R81.20 Jumbo Hotfix Take 119

Take 119 - New Functionality

PRJ-62667,

PMTR-116161

Gaia OS

NEW: Hardened the authentication in the Gaia Cloning Group.

Important - After the installation of this Jumbo Hotfix Accumulator Take, you must follow these steps in each current Cloning Group:

1. Make sure this Jumbo Hotfix Accumulator Take is installed on each Cloning Group Member

2. On each of the Cloning Group Members, enter a Cloning Group password - enter the current password again or a new password.

3. On each Cloning Group Member, re-synchronize the Cloning Group.

For more information, see the Gaia Administration Guide > Chapter "System Management" > Section "Cloning Group".

PRJ-62142,

PMTR-116780

CPView

NEW: Added the new Skyline metric "system.traffic.templates". Refer to the Skyline Administration Guide > Skyline Metrics Repository > System > Traffic.

Take 119 - Improvements and Resolved Issues

PRJ-63002,

PMTR-117744

Gaia OS

UPDATE: Check Point response to CVE-2025-32728 - The SSH directive "DisableForwarding" fails to disable "X11 Forwarding" and "Agent Forwarding". Refer to sk183394.

PRJ-59093,

PRHF-37840

Security Management

UPDATE: It is possible now to run the Management API command "show-packages" asynchronously using the "async-response" parameter.

PRJ-62340,

PMTR-115295

CPUSE

UPDATE: Added an HCP test to check whether the CPAC-2-100/25F, CPAC-2-100/25F-B, CPAC-2-40F-B, or CPAC-2-40F-C FW firmware is safe to update from R81.10 to a higher version. Refer to sk182403.

PRJ-61801,

PRHF-39531

Logging

UPDATE: The SOLR process (listening on port 8211) no longer accepts connections using the TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA cipher suite. Refer to sk181683.

PRJ-62728,

PMTR-117738

Logging

UPDATE: Improved the design of the Security Checkup report in SmartView.

PRJ-62472,

PMTR-117312

IPS

UPDATE: HTTP/1.1 requests missing host headers are now processed by the non-compliant HTTP Protection feature (Strict Parsing option). Previously, such requests were dropped immediately. Refer to sk183569.

PRJ-60141,

PMTR-87460,

PRJ-60463,

PMTR-114416

SecureXL

UPDATE: SecureXL Rate Limiting rules for DoS Mitigation now support these parameters with automatic IP range updating enabled by default:

• "cc:<COUNTRY_CODE>"

• "asn:<AUTONOMOUS_SYSTEM_NUMBER>"

Refer to sk112454.

PRJ-61324,

PRHF-39697

CloudGuard Network

UPDATE: Updated supported regions in OCI (Oracle Cloud Infrastructure) data centers and changed the fetching domain logic.

PRJ-63517,

ODU-3040

Automatic Updates - CPView

UPDATE: Added Take 201 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

PRJ-63521,

ODU-3064,

PRJ-63712,

ODU-3111

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 149 and Take 150 via self-updatable package. Refer to sk170314.

PRJ-63781,

ODU-3095

Automatic Updates - Policy Insights

UPDATE: Added Take 76 of Policy Insights Release Updates. Refer to sk183421.

PRJ-63899,

ODU-3127

Automatic Updates - CPView

UPDATE: Added Take 50 of CPquid (QUID) Release Updates. Refer to sk181458.

PRJ-62243,

PMTR-116383

Security Management

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit, creating a core dump file because of the incorrect license update.

PRJ-57301,

PRHF-35813

Security Management

In rare scenarios, the User Check policy is not updated during the Accelerated Policy installation.

PRJ-62664,

PRHF-41094

Security Management

When Global Domain Assignment removal fails with the "Global Domain Assignment failed: object XXX could not be deleted because it is referenced by other objects" error, only a partial list of the referencing objects is displayed in the error message.

PRJ-61897,

PRHF-40211

Security Management

After editing an Interoperable Device object, the number of changes of the current session presented in SmartConsole may be inaccurate.

