log/messages file, although the debug mode is not activated. The issue is cosmetic only.

After deploying a new license to a Multi-Domain Log Module (MLM), all Customer Log Modules (CLMs) generate alert logs about missing license/contracts stating "No valid license was found".

In some scenarios, the VSX Security Gateway may not set the MAC header correctly when sending traffic back to Gaia OS directly out of an interface on a Virtual Router.

On the Security Management Server, a CPD zombie process may be created.

CIFS traffic may cause CPU spikes in the FWK process.

Installation of Threat Prevention Policy fails with the error "No profile defined on GW <Name of Security Gateway Object>" in this scenario:

• The "Install On" column of a Threat Prevention rule contains a Group object (Group #1).

• This Group object (Group #1) contains another Group object (Group #2).

• This nested Group object (Group #2) contains the Security Gateway object.

After an upgrade, the Security Identifier (SID) for LDAP Users or LDAP Groups that were configured prior to the upgrade may be empty. Refer to sk181946.

User/Security Gateway identities may be revoked unexpectedly if an additional update from the AD Query identity source is rejected due to Identity session conciliation.

Some URLs may be blocked by the Anti-Virus blade as malicious, even though the Threat Prevention Rule Base contains an exception rule with a Site/Application object that includes this URL.

SAML authentication may fail after installation of Jumbo Hotfix Accumulator R81.10 Take 113. Refer to sk182128.

See the Important Notes section.

In a rare scenario, after an upgrade, connections between networks may be dropped with the "First Packet isn't SYN" error.

In a cluster environment, the Security Gateway may become unresponsive on the Active member, and after a failover the issue occurs on the new Active member also.

In some scenarios, when SecureXL User Mode (UPPAK) is enabled, the Security Gateway crashes during boot up.

When the Security Gateway works in SecureXL User Mode (UPPAK), a SIGPIPE signal may cause the USIM process to exit, leading to a system reboot.

In some scenarios, when QoS blade is enabled and SecureXL works in User Mode (UPPAK), Security Gateway may crash with the "invalid data" error.

In some scenarios, the Security Gateway crashes during boot up when SecureXL works in User Mode (UPPAK).

In some scenarios when Route based probing is configured, the VSX Security Gateway sends out encrypted traffic with a source IP address of all zeroes through a Virtual Switch interface. This traffic may be dropped by routers, the VPN peer Gateway or other Security Gateways due to the invalid source IP address.

In scenarios where numerous BGP peers are configured with the "multihop" option enabled, combined with short "keepalive" settings and a large number of routes being received from each peer, the ROUTED process may experience high CPU utilization.

The ROUTED process may unexpectedly exit because of an OSPF assertion failure.

The MONITORD daemon causes high CPU after 388 days of uptime. Refer to sk181922.

Some valid interfaces may not be available with running the "set lldp interface" command.

Removing unused built-in user called "cp_ender" that may appear in Gaia OS after an upgrade. Refer to sk182185.

In a VPN Community with a configuration involving two Security Gateways (a Center Cluster and a Satellite Security Gateway) with IPv6 external and internal interfaces, when attempting to establish a Link Selection Star community between them, the VPN process may unexpectedly exit due to repetitive IKE core crashes on one of the Security Gateways while the other Security Gateway tries to establish a tunnel, resulting in connectivity issues.

In a rare scenario, in a Maestro environment the first packet of the VPN tunnel is lost or has a large delay.

IPv6 non-VPN traffic may be dropped with "Clear text packet should be encrypted".

In an on-premises environment, large Active Directory groups with more than 1500 members appear empty or have incomplete membership information.

An additional reboot may be performed on Maestro Security Gateway because of the database entry (otlp) which should not be pulled from SMO. This entry is updated locally on each member via self-update functionality and therefore may differ between members.

After a failover scenario, the "m site-id member-id" command requires reauthentication.

Redundant "MHO_stateAgent[3230]: QuidAddon: System not ready yet - attempting to re-init" messages in the /var/log/messages file.

In a rare scenario, when a Maestro Security Gateway is active again after a reboot, and LightSpeed is used, the LACP bond may drop incoming and outgoing packets.

