R81.10 Jumbo Hotfix Take 110

NEW: Added a new field to the output of "mgmt_cli show updatable-objects-repository-content" command. This field displays the object's unique name as it is saved in the updatable objects repository.

NEW: Added a new Management API "mgmt_cli show ha-status". It provides synchronization information for the currently active domain.

• When running the command from the Active Domain in the local/Global Domain, it retrieves details about the synchronization status of the other standby peers and the overall synchronization status for the Domain.

• When running the command from the system Domain, it only displays the general synchronization status, as all peers are active.

NEW: CloudGuard Controller for NSX-T

• Starting from NSX-T 4.0.0.x and higher, Manager Mode APIs are deprecated, it is recommended to use Policy Mode.

• Import NSX-T Tags (NSgroups and VMs) is now supported.

• Import NSX-T Virtual Machine objects is now supported.

Note: Importing Virtual Machines can be enabled only using Policy Mode APIs. When enabled, the amount of API requests toward the NSX-T manager increased.

UPDATE: Added ability to block policy installation if this policy contradicts another policy installed on the Security Gateway. In this scenario, the "install-policy" Management API command will now fail with "Requested policy X does not match currently installed policy Y on gateway Z. To ignore this warning, set the 'ignore-warnings' flag to 'true'". Refer to sk180792.

UPDATE: Significantly improved performance during upgrade and import for large Multi-Domain Security Management environments with many administrators (over 20 domains and over 100 global administrators).

• Requires installing Upgrade Tools package 996000482 and higher.

UPDATE: Added a new environment variable "IMPLIED_RULES_SET_BEFORE_LAST". It defines if Multi-Portal implied rules should be matched as "before drop" or "before last". The default value is "0", set to "before drop". When the value is set to "1", implied rules will be matched as "before last". Refer to sk180808.

UPDATE: Improved the fullsync time after reboot in large scale environments. Refer to sk180742.

UPDATE: Major performance improvement in HTTPS Inspection of TLS 1.3.

UPDATE: IPS bypass triggers will now be activated based on the average CPU load exceeding the high threshold, as opposed to the previous implementation, where a single CPU load triggered the bypass. The change will result in more effective security measures without unnecessary bypasses.

UPDATE: First release of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

UPDATE: Upgraded OpenSSL from 1.1.1t to 1.1.1u to include the latest security improvements. Refer to sk181427.

UPDATE: Increased the size of the scheduled snapshot database binding, allowing longer paths and passwords to be defined.

UPDATE: Added Take 23 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

UPDATE: Added a new log file to indicate the reason of member reboots if they are triggered by configuration mismatch - /var/log/configuration_reboot_info.log.

If the Security Management Server is behind NAT, remote Management API login fails.

APP_ID may not be initialized when adding a new Check Point application via API, this may cause blocked access to several websites.

Editing an object in SmartConsole may fail with "Server error is: Object not found (Code: x08003001D, Could not access file for write operation)".

In some scenarios, an upgrade may fail when a Network object Group contains more than 32000 members.

If a Security Gateway is added to a group after configuring an installation policy preset, the policy may not be installed on that Security Gateway. Refer to sk181461.

In some scenarios, Access Policy Verification fails but the name of the failed rule is not specified.

When using the "Deployment from Local Paths and URLs" option, and inserting a correct path, the client is being deployed through the Management Server and not Locally as it should be deployed.

In the Object Explorer window in SmartConsole, the IP address column is sorted alphabetically, although it should be sorted in numerical order.

In the Infinity Services view, the Log Sharing status may not be correct.

The "show object" command fails when running it on nat-section objects. It returns a "null pointer exception" message, which occurs in calculations related to the overview objects meta-info.

When creating several LSM objects (Security Gateways or clusters) via both Management API and SmartConsole, the LSM objects IP addresses may be duplicated.

In some scenarios, the "show-packages" Management API command may return empty results when using the "domains-to-process" flag.

Policy installation gets stuck if the known proxy group contains the policy target.

In rare scenarios, login to SmartConsole fails, and opening Security Gateway objects times out.

Disabling or enabling rules may not affect the "last-modify-time" field in the output of the "show-access-rule" Management API command.

Deleting the entire Domain including all its Domain Servers fails, if any of the Domain Servers is used in the Domain's policy.

A scheduled Install Policy Preset may not have its next run time updated when:

• The Multi-Domain Security Management Server was down while the preset was scheduled to run

• There are over 50 presets defined

Deleting a Domain from SmartConsole fails after a Domain Server was removed and the Domain has no Domain Servers.

In rare scenarios, in a Multi-Domain Security Management environment:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

Typo in the Compliance report - "OSFP" instead of "OSPF".

In rare scenarios, many open connections on port 18196 are observed on the Multi-Domain Security Management Server or Multi-Domain Log Security Management Server.

In some scenarios, in the Logs view, the "Destination" field may be missing. The issue is cosmetic only.

Source and destination IP addresses in SmartLog may not be shown correctly for duplicate packets of fragmented traffic.

In specific network configurations, after installing a policy, the target IP address of the Log Server may differ from what was configured.

In rare scenarios, memory corruption occurs during packet correction requiring fragmentation, this may cause the Security Gateway crash or freeze.

On the Security Gateway with Management Data Plane Separation (MDPS) enabled:

• when adding a RADIUS Server from WebUI, a new MDPS task with the IP address of the Server may not be added,

• when deleting a RADIUS Server, the MDPS task may not be deleted.

In some scenarios, the Security Gateway may crash.

In some scenarios, while processing H323 traffic, the Security Gateway may unexpectedly restart.

Incorrect bonds may be shown in the Data Plane when using MDPS with the "show bonding groups" command.