PRJ-63199,

PMTR-118466

Security Management

In rare scenarios, the FWM process may not start automatically after an unexpected exit.

PRJ-62637,

PRHF-40995

Security Management

After an IPS update, reassigning global policies may take a long time.

PRJ-61805,

PRHF-40186

Security Management

In rare scenarios, discarding an old session fails with an "An internal error has occurred" message.

PRJ-59981,

PRHF-38312

Security Management

When migrating a Security Management Server to a Multi-Domain Security Management Server more than once, the operation fails with the "got at least one duplicate UID in requested list" error.

PRJ-63489,

MGMTTECH-516

Security Management

Security Management Server upgrade may fail when running out of memory.

PRJ-63104,

PMTR-118295

CPView

In a VSX environment, the CPVIEWD daemon may exit and produce a core dump file.

PRJ-47565,

PRHF-29330

CPView

In CPView > Network > Traffic > in the Concurrent Connections table, the number of non-TCP connections is higher than shown in the output of the "fw ctl pstat" and "fw tab -t connections -s" command. The issue is cosmetic only.

PRJ-62753,

PRHF-41169,

PMTR-117799,

PRHF-41238

CPView

The CPVIEW_SERVICES process may exit because of incorrect database handling.

PRJ-60004,

PRHF-38733

Security Gateway

Policy installation may fail when an updatable object is processed incorrectly.

PRJ-61858,

PRHF-40380

Security Gateway

When configuring NAT64 rules for specific targets, the rules may fail to apply. Return traffic may be dropped.

PRJ-61436,

PRHF-39815

Security Gateway

In Maestro Dual Site in the VSX VSLS mode, although CoreXL Dynamic Balancing is enabled, CoreXL does not change the number of Firewall instances and SND instances during traffic load. Refer to sk183485.

PRJ-62016,

PRHF-40483

Security Gateway

The RAD daemon may unexpectedly exit on VSX Gateways.

PRJ-59450,

PRHF-38172

Security Gateway

An application may fail to match correctly when URL Filtering is configured in Hold Mode.

PRJ-60294,

PRHF-28489

Security Gateway

In rare scenarios, the Security Gateway may drop the traffic with "up_manager_fw_handle_first_packet: cmi_context_exec_with_chain_connkey() failed". Refer to sk182506.

PRJ-62894,

PRHF-41242

Security Gateway

HTTP/2 connection may fail when Threat Prevention Software Blades are enabled with Deep Inspection because of a protocol error. Refer to sk183822.

PRJ-62562,

PRHF-41025

Security Gateway

ICAP Server may fail to process multipart HTTP requests (when request body is split into multiple parts, each with its own headers and content).

PRJ-63022,

PMTR-117719

Threat Prevention

In a rare scenario, the DLPU process may exit during traffic inspection when holding a connection.

PRJ-58193,

PRHF-37156

Threat Prevention

In some scenarios, the Anti-Virus Software Blade fails to parse and load external IoC observables of type IPv6. Refer to sk182947.

PRJ-61618,

PRHF-40065

Threat Prevention

The testing of external IoC feed connectivity from SmartConsole fails because of improper retrieval of configuration values.

PRJ-60586,

PRHF-38756

Identity Awareness

Users on shared Servers (MUH v1 and v2) cannot access resources they should have permission to use. When this happens, the Security Gateway fails to recognize the user's identity and does not apply the correct access permissions. Refer to sk183268.

PRJ-60982,

PRHF-39261

Identity Awareness

Entra ID (Azure ID) authorization may fail when more than one tenant is configured for authorization and the "fetch-user-group"s or "fetch-machine-groups" mode is enabled.

PRJ-58058,

PRHF-36813

IPS

In rare scenarios, the source IP shown in the IPS detection log is invalid. Refer to sk182914.

PRJ-62811,

PRHF-41088

IPS

When using Gateway as a Proxy "Non-transparent" and HTTPS Inspection is set to "inspect" with "X-Forward-For header", video playback on YouTube fails.

