R81.20 Jumbo Hotfix Take 43

NEW: Added support for Quantum Spark Appliances 1900/2000 for EA (Early Availability) customers.

NEW: We have extended the grace period of Anti-Spam Blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.

UPDATE: Added support for the VPN certificate alert feature for Quantum Spark Appliances R81.10.X.

UPDATE: Added Take 74 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

UPDATE: Previously, in the "Hide NAT behind IP Address Range" feature, only the source IP address determined the Hide NAT IP address from the IP Address Range. It is now possible to configure the Security Gateway to select the Hide NAT IP address based on the combination of the source IP address and the source port. Refer to sk105302.

UPDATE: Added a new option in domains_tool, which allows to retrieve IP addresses of multiple Domains - "-md <list of domains>". Refer to sk161632.

UPDATE: Added Update 22 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

UPDATE: It is now possible to add exceptions to external Custom Intelligence feeds.

UPDATE: SSL Network Extender was updated to version 80008407.

UPDATE: When enabling the VMAC feature, link_monitoring on the cluster members is now configured automatically.

UPDATE: In VSX, removed the redundant option to change CoreXL mode from USFW to Kernel mode.

UPDATE: Upgraded OpenSSL from 1.1.1u to 1.1.1w to include the latest security improvements.

UPDATE: Gaia API updates is now installed automatically through AutoUpdater. Refer to sk165653.

UPDATE: Posture Management (Vulnerability & Patch Management) is now supported.

UPDATE: Added support for Azure Scale sets with Flexible orchestration mode.

UPDATE:

• Enhanced the mapping performance of Azure subscriptions and the overall process of mapping Data Centers.

• Minimized the duration required for policy updates to gateways in environments incorporating Public Data Centers (Azure, AWS, GCP, Oracle-Cloud OCI, and Generic-Data-Center).

• Updating Data Center properties requires installing the policy on only one Security Gateway.

UPDATE: Updated the Jetty open source library from the 9.3.6.v20151106 version to 9.4.52.v20230823.

UPDATE: Added ability to use Generic Data Centers and Dynamic Objects with Maestro cluster, not just for a separate Security Gateway.

In rare scenarios, Global Policy reassignment fails with "IPS Update Failed On Assign".

Global Policy assignment fails if it is configured to assign to specific Domain policies and one of these local Domain policies is deleted.

When closing an application from SmartConsole without changes, a redundant revision is created.

In some scenarios, the "Object is no longer available" validation warning appears for updatable objects.

The "show-nat-rulebase" Management API command fails when Packet mode is enabled and "match on any" is set to "false". For example, "show-nat-rulebase XXX package YYY filter-settings.search-mode packet filter-settings.packet-search-settings.match-on-any false filter ZZZ".

A migrate export or CPUSE upgrade of a Security Management Server fails if a Rule Base contains more than 35,000 rules. Refer to sk178325 to check the recommended size of Rule Bases.

In multi-site Multi-Domain Security Management environments, login to SmartConsole fails if the "Read_Write_All_Profile" permission profile is deleted.

When using the RADIUS username for authentication, login to SmartConsole may fail.

The "show-objects" Management API command with an "in" clause fails if the object name contains a period. For example, "show-objects in.1 <name> in.2 <ab.c>".

In rare scenarios, opening the Install Policy view gets timed out, and SmartConsole unexpectedly closes. Refer to sk181397.

In the Revisions view, when comparing the selected revision to its previous revision, an empty screen is shown instead of a report.

SmartConsole may unexpectedly close after clicking "Install Policy" while the Compliance blade is running a full scan.

The "set checkpoint-host" API command may fail if the host object has a VPN Tunnel interface (vpnt) defined.

In rare scenarios, the update_inspect_files tool may unexpectedly exit with a core dump file.

In rare scenarios, the High Availability synchronization status shows "NGM failed to import data", and then is cleared automatically within 15 minutes.

In rare scenarios:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

Login via API fails if the Security Management Server has multiple IP addresses and they are not defined on the Security Management Server object in SmartConsole.

In environments with tens of thousands of network objects, opening and closing Security Gateway objects in SmartConsole takes a long time. Refer to sk181460.

In SmartConsole, export of policies with the "Hit count" column may get stuck.

The Security Gateway may listen to the ports used by NAT.

In some scenarios, if a DAIP Gateway is registered to a VPN Community:

• "show-vpn-communities-star" Management API command may fail.

• sharing SmartConsole configuration with Infinity Portal fails.

In some scenarios, in High Availability Security Management Server environments, there may be increase of the database on the Security Management Server.

The "run-script - audit log" Management API program may fail and the audit log may be missing the "performed on" field.