UPDATE: Remote Access VPN for local accounts authenticated only with Check Point password created in R80.20 or lower, and not updated after the upgrade to R80.30, is blocked until the password is reset. Refer to sk182336.

Installing a Hotfix on top of R81.10 Jumbo Hotfix Accumulator may fail.

NEW: Added ability to R81.10 Security Management Server and Multi-Domain Management Server to manage Quantum Force 9800 / 9700 / 9400 / 9300 / 9200 / 9100 Appliances that run R81.20 Security Gateways. Refer to sk181698.

• Requires R81.10 SmartConsole Build 423 or higher.

NEW: Added ability to track RAM usage of the VPND process using the "cpstat" command in CLI. Refer to sk181815.

UPDATE: Added verification for policy deletion. If the policy is installed on the Security Gateway, the "delete-package" Management API command now fails with "Policy X is installed on 1 or more gateways.". Refer to sk181877.

UPDATE: Added an ability to configure objects for the HTTPS Inspection CA using labels.

• There are now handle-based and label-based configurations.

• Hardware Security Module in High Availability mode (HSM HA) now supports only the label-based configuration.

UPDATE: Fixed CVE-2023-51764 - Postfix SMTP Smuggling vulnerability. Refer to sk181944.

UPDATE: Added an option in ICAP Server for logging benign files scanned by the Anti-Virus Blade. By default, logging for benign files is disabled. To enable it, add the following entry to the ICAP Server configuration file: "LogBenign on".

UPDATE: Implemented monitoring functionality and alerts for tracking the expiration date of Identity Broker certificates.

UPDATE: When a Gaia OS Server has a Cloning Group feature enabled, it now accepts other Gaia OS Servers that join this Cloning Group over TLS1.2 or higher (over the TCP port 1129).

UPDATE: Added support for Data Centers in AWS ca-west-1 Calgary region.

UPDATE: New features and improvements are released in Take 97 through self-updatable package. Refer to sk170314.

UPDATE: Added Update 7 of Quantum Smart-1 Cloud. Refer to sk166056.

UPDATE: Added Take 31 and Take 33 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

The FWM process on the Management Server may unexpectedly exit, creating a core dump file.

The "show users" Management API command fails if a user is configured to be able to connect on specific days, but the days are not selected.

The "set-smart-task" API command fails when enabling the "Send mail to/from" option in SmartTasks.

Deleting a Domain may fail when using the createDomainRecovery.sh script.

If there are changes in the HTTPS Policy and Certificates in the session, a "Something went wrong" message appears when opening the Change Report.

High Availability synchronization runs after every scheduled Application Control update, even if the Application Control is up to date.

Login to SmartConsole may fail while the Compliance Blade is running a full scan.

When the value of the "asm_ips_cci" property is updated manually to a number higher than 500,000:

• login to the Security Management Server fails due to timeout

• the FWM process may consistently consume 100% CPU.

In some scenarios, Access Policy installation fails with "Policy load / verification failed because it required more than the maximum allowed memory of 4GB. Follow sk161874 to improve the performance and prevent excessive memory consumption".

SmartConsole may unexpectedly close after deleting an object in the Object Explorer view.

In a rare scenario, the FWK and CPD processes may exit with core dumps at approximately the same time.

The Change Report generated before publishing a session, may contain internal system changes that were made by the user.

In Multi-Domain Security Management environments with over two hundred administrators, Domain creation may fail with "Timeout expired while waiting for permissions calculation".

Login with Web SmartConsole to the Security Management Server may fail if using a trusted client with IPv6.

CPU statistics may be incorrect or missing in CPView. Refer to sk182286.

Offload may fail in CPView with "ERROR! Reason not initialized".

In SmartConsole, in the "Device License Information" view, the "New connection rate" field may indicate "please wait 10 seconds".

In SmartView, incorrect results may be displayed when filtering logs using the "src_machine_name" field.

Some Access Rule Base logs may be generated with a wrong interface direction. The issue is cosmetic only.

In rare cases, the LOG_EXPORTER process exits and the CPWD process does not start it because of the "exit_code 0" error.

In a rare scenario, a Security Gateway / Cluster Member may stop logging locally or to configured Log Servers. Refer to sk170331.

