R81.20 Jumbo Hotfix Take 70

NEW:

• Added support for the Gaia API proxy with VSX to use Management API from both the Multi-Domain Security Management Server and the Security Management Server. Refer to Management API Reference.

• This release also resolves issues that occur when using Multi-Portal Blades with internally issued certificates and third-party certificates.

NEW: Added support for AWS Elastic Network Interfaces (ENIs). These ENIs can now be viewed and managed in SmartConsole, similar to how other supported Data Center objects are handled. The feature is disabled by default. Refer to R81.20 CloudGuard Controller Administration Guide > Supported Data Centers > CloudGuard Controller for Amazon Web Services (AWS).

UPDATE: Added an ability to configure the schedule for Compliance blade scans. This should prevent login issues during the scans. Refer to sk182033.

UPDATE: In the Change Report, updated some portions of the translated GUI.

UPDATE: Added the "SecureXL" filter to the "cpview -m -f" command, which allows to extract to Skyline all the information related to SecureXL drops. Refer to the Skyline Metrics Repository.

UPDATE: If inspection logging is configured, the "Inspect" log now displays the negotiated ciphers and TLS version used for successful inspections, both between the client and the Security Gateway, and between the Security Gateway and the Server.

UPDATE: The DOS/Rate Limiting feature can now run in SecureXL User Mode (UPPAK) environments without a Light Speed, allowing IoC Feeds that use it for enforcement to function properly.

UPDATE: jQuery UI is upgraded to version 1.13.2.

UPDATE: Added support for Data Centers in AWS ca-west-1 Calgary region.

UPDATE: Added Multi-Queue support for Microsoft Azure Network Adapter (MANA) accelerated network interfaces.

UPDATE: New features and improvements are released in Take 100, Take 102, Take 104 and Take 111 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 34 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

When a Domain object in a policy is set with a backslash in the suffix, policy installation fails with the "Unterminated string&CURRENTVERCMP" error.

Deleting a domain may fail when using the createDomainRecovery.sh script.

In rare scenarios, Global Policy assignment fails when there are many open Remote CPM Server sessions. Refer to sk181822.

There may be synchronization failure and, as a result, corrupted Domain policies on the Multi-Domain Security Server when a newly created local administrator on the backup Security Management Server makes changes to rules or objects, after the Active role is switched to that Security Management Server.

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit or not start, creating a core dump file.

In some scenarios, policy installation may fail and the displayed message erroneously refers to sk178886: "One of the updatable objects was downloaded incorrectly (see SK178886". sk178886 describes a different scenario and does not resolve the issue.

Changes Report may allow to list certain directory contents.

In some scenarios, when searching objects in SmartConsole, not all relevant results are highlighted.

In Multi-Domain Security Management environments, High Availability synchronization issues may arise after making and publishing changes through the SmartTasks feature in SmartConsole for a local Domain.

In rare scenarios, after an upgrade or a Domain migration:

• Policy installation might fail with "ERROR: Duplicate keys xxxxxxxx in table 'gw_properties".

• DAIP Gateway objects will have duplicate IP addresses.

  Refer to sk181834.

The revisions purge process may get stuck due to an incomplete purge operation from a previous attempt.

Enabling automatic updates of Trusted CAs as described in sk173629 may fail.

In some scenarios, SmartConsole may close unexpectedly when clicking the "View Changes" option in the Install Policy view.

In rare scenarios, High Availability synchronization fails with "Peer is busy".

The "set-smart-task" API command fails when enabling the "Send mail to/from" option in SmartTasks.

In Multi-Domain Security Management environments with over two hundred administrators, Domain creation may fail with "Timeout expired while waiting for permissions calculation".

In a Multi-Domain Security Management environment, the "show simple-gateway" and "show simple-cluster" Management API commands may fail with "Runtime error: An internal error has occurred"

The "cprlic get" command output may not provide correct information about vSEC licenses.

SmartConsole slowness when adding applications to rules. Refer to sk182063.

The Management API command "set-lsm-gateway" with the "sic.ip-address" parameter may fail with "Establish SIC failed. Reset SIC on gateway and try again." when resetting SIC.

When Identity Awareness blade is enabled, the "Src User Dn" and "Dst User Dn" fields in ICMP Logs are not masked for users without "Identities" permissions. Refer to sk181677.

In Quantum Smart-1 Cloud environments, exporting more than five thousand logs to CSV may fail.

In rare scenarios, the FWD process on the Security Gateway may reach out of memory and produce a core dump file of around 3GB.

The "cpstat -h log server ip ls -f logging" command fails when running it from Security Management.

Running GTP traffic may cause a crash on a Security Gateway without a GTP license.

There may be log entries related to the drop optimization feature, although the dropped traffic matches a non-logging rule.

The ICAP Server does not send data for the Threat Prevention blades inspection, after the restart of the TEMAIN process.

Traffic outages may occur because of high utilization of CPU cores that run CoreXL SND instances. Refer to sk181996.

A rare race condition may be triggered by the timing and packet patterns of VoIP traffic, and, as a result, the FWK process may restart.

After deploying a new license to a Multi-Domain Log Module (MLM), all Customer Log Modules (CLMs) generate alert logs about missing license/contracts stating "No valid license was found".

In rare scenarios, a file downloaded via HTTP may be corrupted.

When using three or more ISP DNS proxies in High Availability mode and Load Sharing mode:

• A DNS query to any ISP returns IP addresses of all three, although it should return only the active ISP.

• When one ISP is down, the faulty ISP is also returned instead of the newly active.

In a rare scenario, because of a memory allocation issue, the Security Gateway may crash and reboot.

In some scenarios, if a rule with a security zone is installed using accelerated install policy, the traffic may stop matching the NAT Rule Base.