In rare scenarios, Global Policy Reassignment takes a long time to complete after deleting a Global IPS profile. Refer to sk180787.

When viewing Subordinate CA objects in SmartConsole:

• Users with read-only permissions may receive a "Trusted CA" field as "not initialized" message.

• The information under "Retrieve CRLs from" in the OPSEC PKI tab is inaccurate.

The fix requires installing SmartConsole R81.20 Build 651 (or higher).

In rare scenarios, in a Multi-Domain Security Management environment:

• Login to the Management Server may timeout and fail.

• Publish operation may take a long time.

Deleting the entire Domain including all its Domain Servers fails, if any of the Domain Servers is used in the Domain policy.

After importing or deleting SNORT protections in the IPS Protections view, the view may not show the change.

• The fix requires installing SmartConsole R81.20 Build 651 (or higher).

Tasks in SmartConsole may end unexpectedly during the Jumbo/ major version upgrade operation.

Configuring log settings to delete logs if free disk space is lower than a certain percentage may not be applied.

In some scenarios, the "show logs" Management API returns incorrect values for the "Match table" field.

The "fwm logexport" may return "Failed to print record at position" and "missing table field" error messages despite succeeding to export the logs.

Windows Syslog messages information may be displayed in the "Description" field of the log and not parsed into the suitable fields.

In SmartView, filtering logs by Media Encryption & Port Protection blade may fail.

In some scenarios, the Log Sharing status may show an error in exporting the logs, although logs are correctly shared to the cloud.

In some scenarios, implied rules are not logged for clusters.

Following the installation of R81.20 Jumbo Hotfix Accumulator Take 26, it is impossible to configure a new Maestro group via the Gaia Portal.

The VPND, CVPND, and PDPD processes on the Security Gateway may become non-responsive and cause SAML authentication for Remote Access VPN users to fail.

The output of the "cpstat os -f cpu" command may be incorrect. Refer to sk180966.

In some scenarios, when IPS is enabled, CPU spikes may occur.

When adding another loopback interface in an MDPS environment, it is shown in MPLANE and not in DPLANE as expected.

When running the tp_collector tool, the FW_FULL process may unexpectedly exit.

Topology and Anti-Spoofing ranges are not calculated on an external interface when adding a route to an internal interface that shares the same subnet.

After installing a policy, because of high latency, the Security Gateway may delete connection before SIM Affinity is able to send an update notification. This may cause some connections to be dropped.

Re-mirrored traffic may be re-ordered in the Mirror & Decrypt feature.

Web Security parsing error "illegal header format detected: Missing quotation mark" of content-disposition header - that contains a filename* parameter or an unquoted parameter.

When two routes with similar attributes are added to different routing tables, and one is deleted, Anti-Spoofing may drop the traffic to that route.

The FWK process may unexpectedly exit with a core dump file when removing an IPv6 interface on VSX.

In a rare scenario, the FWD process listens to high ports that are not blocked by the "auth_services_real_ports_block" implied rule. Refer to sk180505.

In rare scenarios, ICA certificate creation and enrollment fail.

The output of the "fw amw unload" command shows the policy gets unloaded, however CPView still shows that the blades are enabled. Refer to sk181148.

Anti-Virus Blade triggers the "Detect" logs for DNS traffic, although these malicious DNS requests were prevented.

Uploading an IoC file containing invalid characters (for example, quotation marks) may cause Threat Prevention policy installation failure.

Multiple ifiPython3 processes may utilize the Security Gateway memory, affecting the Anti-Virus blade performance.

Anti-Virus fails to block Custom Intelligence feeds that contain percent-encoding.

Some connections may be dropped because of an issue in IPS inspection, which can be resolved by installing/fetching a local policy.

In a rare scenario, when cloning SGM in Maestro, the FWD process may exit during an IPS/Anti-Virus/Anti-Bot package update.

Ioc_feeds changes the username to lowercase, which causes the "401" error. Refer to sk181039.

When configuring Custom Intelligence feeds from the management:

• The "no_ssl_validation" variable may be deleted after the policy installation.

• Fetching feed fails with the "Peer certificate cannot be authenticated with given CA certificates" reason.

In a rare scenario, when Identity Broker is configured, a memory leak in the PDPD process may occur during policy installation.

The DLP process may unexpectedly exit during policy installation.

When the "Categorize HTTPS Websites" option is enabled and the global parameter "appi_urlf_ssl_cn_use_sni_without_validation" is set to true, a memory leak may occur.

CPView and the 'cpstat' command show different Application Control database versions. Refer to sk181186.

Loading a large Custom Intelligence feed may fail. Refer to sk181158.

When transferring many files, SMB traffic may freeze while scanned by Anti-Virus blade.

