R81.20 Jumbo Hotfix Take 115

Take 115 - New Functionality

PRJ-60278,

PMTR-114156

Application Control

NEW: This Take introduces the Dynamic URL List feature is an enhancement to the Custom Applications / Sites object (sk165094), allowing to maintain a dynamic list of URLs based on a feed file.

Refer to R81.20 Security Management Administration Guide > Topic "Creating Application Control and URL Filtering Rules".

PRJ-60071,

FMW-4386

Scalable Platforms

NEW: Added support for SecureXL User Space (UPPAK) mode on Check Point Firewall 9400 appliances in the Maestro configuration. Refer to sk179432.

Take 115 - Improvements and Resolved Issues

PRJ-63339,

PRHF-41560

HTTPS Inspection,

VPN

UPDATE: Updated CRL and OCSP validation in Remote Access VPN, Site-to-Site VPN, and HTTPS Inspection to use HTTP/1.1 instead of HTTP/1.0. This ensures continued compatibility with DigiCert's updated requirements and prevents certificate validation failures. Refer to sk183884.

PRJ-63089,

PMTR-116712

Security Management

UPDATE: Added a new Gaia Clish command "cplic ignore_expired_ngtx 1" that allows administrators to disable license status monitoring for expired Next Generation Threat Extraction (NGTX) licenses in SmartConsole. Run this command on each Cluster Member or Virtual System that reports an error and restart the services with the "cpstop;cpstart" commands.

PRJ-59692,

MGMTPROD-1385

Security Management

UPDATE: In SmartConsole and Management API, Access and NAT Policies now support Rule Base search for hitcount values.

PRJ-61671,

PMTR-89079

Security Management

UPDATE: Improved the "fw tab" CLI command help by adding descriptive explanations for each option.

PRJ-62307,

PMTR-117039

Security Management

UPDATE: Added the "show-only-local-domain" field to API queries to return only objects from the current local Domain.

PRJ-59692,

MGMTPROD-1385

Security Management

UPDATE: In SmartConsole and Management API, Access and NAT Policies now support Rule Base search for hitcount values.

PRJ-59284,

PRHF-38115

Security Management

UPDATE: JRE is updated from version 8.0_8.26 to version 8.0_8.35.

PRJ-61285,

PRHF-39744

Security Management

UPDATE: The upgrade duration for the Security Management Server and Multi-Domain Security Management Server has been reduced by up to 60%.

• The fix will only be applied if the upgrade to R81.20 Jumbo Hotfix Accumulator Take 115 or higher is done using a Blink image or the Advanced Upgrade method.

PRJ-60363,

PMTR-114192

Security Management

UPDATE: Updated the output of the Gaia Clish command "show asset" with the correct details for the CPAC-4-10/25F-DA acceleration card.

PRJ-62453,

MGMTPROD-1952

Security Management

UPDATE: Added new Management API commands to configure synchronization with User Center: "show sync-with-user-center" and "set sync-with-user-center" which was previously only configurable through the SmartConsole GUI. Refer to sk94064.

PRJ-62156,

PMTR-116839

Logging

UPDATE: Extended the "show logs" API to support Infinity Copilot queries in on-premises logs.

PRJ-61188,

FMW-3427

URL Filtering

UPDATE: URL Filtering now provides better categorization for non-inspected HTTPS connections by proactively re-validating certificates before the Categorize-HTTPS cache entry expires.

PRJ-61815,

PRHF-20323

VPN

UPDATE: Modified the default behavior of the legacy Policy Server daemon (DTPSD). By default, this daemon now starts in the "DOWN" state unless explicitly configured otherwise. Refer to sk183803.

PRJ-54573,

PRHF-33808

Gaia OS

UPDATE: In the Gaia Portal, improved the text of the warning displayed when removing permissions from a user in the Gaia Portal.

PRJ-61641,

PMTR-115412

Gaia OS

UPDATE: In the Gaia Portal login, added support for the period character (".") in RADIUS and TACACS usernames. This feature is disabled by default. Refer to sk183201.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-62422,

VSECPC-10838

CloudGuard Network

UPDATE: Added support for GCP NSI (Google Cloud Platform Network Security Integration) solution.

PRJ-59471,

PMTR-109854

Scalable Platforms

UPDATE: Added option to use the local IP address 127.0.0.1 for license creation for Maestro Security Group members.

PRJ-61787,

PMTR-101696

Scalable Platforms

UPDATE: CPView now monitors the Maestro backplane interfaces, Sync, and Chassis Internal Network (CIN) interfaces.