The Security Gateway may crash during policy installation.

Sporadic latency while uploading a file when HTTPS Inspection and ICAP client are active. Refer to sk181793.

After installing a hotfix in a cluster setup with a Threat Prevention policy that includes Network Objects, a member may get stuck during initialization after a reboot. Refer to sk180225.

In a bond failover setup with the XOR bond mode, rapid toggling the port states causes the switch to display incorrect "connected" port statuses for both ports, despite one port being actually down, leading to a non-functioning bond interface.

The "ioc_feeds" CLI command with the "--transport local_directory" argument may fail to load feeds.

When a Multi-User Host is used with Identity Broker, the user session may expire on the PEP side, while still connected on the PDP, causing failure of user-based access.

After an upgrade, the Security Identifier (SID) for LDAP Users or LDAP Groups that were configured prior to the upgrade may be empty. Refer to sk181946.

During policy installation, users authenticated using the Captive Portal may get disconnected.

In a Cluster Load Sharing environment or when a single Policy Decision Point (PDP) is shared among multiple Policy Enforcement Points (PEPs), the PDP registers the PEP, but the PEP may not be aware of this registration.

There may be excessive "fwconn_chain_is_data_conn failed" messages in the /var/log/messages files when activating the IPS Blade.

In a rare scenario, the Security Gateway crashes due to memory corruption caused by the Anti-Virus blade.

SSL Network Extender (SNX) cannot connect after installing Jumbo Hotfix Accumulator. Refer to sk181805.

See the Important Notes section.

The Security Gateway may crash during the conversion from VRRP Cluster to ClusterXL Cluster.

The Security Gateway may fail to add interfaces to the SecureXL accelerated interfaces list.

In some scenarios, the VSX Security Gateway may not set the MAC header correctly when sending traffic directly out of an interface on a Virtual Router or Virtual Switch.

There may be a delay in enforcing DOS/ Rate Limiting rules to drop packets when concurrent connection limits are exceeded.

In some scenarios when Route based probing is configured, the VSX Security Gateway sends out encrypted traffic with a source IP address of all zeroes through a Virtual Switch interface. This traffic may be dropped by routers, the VPN peer Gateway or other Security Gateways due to the invalid source IP address.

Entering Maintenance Mode during the boot process may result in disabling SecureXL User Mode (UPPAK).

When SecureXL User Mode (UPPAK) is enabled, there may be some increased latency when sending cleartext traffic between a Virtual System and a Virtual Router.

DOS/Rate Limiting commands that require a change from default configuration are not allowed to run in SecureXL User Mode (UPPAK) . "ERROR: fwaccel_dos: DOS features are not supported for SecureXL User Space Mode with LightSpeed" is printed in the /var/log/messages file.

ROUTED process assert failure may take place when LSA from a neighbor's retransmission list is freed if that LSA belongs to the max age hold tree that is flooded at max age.

BGP peers may experience timeouts when these conditions occur simultaneously:

• The network has more than 100 BGP peers configured,

• The routing table contains tens of thousands of routes,

• BGP tracing is enabled,

• The BGP timers (such as keepalive and hold timers) are reduced from their default values, making the peers more sensitive to delays or congestion.

Cluster failover may occur when the ROUTED process due to a memory leak unexpectedly exits with a core dump file generated.

It may not be possible to propagate a newly added static route through OSPF.

In rare scenarios, when a PIM interface or PIM instance stops working, the Security Gateway may crash if trying to access a bogus reference to a PIM neighbor.

Establishing an IKEv2 tunnel with Cross AZ Cluster may fail.

In a rare scenario, while connecting SNX client, the VPND process may exit.

In Cross-AZ clusters, when using probing-based link selection for High Availability and Load Sharing, there may be a potential VPN traffic outage. Refer to sk181909.

When the DAIP Gateway public IP address occasionally changes, the connected Security Gateway fails to update the new IP address and continues responding to the old IP address, causing communication issues.

When adding a new Virtual System, a CPD core dump file may be generated.

The MONITORD daemon causes high CPU after 388 days of uptime. Refer to sk181922.

In rare scenarios, the Gaia Portal daemon HTTPD may unexpectedly exit and create a core dump file in the /var/log/dump/usermode/ directory.

Removing unused built-in user called "cp_ender" that may appear in Gaia OS after an upgrade. Refer to sk182185.

In an on-premises environment, large Active Directory groups with more than 1500 members appear empty or have incomplete membership information.

In some scenarios, Unified Endpoint Policy Management (UEPM) database upgrade fails or takes a long time during the scripts stage.

SmartEndpoint creates an empty "Policy Report" CSV file.

CloudGuard Controller synchronizes cloud object configurations with a noticeable latency, reflecting the updates made to those objects in the cloud environment after a significant time delay.

Excessive CPU usage occurs on a Maestro Security Group because of exhaustion of available NAT ports when traffic is subjected to NAT and Layer 4 (L4) load distribution is enabled. Refer to sk181925.

After a failover scenario, the "m site-id member-id" command requires reauthentication.

When running the "fwaccel stat" command on a VSX Security Gateway, the output may show physical interfaces as not accelerated, although they are.

Member state may flap between Active and Ready.

In a rare scenario, file system corruption may lead to a failure identifying the Maestro Orchestrator hardware model during the Maestro Orchestrator OS boot process, causing the boot to fail.

An additional reboot may be performed on Maestro Security Gateway because of the database entry (otlp) which should not be pulled from SMO. This entry is updated locally on each member via self-update functionality and therefore may differ between members.

In a rare scenario, when a Maestro Security Gateway is active again after a reboot, and LightSpeed is used, the LACP bond may drop incoming and outgoing packets.