A memory leak may occur in the Security Gateway when a connection is not correctly released after the inspection.

Some websites may be unreachable when one of Threat Prevention Blades is in Hold mode.

The Security Gateway may fail to enforce certificate blacklisting.

It may not be possible to connect to the RDP application with SNX in Application mode. Refer to sk181155.

A Standby member may initiate FTP data connection, although it should be sent from the Active member. As a result, the connection is teminated. Refer to sk180531.

When interfaces disconnect/connect on both members at the same time, it may cause a failover.

When attempting to route packets to unresponsive hosts, the CPU utilization may be high.

In some scenarios, traffic may not pass through a Virtual System on a VSX Security Gateway when it originally came through a Virtual Switch and User Mode (UPPAK) was enabled.

When one of the multiple PIM neighbors goes down on the LAN,there may be outages in multicast traffic.

Traffic may be dropped when there are many OSPF routes of type 5.

An OIF entry may be missing when multiple downstream neighbors are present on a LAN. Refer to sk181354.

The traffic may be dropped, because the routes are sent but not installed to the routing table. The issue is related to IS-IS when running on P2P interfaces.

Policy installation may take a long time and fail with "Operation failed, install/uninstall has been improperly terminated.&CURRENTVERCMP *##MSG_IDENTIFY##".

Back connection does not function on the Statically NATed Office Mode address as expected.

The "Encryption Domain Per community" feature overrides the Encryption Domain for other communities. Refer to sk170857.

Potential VPN outage during policy installation.

The Security Gateway may send a wrong certificate to the MAB Portal during certificate authentication.

A low-severity security vulnerability may exist when establishing an HTTPS connection to the Security Gateway.

In some scenarios, the VSX Security Gateway may not set the MAC header correctly when sending traffic directly out of an interface on a Virtual Router.

In some scenarios, the VSX VSLS cluster cannot pass the traffic for up to twenty seconds after performing a failover and failback when User Mode (UPPAK) is enabled.

A memory leak may occur in the CPD process.

Vsx_util upgrade or downgrade validation fails on Virtual Systems where policy was never installed.

Incorrect Multi-Queue configuration when MDPS, VSX, or both are enabled. Refer to sk181249.

Snapshot fails when the unpartitioned disk size is greater than 1TB. Refer to sk181485.

The SNMPD process memory consumption may be high, which causes the process to become unresponsive.

Because of a rare race condition, AD scanners may get stuck in the initializing state with "ERROR ajp-nio2-127.0.0.1-8009-exec-96 - Failed to enumerate scanner instances for SF-DC2.mapro.cat, scanner instance788b7398-5a79-91fb-6f68-137813a5556e (UsmDSConfigResponder)java.lang.NumberFormatException".

After the Deploy New Endpoint push operation is successfully done, the list of target devices may change to "None". And it is not possible to delete this push operation manually, a "Sorry, we had an API issue during request" message is printed.

Some devices added to a Virtual Group from the SmartEndpoint Reporting tab do not receive the assigned policy.

The default policy configured in the Infinity Portal may not be exported with the new Endpoint Security client package.

Azure mapping may fail on Private Endpoint without network interfaces. In the cloud proxy logs, the "ERROR datacenter.scanner.DcScanner [scanner-Azure-XXX]: Error during scan - attempting to reconnect for scanner of [Azure] in domainYYY" messages are printed.

SIP agent implements a keep-alive mechanism against the RFC, making each message arrive with a different tag in the "From" header, which may increase the memory of the Security Gateway, and these messages may be dropped once they hit the limit defined (the "sim_max_reinvite" parameter).

In a Maestro Orchestrator environment, the "orch_stat -p" command may bring the "invalid literal for int() with base 10" error message.

Reboot may take a long time.

• If member ID 1 is removed and then re-added to the Security Group on the active site, while there are two or more active members, it may result in a matrix mismatch. This can potentially lead to traffic interruption until member ID 1 becomes active again.

• Similarly, installing Jumbo Hotfix Accumulator when member 1 is absent may result in the same behavior and Jumbo Hotfix Accumulator installation may be blocked.

In rare scenarios, when using "chassis_admin" command, the "asg_chassis_admin | "/opt/CPsmos-R81.20/bin/asg_chassis_admin: line 192: [[: |: syntax error: operand expected (error token is "|")" output may be printed. This is only cosmetic and does not prevent performing site failover.

Policy installation may cause traffic interruption on Maestro Security Group due to missing VLANs of a Virtual System in the configuration file.

In a Scalable Platform environment, when opening an IPS Packet Capture originated on a local member, the "Fetching in progress" error is displayed, and a "Capture file was not found on remote SGM" entry is printed in the log.