PRJ-63061,

PMTR-118347

Anti-Virus

In a rare scenario, the Security Gateway may crash during traffic inspection.

PRJ-63025,

PMTR-116661

Anti-Virus

In some scenarios, the Anti-Virus Software Blade reaches a timeout when inspecting Domains because of latency in the RAD daemon.

PRJ-61302,

PRHF-39517

Anti-Virus

In a rare scenario, the memory consumption of the DLPU process continuously increases.

PRJ-44982,

PRHF-27785

Anti-Virus

In rare scenarios, the Anti-Virus Software Blade cache may reach its capacity.

PRJ-61582,

PMTR-115396

ClusterXL

6in4 tunnels are shown in Down state when monitored using the "cphaprob -a if" command.

PRJ-62301,

PMTR-115027

ClusterXL

In ClusterXL High Availability (HA), in some scenarios, the Active cluster member stops sending Cluster Control Protocol (CCP) heartbeats, and the Standby member may misinterpret this as an Interface Active Check (IAC) failure.

PRJ-62686,

PRHF-40994

ClusterXL

Modifying the number of CoreXL instances in a VSLS cluster containing three or more members causes traffic interruption on the updated Virtual System.

PRJ-60348,

PMTR-113063

ClusterXL

In cluster environments using Bonds and VLANs, the ClusterXL Monitoring command "cphaprob stat" (Expert Mode) and the Clish command "show cluster state" may display an incorrect failover reason when an interface disconnects or a link goes down.

PRJ-61109,

PMTR-115083

ClusterXL

A rare race condition occurs during "cpstart" command execution in VSX environments that prevents proper sync interface installation, specifically in the cluster flow process, causing synchronization problems between cluster members.

PRJ-59744,

PRHF-38554

ClusterXL

In a ClusterXL setup, a rare performance issue may be caused by policy installation failure.

PRJ-61739,

PMTR-115808

ClusterXL

An FWK core file is generated when configuring a Bridge Group with more than two interfaces.

PRJ-63078,

PMTR-118396

SecureXL

In some scenarios, the DOS/Rate Limiting configuration settings may default to incorrect values during an upgrade from R81.10 to R81.20.

PRJ-63769,

PRHF-41893

SecureXL

When VLAN interfaces are created on top of bond interfaces configured for Load Sharing, connections may not be hardware accelerated if the bond uses multiple ports from the same physical NIC. Refer to sk184291.

PRJ-60627,

PMTR-114633

SecureXL

Memory corruption may occur in rare VPN routing scenarios.

PRJ-62200,

PMTR-116890

SecureXL

SecureXL does not immediately send packets to the appropriate handler when it receives packets from a Virtual Router or Virtual Switch and fails to forward them to the connected Virtual System. This delay causes significant routing delays and potential routing errors on VSX Security Gateways.

PRJ-62263,

PMTR-109269

SecureXL

The USIM core file may be generated when rebooting the Security Gateway.

PRJ-60896,

PMTR-111305

SecureXL

When SecureXL User Mode (UPPAK) is enabled, there can be a significant latency on a Security Gateway when opening an FTP data connection.

PRJ-63077,

PRJ-63054

SecureXL

The link on the 4-Port 10/25GbE CX7 Lightspeed Network Interface Card may fail to establish when multiple 4-port CX7 Lightspeed Network Interface Cards are installed.

PRJ-63120,

PMTR-118447,

FMW-6167

SecureXL

Large packets cause performance slowdown.

PRJ-55276,

PMTR-104579

SecureXL

Local TCP traffic may encounter "out-of-state" connection issues.

PRJ-62887,

PRHF-40086

SecureXL

In cluster environments, on the Active member, the USIM_x86 process may experience frequent core dumps, causing Security Gateway instability.

PRJ-62587,

PRHF-41038

CoreXL

In rare scenarios, CoreXL Firewall instances may become fully utilized because of resource contention from the Parallel Processing Engine (PPE). Refer to sk184183.

PRJ-52995,

PRHF-31534

Routing

In a specific scenario, where SSM static groups are configured on an interface, after a failover, these IP addresses do not appear as Outgoing Interfaces (OIFs).

