R81.10 Jumbo Hotfix Take 55

In some scenarios, CPView shows the SNMP data partially.

UPDATE:

• Added the "--help" and "-h" flags to "mdsstop", "mdsstart" and "mdsstat".

• It is no longer possible to run the "mdsstop" and "mdsstart" commands with wrong parameters.

In rare scenarios, the task of creating/deleting a Domain or Domain Server may be stuck at 5% with the "Task in queue" status.

In large environments, after installing Jumbo Hotfix Take 38 or Take 45, login to SmartConsole may fail shortly after services are up. Refer to sk178807.

See the Important Notes section.

Multi-Domain High Availability synchronization in the Global Domain may fail with the "There are invalid assignments on peer" error.

The Management REST API "add lsm-gateway" with "SIC" parameter may fail with "generic_error".

When automatic purge is configured in a local Domain and there is an assignment between the Global Domain to that Domain, the "show-automatic-purge" API command may fail in the Global Domain with the "Can't build automatic purge reply" error. Refer to sk176443.

The "Free Memory" column under the "Gateways and Servers" tab may show "N/A" instead of the actual value. Refer to sk177135.

When working with Endpoint Cloud, the License tab under "Gateways and Servers" in SmartConsole may show "Certificate error: CertAuthorityInvalid".

Policy installation on R81 (and below) Gateways may fail when there are multiple login options configured with SAML which uses Identity Provider as an authentication method. Refer to sk176725.

The mgmt_cli tool (API) with certificate login may not work.

The CPD process may consume a high CPU after an upgrade of the Security Management Server that manages devices through LSM Profiles.

In some scenarios, it is not possible to add the "Policy Rule UID" column to the Logs view in the SmartView Web Application.

In rare scenarios, when QoS Blade is enabled, the FWD process may unexpectedly exit. Refer to sk177783.

UPDATE: Added Connection and Packet Distribution statistics in CPView.

The dlpu process may unexpectedly exit, producing a core dump file.

It may not be possible to use the Office 365 Tenant Restrictions feature when ICAP client is enabled.

Policy installation may fail when reaching out of memory on the Security Gateway.

Matched rules on Inline layer may appear as the "Accept'"/ "Drop" action instead of "Inline".

The Security Gateway may crash during policy installation due to memory allocation problems.

The log_exporter process may consume a high CPU.

In a rare scenario, the DLP process leaves open unused file descriptors in the $FWDIR/tmp/dlp directory which may take up a large amount of disk space.

Threat Prevention policy may fail when the MITRE tactic ID value is invalid.

In a rare scenario, when URL Filtering Blade is active, in Website categorization background mode, the FWK process may unexpectedly exit and create a core dump.

In some scenarios, DLP (Data Loss Prevention) Blade may not delete temporary files used for scanning.

In rare scenarios, the WSTLSD daemon may unexpectedly restart.

When running cipher_util in any VS other than VS0, the "Cannot access features configuration directory" error is shown.

In some scenarios, the WSTLSD daemon may unexpectedly exit during TLS probing.

In a rare scenario, the WSTLSD process may unexpectedly exit while validating signatures of sites with improper certificate chains.

UPDATE: SSL Network Extender was updated to version 800008304. It provides TLS 1.2 cipher suites support on macOS.

The VSX Gateway may crash when trying to route traffic from a VS to a Virtual Switch (VSW).

UPDATE: ROUTED debug log will now show IP addresses.

An OSPFv2 graceful restart with authentication may cause an outage.

UPDATE: Adjusted AD-Query and Identity Logging solutions to work with Microsoft hardening changes in DCOM which were required for CVE-2021-26414. Refer to sk176148.

There may be connectivity issues and high CPU spikes on the PDPD, VPND processes, and on the Gateway when installing policy. Refer to sk174144.

Capsule Workspace cannot connect to a Mobile Access Gateway when the Citrix application is configured and allowed to the end-user's group.

The "fwaccel dos rate add" command may fail with the "Another fwaccel command is already in progress" error.

In some scenarios, the RIM script is not activated in DPD Tunnel monitoring.

In rare scenarios, Remote Access users cannot connect to the Gateway because of certificate authentication failure.

A memory leak may occur in the VPND process when using Remote Access with Multiple Entry Points configured.

Enhanced stability of Site-to-Site VPN with interoperable devices.

In some scenarios, L2TP users cannot connect to the Gateway in a cluster environment.

A memory leak may occur in the VPND process when using Remote Access Secondary Connect.

Improved IKEv2 for working with DAIPs.

The VPND process may unexpectedly exit with a core dump file.

A memory leak may occur in the VPND process.

In some scenarios, the VSX Gateway may incorrectly handle broadcast packets received from a Virtual Switch.

Fixed the CVE-2020-14145 vulnerability.

NEW:

• Rule base search in SmartConsole now also matches rules with Data Center Objects.
• In SmartConsole, it is now possible to see IP addresses of all the objects included in:
• AWS VPC and Availability Zone,Azure Virtual Network, GCP Network
• In SmartConsole, improved searching objects using tags.

When there are VS's with the same name prefix, the CloudGuard Controller fails to update the VS with Data Center Objects.

Added Take 14 of Public Cloud CA Bundle. Refer to sk172188.

In a rare scenario, after a reboot, there may be connectivity issues between a Gateway and Maestro Hyperscale Orchestrator (MHO).

OSPF may install a route to the incorrect IP when configured as P2P. Refer to sk177686.

Local connection from a Standby site may be dropped if there is a switch between the sites. Refer to sk178045.