R81.10 Jumbo Hotfix Take 95

NEW:

• Added support for 1595 Slim Ruggedized appliances.

• Added support for 1535 / 1555, 1575 / 1595 Quantum Spark Pro appliances.

NEW: Compliance Blade is enhanced with 5 new Firewall Best Practices:

• FW174 - Check that there are no Access Control rules that contain "Any" in the "Source" column and contain "Accept" or "Ask" in the "Action" column.

• FW175 - Check that Access Control rules do not contain "Any" in "Destination", and "Accept" or "Ask" in "Action".

• FW176 - Check that Access Control rules do not contain "Any" in "Services and Applications", and "Accept" or "Ask" in "Action".

• FW177 - Check that there are no temporary Access Control rules (based on the "Name" column).

• FW178 - Check that there are no temporary Access Control rules (based on the "Comments" column).

UPDATE: Defining GUI Clients on the Log Server is now blocked. Defining GUI Clients is allowed only from the Security Management Server in Active mode.

UPDATE: Added a new kernel parameter allowing to control the size of fragments table in SecureXL. To use it, set the kernel parameter "sim_frag_limit_override" with the new value and install policy. This can prevent fragment drops when having multiple instances in the Firewall.

UPDATE: When the VTI MTU is different from the physical MTU, the physical MTU is used for sending packets by default.

• To modify the default behavior (the change does not survive reboot), run the CLI command "fw ctl set int sim_vpn_use_physical_mtu 0 -a". This allows using configured VTI MTU as the default.

• To make the change permanently, open the $PPKDIR/conf/simkern.conf file for editing and add the entry "sim_vpn_use_physical_mtu=0".

Refer to sk98074.

UPDATE: Linux installations are now automatically added to "All Linux Desktops Virtual Group" in Harmony Endpoint. Refer to sk180430.

UPDATE: Upgraded OpenSSL from 1.1.1n to 1.1.1t to include the latest security improvements.

UPDATE: Added support for Data Centers in AWS ap-southeast-4 Melbourne region.

UPDATE: Enhanced the mechanism of Maestro Gateway leaving a Security Group.

In some scenarios, the "run-script" Management API command may fail with "Null Pointer Exception" when using root user permissions.

After creating a new administrator in SmartConsole, the Administrators view may fail to load with "Error retrieving results".

When using Custom Application/Site Group objects in an Access policy, policy installation may fail with an "Internal error" message.

A typo in "Dropped fragmentation violation" under CPView > Advanced > SecureXL > Drops.

The Network-per-CPU tab under CPVIEW > Advanced > SecureXL does not show traffic distribution for all CPUs. Refer to sk180540.

In some scenarios, the FWD process may unexpectedly exit and cause a short outage related to a BGP failure.

After an upgrade to Take 79, memory usage may increase on all Security Gateway Modules, and the "pkt_handle_f2v_if_needed: dropping packet (failed to send notification)" error is printed in logs.

When MDPS is configured, mdps_tun interface is shown when running the "cpstat ha -f all" command.

When adding a new RADIUS Server in Gaia Portal, its IP address is automatically added to MDPS tasks, but when deleting this Server, the MDPS task is not deleted.

The Security Gateway may receive duplicated traffic (such as non-IP protocol connections) for IPS inspection. This can trigger high CPU usage and result in failures to connect over SSH or policy installation.

SAML authentication fails with the "HTTP 500" error when MDPS is enabled on the Security Gateways. Refer to sk179625.

On supported Open Servers (sk167052), after changing the Firewall mode from Kernel Space (KSFW) to User Space (USFW) and reboot, the Security Gateway continues to boot in the Kernel Space mode.

If SSH Deep Packet Inspection (DPI) is enabled and NAT is configured on the Security Gateway, SSH connectivity from the Internet may not be possible.

In a Quantum Maestro environment, adding an IoC feed from the command line may fail with a "Can not load indicators feed without AV & AB Blades enabled, please enable AV & AB and try again" message, although Anti-Virus and Anti-Bot Blades are enabled.

The PDPD process may cause CPU spikes during cluster failover.

In a rare scenario, a wrong access role may be assigned to a user.

A buffer overflow may occur and cause the FWD process to exit. This leads to the Security Group Members in a Maestro environment change from Active to Down state and creates instability.

In a rare scenario, the Security Gateway may crash during an IPS package update.

A memory leak may occur in the DLPU process.

Some web applications which use PT or UT link translation methods may have issues after a browser upgrade.

IPv6 template is not created when the connection is NATed.

After an upgrade, packets passing through a Remote Access VPN tunnel in a VSX environment may be silently dropped.

Failover may take longer than expected and traffic does not pass for several seconds because dynamic routes are lost.

The ROUTED process may repeatedly exit when using PIM in Sparse mode (SM).

The ROUTED daemon may unexpectedly exit and generate core dumps after OSPF neighborship was established, but did not advertise routes. Lost routing causes the network to be down.

Cluster member may stop sending multicast PIM traffic after failover or a reboot. Refer to sk180669.

VPN endpoint users fail to login with ECDSA certificate.

• NAT-T traffic may stop matching the implied rule after policy installation and is dropped with "IKE_NAT_TRAVERSAL Traffic Dropped from x.x.x.x to y.y.y.y" message in SmartLog.

• VPND and IKED stability issues occur when loading newly created LDAP group objects.

Refer to sk180530.

TCP traffic on port 34500 may be encrypted by VPN, although it should not.

When running the "vpn tu tlist" on cluster Standby members, old IKEv2 SAs may be printed in the output.

When running the "ifconfig -a" command on a Virtual System (VS) with more than 250 interfaces, the "/bin/cp-ifconfig.sh: line 179: /bin/echo: Argument list too long" error is printed.

Incorrect logs are printed in the /var/log/httpd2_error_log file when logging into the WebUI.

When restoring a backup with VSX objects, the objects database may not be restored on the newly installed Security Management Server.

VPN Cluster stability issue when the peer is an Azure Security Gateway.

Azure scan fails if a Virtual Machine Scale Set (VMSS) is deleted after the scan started.

After an upgrade, local IPv6 traffic from Active members may fail.

Adding more than 250 VLANs on an Orchestrator MHO-175 Maestro Uplink interface causes intermittent traffic outages. Refer to sk180340.

The "asg perf" command fails when running it with the "-vv" flag.