PRJ-62939,

ODU-2936

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 147 via self-updatable package. Refer to sk170314.

PRJ-63159,

ODU-2706

Automatic Updates - Log Exporter

UPDATE: Added Take 44 to Log Exporter Auto Update Deployment. Refer to sk182866.

PRJ-62738,

ODU-2594

Automatic Updates - Threat Prevention

UPDATE: Added Update 26 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

PRJ-63264,

ODU-2952

Automatic Updates - HCP

UPDATE: Added Update 23 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-62941,

ODU-2928,

PRJ-63334,

ODU-3024

Automatic Updates - Policy Insights

UPDATE: Added Take 72 and Take 74 of Policy Insights Release Updates. Refer to sk183421.

PRJ-63337,

ODU-2960

Automatic Updates - Scalable Platforms

UPDATE: Added Take 18 of Scalable Platforms (Maestro and Chassis) Release Updates. Refer to sk183156.

PRJ-60012,

PMTR-114030

Security Management

In rare scenarios, policy installation may get stuck at 99%.

PRJ-61586,

PRHF-37905

Security Management

Access Control policy installation may take a long time when updatable objects are used in the policy.

PRJ-61289,

PRHF-39256

Security Management

In rare scenarios, login to the Security Management Server may fail with a timeout.

PRJ-61292,

PRHF-39777

Security Management

The $MDS_FWDIR/log/ directory may contain multiple api_status_UUID.json files.

PRJ-62022,

PRHF-40184

Security Management

In SmartConsole, deleting a license in the Licenses tab of a Security Cluster object fails with the "Domain Management Server licenses cannot be removed from the Domain Management Server level" error.

PRJ-59090,

PRHF-37685

Security Management

Administrators with LSM write permissions cannot delete LSM Gateway objects without also having write permissions for Others/Common Objects.

PRJ-57082,

PRHF-36096

Security Management

In some scenarios, the PostgreSQL database fully utilizes disk space on the Security Management Server.

PRJ-59084,

PRHF-37999

Security Management

Policy installation is delayed because of the FWM process load. Refer to sk183563.

PRJ-59927,

PRHF-38237

Security Management

In some scenarios, the Changes Report is not attached to the email sent by the SmartTask configured with the "After Publish" trigger and the "Send Mail" action.

PRJ-61321,

PRHF-39817

Security Management

Reassigning Global Policy takes a few hours after updating IPS Snort protections.

PRJ-63371,

PRHF-41564

Security Management

Backup file size on the Security Management Server grows after an upgrade. Refer to sk183835.

See Critical Information for R81.20 Jumbo Hotfix Accumulator

PRJ-62183,

PMTR-116869

Security Management

SAML authentication fails for Web SmartConsole on port 4434, redirecting to an invalid URL (https://localhost:4434:4434/smartconsole/transport) and preventing SSO login, while SmartConsole GUI authentication works normally.

PRJ-61668,

PRHF-39885

Security Management

In some scenarios, SmartConsole disconnects when installing policy if there are 50 installation targets or more.

PRJ-59665,

PRHF-37860

Security Management

Compliance scan finishes successfully but does not show any data in SmartConsole.

PRJ-62232,

MGMTPROD-436

Security Management

The Management API command "set-access-rule" returns the error "You must enable the Granularity option 'Session' for the Track option 'Log' if the rule specifies an application or a Contact Type" when adding an application to an Access Control rule with "service" set to "none" and "track" set to "log".

PRJ-57313,

PRHF-36228

Security Management

In some scenarios, the Management API command "where-used" with "details-level" set to "full" may fail with a "generic_internal_error" message, if the queried object is part of a Threat Prevention Exception Group.

PRJ-62092,

PRHF-40268

Security Management

In SmartConsole, when viewing the License tab of a Security Gateway object, multiple duplicated VSEC licenses with the same signature may be shown.

PRJ-60677,

PMTR-114726

Security Management

The Management API commands "add-lsm-gateway" or "add-lsm-cluster" may report success even when IKE certificate creation fails.

PRJ-61532,

PRHF-39869

Security Management

In the Compliance view, when clicking the picker in the "Source" or "Destination" columns while creating a custom Firewall Best Practice, the network objects list shows "Loading" and loads slowly.

PRJ-60213,

PRHF-38893

Multi-Domain Security Management

In rare cases, Security Gateway licenses are not displayed in SmartUpdate when connected at the Multi-Domain Security Management level, despite being visible at the Domain level.