In rare scenarios, updating the NTP Server may cause a temporary outage.

Enabling MDPS fails with the "clish: symbol lookup error: /usr/lib/cli/lib/libcli_mdps.so: undefined symbol: cp_is_usim" error.

The CPVIEW_API_SERVICE process may exit with a timeout.

Incorrect static NAT destination is applied when the original destination in the NAT rule is the Security Gateway object, but the actual destination does not match the main IP address of the Security Gateway object.

In a rare scenario, because of a memory allocation issue, the Security Gateway may crash and reboot.

When using three or more ISP DNS proxies in High Availability mode and Load Sharing mode:

• A DNS query to any ISP returns IP addresses of all three, although it should return only the active ISP.

• When one ISP is down, the faulty ISP is also returned instead of the newly active.

The ICAP Server may fail to initialize.

When there is fragmented traffic, the /var/log/messages file may be flooded with the "dst_release" entries.

Security Gateway does not pass traffic through an external interface when it is managed by Smart-1 Cloud, and SecureXL works in User Mode (UPPAK) mode. Refer to sk182016.

Multiple "fw_fna_hold_prepare: creating table" entries may be printed in /var/log/messages. The issue is cosmetic only.

When URLF and APPI are disabled in VS0 in VSX setup, automatic updates fail on other Virtual Systems.

Security Gateway with a large number of CPU cores allocated to CoreXL SND may experience performance issues when an IoC Feed and the "fwaccel dos deny" feature are configured. See sk182223.

When a Multi-User Host is used with Identity Broker, the user session may expire on the PEP side, while still connected on the PDP, causing failure of user-based access.

In Multi-User Host setups, some accounts may be identified as service accounts, although they should not be flagged.

Anti-Spoofing drops packets that arrive at a Security Gateway through interfaces with Topology "External" if there are routes configured for internal interfaces that overlap with routes configured for external interfaces. Refer to sk181768.

Core IPS Protection "Unknown Resource Record" drops valid requests of specific DNS types.

There may be excessive "fwconn_chain_is_data_conn failed" messages in the /var/log/messages files when activating the IPS Blade.

The Anti-Virus Blade fails to show the UserCheck page for the URLs blocked by Custom Intelligence feeds.

The Anti-Virus Blade may inspect files on an SMB appliance although the "SMB" checkbox is disabled on the matched profile.

Policy installation fails on the Security Gateway when using HTTPS Inspection with Hardware Security Module (HSM).

In some scenarios, the FWK process may unexpectedly exit, during installation of HTTPS Inspection policy on the Security Gateway.

In a cluster connected to Smart-1 Cloud, local probing may start on the "maas_tunnel" interface, although it is not monitored by the cluster. Output of the Expert command "cphaprob -i list" or the Gaia Clish command "show cluster members pnotes problem" shows that the Critical Device "Local Probing" reports its state as "problem".

The Security Gateway may crash during the conversion from VRRP Cluster to ClusterXL Cluster.

The "fwaccel dos rate get -S IP" command fails to connect to the Security Gateway.

CPView shows SecureXL drops incorrectly as "0" (zero).

The Security Gateway may fail to add interfaces to the SecureXL accelerated interfaces list.

In networks where multicast groups are manually configured through IGMP if only one membership report is received for a specific <S,G> pair and no further reports follow, it may cause outages.

Cluster failover may occur when the ROUTED process due to a memory leak unexpectedly exits with a core dump file generated.

ROUTED process assert failure may take place when LSA from a neighbor's retransmission list is freed if that LSA belongs to the max age hold tree that is flooded at max age.

The CLI Parameters for the "netflow fwrule" command are displayed incorrectly: "set netflow fwrule ?" instead of "set netflow fwrule 0" or "set netflow fwrule 1". The issue is cosmetic only, the functionality works as expected.

When using the "fw tab" command to view the IKE_SA_table, the output shows a column containing the IP addresses that are not meant to be displayed while the correct IP addresses are not printed.

Establishing an IKEv2 tunnel with Cross AZ Cluster may fail.

High CPU usage on SND cores when many interfaces are configured. Refer to sk181860.

When adding a new Virtual System, a CPD core dump file may be generated.

