R81.20 Jumbo Hotfix Take 89

NEW: Added a new "show-statuses" boolean parameter to the "show lsm-gateway" and "show lsm-cluster" Management API commands. When set to "true", this parameter displays the Security Policy and Provisioning Settings statuses for the LSM Security Gateway or Cluster.

NEW: Added support for these features in Maestro Security Groups:

• SecureXL User Space (UPPAK) mode. Refer to sk153832.

• Hardware Acceleration in Acceleration cards. Refer to sk179432.

Applies only to these appliance models:

• Quantum Force 29100, 29200

• Quantum Force 19100, 19200

• Quantum Force 9700, 9800

• Quantum LightSpeed QLS250, QLS450

• Quantum LightSpeed MLS200, MLS400

UPDATE: When Security Management disconnects from the cloud via the Infinity Services tab in SmartConsole, agents now automatically disconnect as well. Refer to sk180557.

UPDATE: Resolved CVE-2024-3596 - Blast-RADIUS attacks for Gaia Portal and Gaia Clish. Refer to sk182516.

UPDATE: Port 8211 now accepts connections with the cipher ECDHE_RSA_AES_256_GCM_SHA384.

UPDATE: Added a log for connections rejected because of short Server certificate public key size (RSA 1024 bits or less, ECDSA 256 bits or less).

UPDATE: It is now possible to add more than fourteen members per site in a Single Site topology.

In rare scenarios, an upgrade of a Multi-Domain Security Management Server fails with "Cancelled due to a failure in other domain" in the upgrade report.

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or via the Advanced Upgrade method.

In rare scenarios, login to SmartConsole fails with a timeout.

If any single Data Center fails to register, the registration of all Data Center assets to the Security Management Server also fails.

In rare scenarios, the Revisions tab in SmartConsole shows "Error retrieving results".

SmartConsole may close during login because of repeated attempts to discard a non-existent work session.

Accelerated Policy installation may get stuck with the "Policy installation (queued)" status.

In a Management High Availability environment, the Standby Security Management Server may not update the "Installation date" during policy installation on Security Gateways/Clusters.

Log queries fail with the error "Problems have occurred during search" when Domain migration is in progress. This occurs specifically during the execution of "export-management" or "import-management" Management API commands.

In a rare scenario, when running the CPView utility, the Security Gateway may crash.

In rare scenarios, the Logs view may display unexpected blank lines or gaps in the chronological sequence of entries.

RAD error messages may be printed to the fwk.elg file during cpstop:cpstart on the Security Gateway. The issue is cosmetic only.

The "show logs" Management API command may show partial information for the fields with multiple values.

In a VSX Cluster environment, the CPVIEWD daemon may cause a high CPU.

During policy installation, Rule Base internal error drops may be shown in the SmartConsole logs. Logs related to "dynobjs" may be printed in Messages.

The Security Gateway may fail to resolve external Network Feeds whose URL contains a port number (such as "https://example.com:8080/feed.csv". Refer to sk182684.

In a Maestro Security Group using VSX mode with diverse appliance models and active dynamic balancing, DSD pnotes may appear on member devices and cause a failover from an SMO member. This occurs when the default number of FWK instances on these members differs from the SMO default setting.

In some scenarios, an external IoC may not be enforced on Sub-domains of a Domain that is listed in the feed.

In a rare scenario, Threat Prevention policy installation may fail after an over-the-air (OTA) package update of TP_CONF_SERVICE. Refer to sk182572.

The ICAP client may send the file name under "Content-Disposition" in an unsupported format written as "filename*=" instead of "filename=", and the Threat Emulation blade does not process such files.

In a rare scenario, the PDPD process on Security Gateway with configured Identity Broker may become unresponsive while processing identity updates. Refer to sk182635.

APPI tenant restriction may not function as expected when the application is not included in the policy or when no extended logging is enabled.

The Anti-Bot Blade may generate error logs with the "Failed to Decrypt CP Site Response" reason. Refer to sk182494.

The "citrixStrictTicketEnforcement" parameter set in the configuration file may not work as expected.

The Security Gateway may crash in Bridge mode or in Non-Bridge mode when the number of MAC addresses in its network interface card's table exceeds the hardware capacity limit.

After installation with Gaia Fast Deployment (Blink), SecureXL User Mode (UPPAK) becomes disabled.

SYN Defender configuration in Inspection Settings on the Security Management Server may not be applied on Accelerated Policy installation.

A multicast outage may occur after a failover triggered by incomplete processing of cluster synchronization messages.

A multicast outage may occur during failovers caused by interface flaps.

By default, the VPN permanent tunnel is configured to use "tunnel test" instead of "DPD". This configuration may cause inaccurate permanent tunnel status reporting when connecting to third-party devices.

Memory corruption occurs when a bond interface is configured, leading to a Security Gateway crash with a vmcore or a boot loop.

In Quantum Maestro/Scalable Chassis environments, when using the Threat Prevention Blade in the Security Group, the entitlement_status_collector_db.C files may be inconsistent between the Security Group Members.