PRJ-62128,

PRHF-26970

Multi-Domain Security Management

Running the "mds_backup" command with the "-v" flag may fail with "setenv: Too many arguments" error.

PRJ-61929,

PMTR-105087

Logging

In some scenarios, exporting logs to a CSV file at the Multi-Domain Security Management level generates an incomplete file with empty lines, and a log_indexer core dump may be found on the Server.

PRJ-59193,

PRHF-38042

Logging

When viewing certain reports in SmartView, the "No data found" error may appear even when matching logs exist.

PRJ-58761,

PRHF-37638

Security Gateway

Incorrect bonds may be shown in the Data Plane when using MDPS and running the Gaia Clish command "show configuration bonding".

PRJ-60753,

PRHF-39368

Security Gateway

Non-HTTP connections may be incorrectly dropped because of a missing Host header when the Gateway operates as a proxy.

PRJ-61908,

PMTR-116366

Security Gateway

Missing cleanup when template connection creation fails prevents the system from exiting new connection context mode, causing subsequent connection operations to write incorrectly to the cache instead of the connection table.

PRJ-60899,

PRHF-39414

Security Gateway

Traffic is dropped with a"Matched Optimized Drop" message, although it is allowed by configurations in the Rule Base. Refer to sk183443.

PRJ-61059,

FMW-4633

Security Gateway

VSEC licenses may be automatically deleted and re-added on the Security Management Server (SmartCenter in Azure), creating duplicate license strings with mismatched signatures and causing intermittent "License with CK already exists" errors.

PRJ-61864,

PRHF-40249

Security Gateway

In rare scenarios, the WSDNS daemon may exit instead of shutting down gracefully.

PRJ-57281,

PRHF-36273

Security Gateway

The $CPDIR/bin/update_license_conf script incorrectly parses the allowed cores count, setting "ALLOWED_CORES=-1" and causing Check Point Virtual Machine system corruption and daemon failures when CPU increases.

PRJ-62106,

PRHF-40509

Security Gateway

The Clone Policy Package task in SmartConsole fails with the "The object name must not contain whitespace characters at the beginning or the end" error. Refer to sk161294.

PRJ-60756,

PMTR-114362

Security Gateway

In rare scenarios, the local connection route may be incorrect when the ICAP client is active.

PRJ-55960,

PMTR-105446

Security Gateway

Maestro Security Group Member status frequently changes to "Down". The $FWDIR/log/fwk.elg file contains the error "h_iterate: invalid return value from callback". Refer to sk184887.

PRJ-59649,

PMTR-116831

Security Gateway

In rare scenarios, the FWK process may unexpectedly exit when stopping the Security Gateway with the "cpstop" command while a packet capture tool is running.

PRJ-51593,

PRHF-31491

Security Gateway

Unexpected cluster flapping may occur during signature load.

PRJ-62120,

PRHF-40597

Security Gateway

The SAML authentication flow may fail on a VSX Gateway.

PRJ-61362

Security Gateway

The Security Gateway may not be stable, and the error is printed in logs "Error: Timeout waiting for response from database server. BUG: soft lock - CPU#XX stuck for XXs". Refer to sk184554.

PRJ-62372,

PMTR-117120

Security Gateway

The Security Gateway may crash when checking if a local outbound packet's interface is excluded from outbound traffic processing while SecureXL User Mode (UPPAK) is enabled.

PRJ-61011,

PRHF-39339

Security Gateway

After upgrading the Security Gateway to R81.20 Jumbo Hotfix Accumulator Take 92, Remote Access IPSec VPN connections using Endpoint Security VPN E88.60 fail. Authentication succeeds, but all client connections through the Security Gateway are dropped by the Cleanup Rule.

PRJ-61488,

PRHF-39983

Security Gateway

In a rare scenario, the FWK process may restart unexpectedly.

PRJ-61052,

PRHF-39655

Security Gateway

After a system restarts (for example, reboot or cprestart), FWD-related sub-processes such as VPND and PDP may not run. Refer to sk183446.

PRJ-47010,

PRHF-28783

Content Awareness

Disk space may not be cleared as expected when Content Awareness is the only enabled Software Blade.

PRJ-62791,

PMTR-115931

URL Filtering

The FW_FULL process may exit in the Dynamic URLs list update flow.

PRJ-62256,

PMTR-116639

URL Filtering

In rare scenarios, the FWK process may crash when the URL Filtering Software Blade is enabled.