Taking a snapshot on the Security Management Server fails because of the error during copying the /boot/config/ content.

There may be some inconsistent syntax in the "comment" section for interface and static-route commands.

Lock database override may not work as expected when it is set via Ansible playbook, and another admin was connected to SSH before that.

The Application Scan Push Operation fails to upload an .xml file. Refer to sk181280.

In some scenarios, SIP TCP connections are dropped after a cluster failover.

In a rare scenario, file system corruption may lead to a failure identifying the Maestro Orchestrator hardware model during the Maestro Orchestrator OS boot process, causing the boot to fail.

After dynamic routing manager failure and recovery, connections are dropped with a log message "TCP out of state: First packet isn't SYN". Refer to sk181874.

The Gaia gClish command "installer verify CPUSE Package ID member_ids all" fails with "Quitting due to time-out" on a Scalable Platform Security Group. Refer to sk181674.

VPN IKEv2 negotiation with a third party peer may fail when the peer offers multiple combined encryption algorithms in one proposal. For example, AWS by default offers AES-GCM and AES-GCM-256. The issue triggers an IKE failure log.

See the Important Notes section.

UPDATE: Added Take 34 of CPviewExporter Release Updates. Refer to sk180521.

UPDATE: Added Update 23 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

When using NAT64 rules, Server to Client traffic may be dropped because of the "Out of state" error.

NEW: Added support for Quantum Spark Appliances 1900/2000 for EA (Early Availability) customers.

UPDATE: Added support for scheduling automatic purges of the System Data domain.

UPDATE: Added a boolean parameter to Management API command for configuring logs distribution between multiple Log Servers - "logs-settings.distribute-logs-between-multiple-active-servers".

Syntax: mgmt_cli -r true set simple-gateway name <gw_name> logs-settings.distribute-logs-between-multiple-active-servers <true/false>

• Supported on Security Gateway running version R81.10 and higher.

UPDATE: When changes are made to updatable objects within a policy and a missing or corrupted package is detected, the policy installation will fail, resulting in the generation of a log.

UPDATE: Added Update 22 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

UPDATE: Added Update 5 of Threat Extraction Engine. Refer to sk165832.

UPDATE: Improved Anti-Virus caching mechanism to prevent generating malicious sub-domains in Background resource categorization mode.

UPDATE: It is now possible to add exceptions to external IoC feeds.

UPDATE: The "IPv6 autoconfig" parameter is now disabled by default on VSX.

UPDATE: The output of "show arp dynamic all" and "dbget ip:arpdynamic:show:0" which was previously limited to +-4450 entries, now increases dynamically.

UPDATE: SNMP traps for interfaces going up and going down now contains the interface name and description.

UPDATE: Added support for Azure Scale sets with Flexible orchestration mode.

UPDATE: Enabled new docker capabilities on IoT Gateways.

In SmartConsole, export of policies with the "Hit count" column may get stuck.

In High Availability Security Management Server environments, outdated IPS packages are retained, which leads to a substantial increase of the database on Standby Security Management Server. Refer to sk182178.

In rare scenarios:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

In multi-site Multi-Domain Security Management environments, login to SmartConsole fails while an Install Policy Preset relays the Security Gateway installation statuses.

In some scenarios, the "Object is no longer available" validation warning appears for updatable objects.

In environments with tens of thousands of network objects, opening and closing Security Gateway objects in SmartConsole takes a long time. Refer to sk181460.

Users may be able to configure user-defined scripts to run on the Security Management Server, although they do not have the permissions of a super-user.

The "run-script - audit log" Management API program may fail and the audit log may be missing the "performed on" field.

Login via API fails if the Security Management Server has multiple IP addresses and they are not defined on the Security Management Server object in SmartConsole.

The "set checkpoint-host" API command may fail if the host object has a VPN Tunnel interface (vpnt) defined.

In some scenarios, an upgrade of the Security Management Server may fail if the import is running at 12 AM.

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or via the Advanced Upgrade method.

The "fwm sic_reset" command may fail and generate a core dump.

In multi-site environments, when using LDAP administrators configured on an external LDAP Server, logging into Domains on different Multi-Domain Security Management Servers in parallel, synchronization may fail with the "failed to import data" status.

