R81.20 Jumbo Hotfix Take 96

NEW: The "show nat-rule" and "show nat-rulebase" Management API commands now support displaying hit count data with optional date range filtering through the "show-hits true" parameter, allowing users to retrieve hit statistics for NAT rules with flexible time-based querying in JSON format.

Syntax examples:

• mgmt_cli show nat-rule rule-number 1 show-hits true package "standard" --format json

• mgmt_cli show nat-rulebase offset 0 limit 20 details-level "standard" use-object-dictionary true package "standard" show-hits true --format json

• mgmt_cli show nat-rule rule-number 1 show-hits true package "standard" hits-settings.from-date "2014-01-01" hits-settings.to-date "2014-12-31T23:59" --format json

NEW: Added Two-Factor Authentication (2FA) support for Gaia OS login using time-based authenticator apps from Google and Microsoft. Refer to sk181854.

NEW: Added new OID (1.3.6.1.4.1.2620.1.38.55) to monitor the Identity Collector connection status in the $CPDIR/lib/snmp/chkpnt.mib file.

• This capability is supported for Identity Collector agents running with version R82.120.0000 or higher.

UPDATE: The Management API command "set-https-rule" now automatically sets the negative value to "false" when modifying the destination, source, service, or site-category fields, regardless of its previous setting.

UPDATE: Improved Log Sharing functionality in the Infinity Portal, focusing on core stability and log status accuracy and detail level.

UPDATE: SD-WAN is now supported when SecureXL User Space Mode (UPPAK) is enabled.

UPDATE: Maestro Orchestrator WebUI now previews topology changes and summary before applying, improved the error handling.

UPDATE: New features and improvements are released in Take 124 via self-updatable package. Refer to sk170314.

In some scenarios, the webservices_cmas_ports.conf file is not updated after Domain deletion from the Multi-Domain Security Management Server, and contains ports of deleted Domains.

The on-premises Security Management Server with a proxy address configured may fail to connect to the Infinity Portal.

When the Security Management has an additional NAT configuration in the SD-WAN policy (Infinity Portal), an indicating banner may not appear in SmartConsole NAT Rule Base. This is a cosmetic issue.

• Requires R81.20 SmartConsole Build 661 or higher.

In rare scenarios, in Multi-Domain Security Management environments, login to Smart Console fails.

The server.log file of the ICAP Server is filled with "Failed to scan web object" entries. This is a cosmetic issue.

In a rare scenario, when multiple Elephant Flows are running in parallel in the accelerated pipelining path, there may be high CPU utilization. Refer to sk183007.

When using HTTP/2 through a proxy, the Security Gateway may incorrectly add carriage return and newline characters (\r\n) to the X-Forwarded-For (XFF) header. This causes the header to become invalid and results in a connection failure. This issue only occurs when the Gateway is configured as a proxy.

Security Gateway with QoS enabled may crash because of a rare race condition.

In a star community topology, SD-WAN overlay traffic connectivity may be disrupted due to unexpected routing and encryption configurations.

In some scenarios, when SD-WAN policy is enabled, open connections are not routed according to the SD-WAN decision.

In a rare scenario, Anti-Virus blade prevents benign traffic due to improper parsing of URL observables in IoC feeds. Refer to sk181519.

IDA Captive Portal may not be available after Jumbo Hotfix Accumulator installation or after an upgrade using the Blink image. Refer to sk172324.

In rare scenarios:

• The PDPD process may become unresponsive during termination.

• PDP to PEP Identity synchronization fails on the PEP side when Identity Sharing is configured with PUSH Identity Sharing.

Refer to sk182613.

A memory leak may occur in the SIM process when using DOS/Rate Limiting rules.

In some scenarios, after an update of the OS route configuration, there may be a significant delay in traffic passing through the Security Gateway when SecureXL works in the User space (UPPAK) mode. Refer to sk182740.

SW RAID (RAID-1) fails to resynchronize after formatting one of the SSD drives. This is applicable for these appliances: 15400,15600, 5900, 6800, 16000, 16000T, 26000, 26000T, 6900, 7000, 16200, 28000, QLS250, QLS450, QLS650, QLS800, MLS200, MLS400.

There is no audio during the first 5 seconds of each VoIP call. Refer to sk182730.

The IKED daemon may exit during IKEv2 negotiation of SD-WAN with a DAIP peer.

An ECDH object may be deleted before its associated event is completed processing.

After a Jumbo Hotfix upgrade, the Mail Transfer Agent may fail on all Virtual Systems except one.

See the Critical Information section.

During the Jumbo Hotfix Accumulator installation on an R81.20 Security Gateway or when adding a new Security Gateway to the environment, the member's state may experience intermittent flapping.

A Maestro Security Group Member may fail to initialize after enabling IPv6 and is stuck with pull_config pnote.