PRJ-63117,

PRHF-41346

Routing

ASE LSAs for routes sharing the same prefix but having different mask lengths may not be re-originated correctly when a topology change restores previously unreachable routes to a reachable state.

PRJ-61917,

PRHF-40237,

PMTR-116423

VPN

In VSX environments with VS and VR configurations, when Policy-Based Routing (PBR) is configured on the Virtual Router, Remote Access VPN traffic bypasses the PBR table and uses the default route instead.

PRJ-60692,

PMTR-114063

VSX

In rare scenarios in a VSX environment, after a Virtual System (VS) starts, it becomes stuck in Down state with a "FullSync" pnote.

PRJ-62227,

PMTR-110683

VSX

The "vsx-provisioning-tool" CLI command returns asynchronous task IDs before it is ready for monitoring, causing Terraform and similar automation tools to immediately fail when attempting to track task status.

PRJ-59687,

PRHF-38276

Gaia OS

HealthCheck Point (HCP) reports "rx_length_errors" for Security Group Members. Refer to sk183040.

PRJ-62734,

PMTR-117714

Gaia OS

When using Resource Separation on MDPS on Maestro, and the Security Gateway is under extreme load, policy installation fails, although the Resource Separation should handle the load.

PRJ-62584,

PRHF-41027

Gaia OS

The Security Management Server hangs during a Backup operation because of endless SSH handshake retry, making it impossible to access via SSH or CLI.

PRJ-63583,

PRHF-41381

Gaia OS

SNMP query for "vsxStatusInterfaceRxBytes" and "vsxStatusInterfaceTxBytes" OIDs returns "0". Refer to sk183871.

PRJ-62996,

PRHF-41344

Gaia OS

The "show syslog logs" Clish command returns the "cat: /var/log/messages*: No such file or directory" error even though these files exist.

PRJ-62797,

PRHF-41139

CloudGuard Network

In the Smart-1 Cloud environment, in the Gateways & Servers view, newly provisioned CloudGuard Autoscaling Security Gateways may be shown as disconnected.

PRJ-62819,

PMTR-103009

SD-WAN

In rare scenarios, SD-WAN policy installation may fail during a Security Gateway reboot.

PRJ-62408,

PMTR-117173

Scalable Platforms

Security Group members may reboot because of cp-nano database entries. The /var/log/configuration_reboot_reason.log may show "process:cp-nano-watchdog" when database entries exist only on the local member or only on the SMO member.

PRJ-58049,

PRHF-37015

Scalable Platforms

When handling multiple shared uplinks across numerous interfaces, errors related to LACP bond uplink updates may be printed in logs.

PRJ-62175

Scalable Platforms

A "failed to load external entity "/etc/extended_commands/lightshot_partition_extended_cli.xml" message may be printed in console during boot.

PRJ-62803,

PMTR-117683

Scalable Platforms

In Maestro Security Group or Scalable Chassis Security Group with VSX with many Virtual Systems (VSs), boot may take a long time when the database file (/config/active) is very large (200,000 lines or more).

PRJ-58374,

PMTR-110163

Scalable Platforms

In rare scenarios, Security Group members may fail to receive their Gaia database from the Single Management Object (SMO). When this occurs, gClish commands related to these missing Security Group configurations may fail.

PRJ-47991,

PMTR-91235

Scalable Platforms

If L4 is disabled, the data connection may be dropped if it is redirected to a different IP address than the control connection.

PRJ-59790,

PMTR-105687

Scalable Platforms

On the Mobile Access Portal, SAML authentication does not display the login fields in a Maestro Security Group in the VSX. Refer to sk182548.

PRJ-48418,

PRHF-23287

Scalable Platforms

After adding a custom command in Gaia gClish with the "add command", the custom command is available only on the Single Management Object (SMO). Refer to sk178671.

PRJ-59938,

PRHF-38620

Carrier Security

Security Gateway drops GTP traffic with the log "Message includes unexpected information element type". Refer to sk106469.