In some scenarios, in High Availability Security Management Server environments, there may be increase of the database on the Security Management Server.

When viewing Subordinate CA objects in SmartConsole:

• Users with read-only permissions may receive a "Trusted CA" field as "not initialized" message.

• The information under "Retrieve CRLs from" in the OPSEC PKI tab is inaccurate.

• The fix requires installing SmartConsole R81.10 Build 420 (or higher).

After importing or deleting snort protections in the IPS Protections view, the view may not show the change.

• The fix requires installing SmartConsole R81.10 Build 420 (or higher).

The "fwm logexport" returns "Failed to print record at position" and "missing table field" error messages despite succeeding to export the logs.

When the CPD process is automatically restarted on the Security Gateway, the output of the "cpstat ls -f logging" command on the Security Management side shows the Security Gateway is disconnected, the Log Server cannot be reached, although logs are sent.

When running the tp_collector tool, the FW_FULL process may unexpectedly exit.

In rare scenarios, the WSDNSD process an RST connection may write to a broken pipe, which causes it to restart constantly.

The /var/log/messages file of a VSX gateway is flooded with the "fwmultik_predefined_dispatching: BAD_MULTIK_TAG" messages with no impact of the connectivity. Refer to sk181281.

Topology and Anti-Spoofing ranges are not calculated on an external interface when adding a route to an internal interface that shares the same subnet.

The Security Gateway may listen to the ports used by NAT.

The VPND, CVPND, and PDPD processes on the Security Gateway may become non-responsive and cause SAML authentication for Remote Access VPN users to fail.

In some scenarios, a misconfiguration on a DNS Server may lead to exhaustion of ephemeral ports on the Security Gateway.

In rare scenarios, CPU utilization can reach high levels because the Multi-Queue affinity of interfaces that use the "mlx5_core" driver is not configured correctly during the boot process.

Traffic directed towards a host situated behind the Security Gateway is not blocked. For instance, if an IP address listed in the feed sends an ICMP request, it will reach a host behind the Gateway without being blocked. Refer to sk132193.

In a rare scenario, there may be an unexpected reboot and a vmcore file generated in /var/log/crash.

In a rare scenario, a memory leak in the FWD process may occur after installing a Threat Prevention policy.

Uploading an IoC file containing invalid characters (for example, quotation marks) may cause failure of Threat Prevention policy installation.

Anti-Virus Blade triggers the "Detect" logs for DNS traffic, although these malicious DNS requests were prevented.

The output of the "fw amw unload" command shows the policy gets unloaded, however CPVIEW still shows that the blades are enabled. Refer to sk181148.

The ida_tables_util tool may fail with the "bad adress" error.

In a rare scenario, when Identity Broker is configured, a memory leak in the PDPD process may occur during policy installation.

CPView and the 'cpstat' command show different Application Control database versions. Refer to sk181186.

The DLP process may unexpectedly exit during policy installation.

Some websites may be unreachable when one of Threat Prevention Blades is in Hold mode.

A memory leak in the DLPU process may occur when Anti-Virus scans files over HTTP(s) or SMB (Server Message Block) protocol.

Site to Site VPN outage on ClusterXL Active member when running "cpstop" on the Standby cluster member. Refer to sk170055.

In some scenarios, it may not be possible to connect to the Security Gateway cluster members when User Mode (UPPAK) is enabled.

Latency may occur when packets accelerated by LightSpeed go through connections with a lower than 100K PPS rate.

In some scenarios, the VSX Security Gateway may not be able to pass VPN encrypted traffic from one Virtual System to another Virtual System through a Virtual Router/Switch.

In some scenarios, the VSX Security Gateway may crash when sending VPN encrypted traffic through a Virtual Router/Switch.

The port beacon feature also known as interface discovery or port blinking may not work correctly in User Mode (UPPAK).

In some scenarios (when there are more than 64000 connections), the Security Gateway accounting information may not be reported correctly on connections that are accelerated through the Quantum LightSpeed hardware.

Syn Defender may not correctly handle reused connections.

If the Security Gateway is in UPPAK mode and a PBR rule directs traffic to a Server on a different subnet, deleting the ARP entry for the Gateway on the Server can disrupt the traffic flow.