PRJ-62442,

PRHF-40727

IPS

Security Gateway blocks the download of files larger than 4 GB with the log "Application Control - HTTP parsing error occurred" in SmartConsole. Refer to sk183681.

PRJ-60270,

PMTR-113602

DLP

A potential memory leak because of many DLP/FILE_CONVERT processes spawned.

PRJ-57444,

PRHF-36348

ClusterXL

Virtual System in a VSX VSLS Cluster does not fail over when a cluster interface goes down. Refer to sk182734.

PRJ-62144,

PMTR-116446

SecureXL

After an upgrade, the USIM process may exit.

PRJ-63033,

PRHF-41230

SecureXL

When there are a large number of SNDs operating with Intel NICs, the system may run low on available jumbo mbufs, leading to connectivity issues. Refer to sk183771.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-62690,

PMTR-117113

SecureXL

When the Security Gateway runs in User Mode SecureXL (UPPAK), removing a VLAN impacts connectivity on other VLANs in Bridge mode that share the same physical interface.

PRJ-59179,

PRHF-37771

Routing

The multicast stream may not resolve correctly in VSX topologies. Packets are dropped with the "IP multicast routing failed (missing OS route)" message.

PRJ-59304,

PMTR-111436

VPN

IKE related core files may be generated when passing traffic through a VPN tunnel.

PRJ-60074,

AAD-5014

VPN

Rare VPN connectivity issues caused by Encryption Domain overrides in communities with third-party Gateways.

PRJ-61968,

PRHF-40481

VPN

The VPND or IKED daemon may exit during IKEv2 negotiation.

PRJ-59921,

PRHF-38669

Gaia OS

In rare scenarios, users may be disconnected from SmartConsole, and an FWM process core dump is generated.

PRJ-61755,

PMTR-115846

Gaia OS

Traffic routing may fail between the host and PPPoE / DNS Server through the Security Gateway, even though host-to-gateway and gateway-to-DNS connections work as expected.

PRJ-61813,

PRHF-40409

Gaia OS

SNMP Agent may report a wrong value for VLAN Interface Speed.

PRJ-59656,

PRHF-38449

Gaia OS

The 1.3.6.1.4.1.2620.1.6.7.5.1.5 SNMP OID (multiProcUsage) reports wrong values when HyperFlow is enabled.

PRJ-61193,

PRJ-61194

Gaia OS

The output of "cppcap" command (sk141412) with the "-i" flag prints "Failed to capture X packets".

PRJ-62383,

PRHF-40893

Gaia OS

SNMP data types in the "asg" MIB tree (for Scalable Platform Security Groups) may be incorrect.

PRJ-62115,

PRHF-40601

Gaia OS

Backup retention policy on Maestro may be performed only on SMO and skip a Security Group member.

PRJ-58020,

PRHF-36770

Gaia OS

Backup may fail when using some special characters in the Remote Security Manager Server password.

PRJ-61592,

PRHF-40115

Gaia OS

• The sysLocation OID (1.3.6.1.2.1.1.6.0) returns "UNKNOWN", even though the value is configured in the SNMP settings and exists in the Gaia database (/config/active).

• When editing sysLocation or sysContact using the SNMP configuration interface, the Gaia database is updated, but the SNMP configuration file is not updated.

PRJ-62221,

PRHF-40517

CloudGuard Network

If the User Center connection fails, contracts may be retrieved incorrectly, resulting in erroneous contracts getting pushed to the Security Gateway.

PRJ-61979,

PRHF-40203

CloudGuard Network

Changes made to the JSON file of a Generic Data Center object may take a long time to appear in SmartConsole or the Management API, although enforcement on the Security Gateway functions as expected.

PRJ-59779,

PMTR-111817

Scalable Platforms

Policy installation may fail on newly added Security Group members because an updatable object package is missing.

PRJ-60102,

PRHF-38839

Scalable Platforms

The "g_perf" command fails with both IPv4 and IPv6 data on the Maestro Security Group when IPv6 is enabled.

PRJ-61344,

PRHF-39863

Scalable Platforms

The "asg diag verify" command reports inconsistent OSPFv3 routes on Maestro Security Group Members. Refer to sk179931.

PRJ-62537,

PMTR-117435

Scalable Platforms

The CPVIEWD daemon may exit on a VSX Gateway.

PRJ-62573,

PMTR-117483

Scalable Platforms

Security Group members changing from ACTIVE state to READY state may cause traffic impact.

PRJ-59055,

PRHF-37439

Carrier Security

The Security Gateway may crash after dropping corrupt GTP-C (control traffic) packets.