The FWK process may unexpectedly exit with a core dump file when removing an IPv6 interface on VSX.

Enlarging MTU may cause even small packets to be allocated as Jumbo frames. This will impact the performance of SNDs CPUs.

The FWK process may unexpectedly exit while processing the mail flow and generate a core dump.

When adding another loopback interface in an MDPS environment, it is shown in MPLANE and not in DPLANE as expected.

When adding a new connection, the "Smart Connection Reuse" feature may cause errors in fwk.elg and connection drops.

Security Gateway may crash when running kernel debugs of the "UP" module.

In a Maestro environment where members are VSXs, connection over SSH or RDP from a host behind Maestro to a peer may be dropped.

Latency in connection caused by a packet flow change from F2V to F2F.

When the Security Gateway handles specific HTTP requests, memory failure may occur. CPView registers SMEM failure.

IoC feed may not load, and the "Feed status cybercrime-tracker_hash_list :: engine memory allocation error. Feed log External IoC - External Indicators processing failed" error is displayed in CLI.

After an upgrade, adding an IoC feed with IP range indicator type may fail with "Feed format problem. Bad or Empty Feed ".

In some scenarios, the FWD process unexpectedly exits, and the Security Group Members state flaps between Active and Down during an Anti-Bot Blade update.

When IPS Blade is enabled, the Security Gateway may crash.

When Content Awareness Blade is enabled, there is a limitation of the file size (sk118516). However, when the source object of the Content Awareness rule does not match the current connection, the limitation is not applied on this connection.

When the "Categorize HTTPS Websites" option is enabled and the global parameter "appi_urlf_ssl_cn_use_sni_without_validation" is set to true, a memory leak may occur.

The DLPU process may stop working, creating a User Space core dump file on the Security Gateway. Refer to sk181026.

Importing a custom intelligence feed containing IP ranges may fail.

In a VSX environment, the WSTLSD process run by Virtual Systems may ignore proxy configuration on VS0.

Sending emails with attachments via Capsule Workspace may fail on iOS.

Some IPv6 connections randomly stop passing through ClusterXL in High Availability mode. Refer to sk180969.

Asymmetric UDP traffic may be dropped with "First Packet isn´t Syn".

After several failovers in a cluster, connections may fail to synchronize. This can cause a timeout and the "first packet isn't syn" drops.

When running tcpdump on the Multi-Domain Security Server, an "error /bin/cp-tcpdump.sh: line 11: sxlmode: command not found" message is shown. The issue is cosmetic only.

The ROUTED daemon may unexpectedly exit because of multi-threading issues.

Routes marked as "stale" may be redistributed via BGP during graceful restart.

BGP state gets stuck in Idle state when using BGP ping to one of the peers.

The ROUTED daemon may unexpectedly exit when aggregating routes with long AS paths.

Configuring OSPFv2 Graceful Restart and passive OSPF interfaces at the same time can cause graceful restart failures.

A VRRP/VRRP6 interface may go into Master/Master state.

An IGMP group with an expiration time of 7101 weeks should be deleted when it reaches 0 seconds, but instead, it may remain at 7101 weeks until a membership report is sent, then it resets to the interval of that interface.

• Remote Access clients are unable to connect using Machine Certificate Authentication when the certificate has OCSP and CRL but the gateway is unable to resolve properly the OCSP or to get a proper answer from the OCSP server. Refer to sk179434.

• OCSP is disabled on the user's IIS Server, but the Security Gateway does not fall back to the CRL method. Refer to sk179434.

• Security Gateway sends defaultCert to the third party instead of an OCSP certificate. An unexpected OCSP response may cause a VPN gateway to stop using its certificate until the next policy installation. Refer to sk180683.

The FWM process may unexpectedly exit at startup because of an incorrect VPN key initiation.

Warp interfaces may appear in VS0 and disrupt connectivity when editing a Virtual Switch with a bond and VLANs.

Virtual System's interfaces may be missing when running the Clish command "show/save configuration".

Some packets may disappear when using the i40e driver, and VMAC is configured on the cluster.

It may be not possible to enter a snapshot description with more than one word.

Backup on Gaia machine with Threat Emulation Blade enabled fails with "Cannot complete the backup process: not enough space". But the solution of sk166833 does not resolve the issue in a VSX environment.

Gaia WebUI logs are printed with "info" severity.

Non-domain macOS devices are created as a new endpoint on the Endpoint Management when re-installing the device.

AWS Data Center mapping fails when an interface subnet is missing from the list of subnets.

SIP traffic may be dropped and "kiss_htab_bl_infra_slink: failed "earlynat_sport_ghtab_bl":3 reason: KISS_HTAB_BL_SLINK_LIMIT_REACHED" is printed in the fwk.elg file.

The FW process may unexpectedly exit, producing a core dump file.

License is not copied from SMO to all other members if other members are in Down state.

The "orch_info" command may freeze, when running it on Maestro Orchestrator.

Querying the HW status via SNMP (OIDs .1.3.6.1.4.1.2620.1.6.7.*) or via the "cpstat os -f sensors" command may fail on Maestro Orchestrator.

Members may stay in Down state after reboot/Jumbo Hotfix installation with pull_config pnote when pulling registry from SMO: "Pull registry failed" error in the $FWDIR/log/Blade_config log file.

On Maestro, when MDPS (Management Data Plane Separation) is enabled, and the license corresponds to an IP address different from the management interface's IP address (such as the sync IP), policy installation may fail because of a license mismatch.

The "set/show trace" command may fail in gClish.

Incorrect parsing of GTP-U traffic may cause anti-spoofing drops.

Security Gateway drops GTP traffic with the reason "Static IP not allowed". See sk181506.

Packet corruption, leading to traffic and performance issues.