During the processing of PIM Join-Prune messages, the absence of prior ({},G) state prevents the processing of (S,G) joins for the same group, even when present in the message.

Back connection does not function on the Statically NATed Office Mode address as expected.

The "Encryption Domain Per community" feature overrides the Encryption Domain for other communities. Refer to sk170857.

VPN connectivity may be unstable when IPv6 and VPN star communities are configured.

A low-severity security vulnerability may exist when establishing an HTTPS connection to the Security Gateway.

Virtual System context may not be handled correctly by CPView, for example, the same interfaces may be listed on all virtual systems.

A memory leak may occur in the CPD process.

The SNMPD process memory consumption may be high, which causes the process to become unresponsive.

E2 engine may send an incorrect value of datDate in sync request.

Due to a synchronization issue between the Policy Server and Primary Server, the Endpoint clients may be connected to the Primary Server instead of the Policy Server.

After an upgrade, Azure Gov mapping may fail.

On a Security Group with MDPS enabled:

• The "asg perf" command on a Security Group does not show any output - the Gaia OS prompt appears immediately after entering the command and pressing the Enter key.

• When running the "mac_verifier" and other commands on a Security Group, the output may show the error message "mount of /sys failed: device or resource busy".

• The "distutil verify -v" command on a Security Group returns "verification failed".

After installing this Take, when MDPS plane separation is enabled, in the context of the Management plane, the directory /sys/class/net/ now shows interfaces that belong to the Data plane, although it should show interfaces that belong to the Management plane.

See sk182076.

In a Maestro environment, LACP bond subordinates may become suspended when using the shared interfaces feature, particularly when the quantity of bonds and subordinates is significantly high.

Performance data collected from all members including the Standby site, may cause the "Instance Load" and "Accelerate Load" values to be different from the asg perf tool data.

When running the "asg if script" command, the "Bridge Master" output does not fit in one line in the "Info" column. The issue is cosmetic only.

Additional reboot is performed when adding a new member to a Security Group with image clone enabled.

The Security Gateway may lose connectivity to Maestro Hyperscale Orchestrator (MHO) when running the "tcpdump -i any" command.

Reboot may take a long time.

UPDATE: Upgraded the commons-compress-jar package from version 1.8 to version 1.22.

UPDATE: properJavaRDP - an SNX-embedded application for Mobile Access is now blocked and is no longer supported because of deprecated Java library dependencies.

UPDATE: New features and improvements are released in Take 81, Take 85, Take 88 and Take 90 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 68 and Take 70 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

UPDATE: Improved traffic classification of GTP traffic on the Security Gateway to enhance the stability.

UPDATE: SNX used to connect back to Mobile Access Blade's portal FQDN by resolving its IP address locally. This method makes it sensitive to DNS poisoning attacks such as those specified by TunnelCrack. Therefore, it was modified to connect back to the Security Gateway / Cluster member IP address by default.

UPDATE: Added Take 29 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

• Running a Gaia API command on a Security Gateway using Management API from the Multi-Domain Security Management Server fails.

• Running a Gaia API command on a Security Gateway using Management API from the Security Management Server fails if the Security Gateway certificate was not recreated.

In rare scenarios, the FW1 process may stop working when at least one of these features is enabled:

• Anti-Virus deep scan

• Threat Emulation

• Threat Extraction

• Application Control

• Data Loss Prevention

• URL Filtering

ARP requests sent with VMAC from the Standby member may cause MAC flapping.

See the Important Notes section.

UPDATE: Added a pop-up message explaining that it is not possible to add an exception to a Global Domain policy from a local Domain when clicking "add exception" in a Global rule.

• Requires installing SmartConsole Build 417 (or higher).

UPDATE: Added a new option in domains_tool, which allows to retrieve IP addresses of multiple Domains - "-md <list of domains>". Refer to sk161632.

UPDATE: Enhanced PushReport (a troubleshooting tool for Mobile Access Blade):

• changes in the cloud service configuration,

• stability improvement.

UPDATE: Added SAML authentication support for Capsule Connect / Capsule VPN.

UPDATE: Added Take 20 of Public Cloud CA Bundle. Refer to sk172188.

UPDATE: Added ability to stop configuration mismatch repeated reboots for debugging purposes. The new command is " cpha_blade_config auto_reboot <on/off>".

UPDATE: Added Update 13 of HealthCheck Point (HCP) Release. Refer to sk171436.

Excluding a network with anti-spoofing by name on the Security Gateway using the "set simple-gateway" Management API command fails with an "Anti spoofing: excluded network object must be defined." validation error message.

The "show-vpn-communities-star" Management API command fails for VPN communities using Diffie-Hellman groups 15-18. Refer to sk27054.

The "show-nat-rulebase" Management API command fails when Packet mode is enabled and "match on any" is set to "false". For example, "show-nat-rulebase XXX package YYY filter-settings.search-mode packet filter-settings.packet-search-settings.match-on-any false filter ZZZ".

QoS policy cannot be installed if the policy package name contains a dot symbol.

A migrate export or CPUSE upgrade of a Security Management Server fails if a Rule Base contains more than 35,000 rules. Refer to sk178325 to check the recommended size of Rule Bases.

Security Management Server import fails with the "Tried to persist object XXX with domain YYY while active domain is ZZZ" error in the upgrade report.

The "show-objects" Management API command with an "in" clause fails if the object name contains a period. For example, "show-objects in.1 <name> in.2 <ab.c>".

In rare scenarios, the High Availability synchronization status shows "NGM failed to import data", and then is cleared automatically within 15 minutes.

When using the RADIUS username for authentication, login to SmartConsole may fail.

In an environment with many Security Gateways, SmartConsole may unexpectedly close when selecting a policy package to install.

Global Policy assignment fails if it is configured to assign to specific Domain policies and one of these local Domain policies is deleted.

Tasks in SmartConsole may end unexpectedly during the Jumbo/ major version upgrade operation.

The "show-simple-gateway" and "set-simple-gateway" Management API commands with the "logs-settings.forward-logs-to-log-server-schedule-name" parameter fail with "generic_server_error".

Configuring log settings to delete logs if free disk space is lower than a certain percentage may not be applied.

In SmartView, filtering logs by Media Encryption & Port Protection Blade may fail.

When enabling Management Data Plane Separation (MDPS) in Clish, a "Failed to commit the transaction on database" error message may be displayed.

The Security Gateway may crash due to a memory issue.

Benign files scanned by the ICAP Server may not be logged by Anti-Virus Blade.

When two routes with similar attributes are added to different routing tables, and one is deleted, Anti-Spoofing may drop the traffic to that route.

In some scenarios, CIFS parser is triggered when it is not needed, this leads to the Security Gateway not accelerating fully the SMB traffic.

When SSH Deep Packet Inspection (SSH DPI) is enabled, the Security Gateway may have SSH connectivity issues because of an incorrect choice of Message Authentication Code (MAC) algorithm during the SSH handshake.

Fetching of Custom Intelligence Feeds fails when no proxy is configured on the Security Gateway.

In rare scenarios, there may be a memory leak in ips_cmi_handler_match_cb_ex.

A memory leak may occur in the Security Gateway when a connection is not correctly released after the inspection.

When copying special German characters to and from the Guacamole Server, they are replaced with unreadable symbols.

In a cluster/Maestro in Load Sharing mode, the Security Gateway may drop NAT traversal traffic with "fwmultik_process_f2p_cookie_inner Reason: PSL Drop: No connection".

The "IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful" error may be printed during cpstart. Refer to sk180646.

When multicast traffic for an existing (S,G) entry arrives at a non-IIF interface, the entry may be deleted and re-added when the next multicast packet is released, although the entry should not be deleted.

An OIF entry may be missing when multiple downstream neighbors are present on a LAN. Refer to sk181354.

When a BFD session is added or removed, disabled sessions may incorrectly come up.

A potential leak in VPN tunnels in a Multi-Version Cluster.

Potential VPN outage during policy installation.

In a rare scenario, affinity configuration on VSX may fail.

When running "vsx_fetch" from a context that is not VS0, this output is displayed: "Management rejected fetch for this module - sic name does not match. Couldn't fetch VSX configuration by IPs, trying to fetch by names."

When changing bond settings, the bond may be missing the global IPv6 Address.