R81.20 Jumbo Hotfix Take 126

Take 126 - New Functionality

PRJ-64972,

AAD-4768

VPN

NEW: Added support for nested groups with host/range/network objects for split tunnel on exclusion/inclusion options. Refer to Dynamic Split Tunneling for SaaS Using Updatable Objects.

Take 126 - Improvements and Resolved Issues

PRJ-64530,

PRHF-42420

Security Management

UPDATE: In environments with hundreds of users and user groups, policy installation duration is significantly improved.

PRJ-64004,

PMTR-119902

SecureXL

UPDATE: Improved Debug Filtering for specific flows in SecureXL User Space Mode (UPPAK) debug messages.

PRJ-61644,

PMTR-115879

Security Management

In rare scenarios, CME (Cloud Management Extension) fails to run because of the Management API command "show-simple-gateway" fails. The CME logs show such entries: "Product - CMESeverity - criticalDescription - Error during synchronization with Security Gateways. Error details: Failed to scan for gateway instances in the cloud account".

PRJ-56729,

PRHF-35654

Security Management

In some scenarios, Compliance Software Blade presents the results of Firewall Best Practices as "N/A".

PRJ-62808,

PRHF-40437

Security Management

Running a Packet Mode search using the Management API for a service object fails to match the correct service rules.

PRJ-63825,

PRHF-41884

Security Management

Best Practices may be missing or show incorrect results in the Security Best Practices view of the Compliance Software Blade. Refer to sk184239.

PRJ-63947,

PRHF-41979

Security Management

Policy installation may fail when an inline layer is used more than once in the same policy and this error is displayed "Policy installation had failed due to an internal error. If the problem persists please contact Check Point support".

PRJ-62086,

PRHF-40511

Security Management

In a Full High Availability (HA) ClusterXL deployment, the Check Point Portal does not display the Active Management Server as connected. As a result, Configuration Sharing is not working as expected in the Check Point Portal.

PRJ-62988,

PRHF-41049

Security Management

In some scenarios, when updatable objects are used in the policy, policy installation fails with error code "0-2-2000245". Refer to sk183844.

PRJ-61152,

PRHF-39622

Security Management

The Management API command "add server-certificate" may fail with the "Invalid parameter for [base64-certificate]. The certificate is not valid because it is longer than 10000 characters" error, even though the certificate is valid.

PRJ-62313,

PRHF-40748

Security Management

The FWM process may leak and then exit.

PRJ-63589,

PMTR-119207

CPView

In some scenarios, the CPD daemon may exit with core dumps.

PRJ-64205,

PMTR-120236

CPView

Apostrophes used in CPView strings cause CPDiag to fail. CPView History data is not shown. Refer to sk184873.

PRJ-63226,

PRHF-40388

Logging

In some scenarios, disk space on the Security Management Server may increase significantly if PostgreSQL database log rotation does not function as expected.

PRJ-64467,

PRHF-42386

Logging

In some scenarios, exporting logs to CSV in SmartView fails and the LOG_INDEXER process unexpectedly exits. Refer to sk184475.

PRJ-65363,

PMTR-122317

Logging

Improper memory handling within the CPD daemon may result in unexpected process restart.

PRJ-63383,

PRHF-41504

Security Gateway

In rare scenarios, the FWK process may exit when parsing an invalid SIP packet.

PRJ-63234,

PRHF-41491

Security Gateway

Enabling the ForceAuth option for Remote Access VPN fails because of a typo in the saml_force_authn_override.sh script (sk182042).

PRJ-59891,

PRHF-38489

Security Gateway

In rare scenarios, the FWK process may exit with core files because of a segmentation fault.

PRJ-65052,

PRHF-42145

Security Gateway

In some scenarios, SNMPv3 monitoring fails on Data Plane when MDPS is enabled. Refer to sk184379.

PRJ-65130,

PMTR-108249

Security Gateway

A PYTHON3.11 zombie process may be running in the background without impact on system performance.

PRJ-59978,

PRHF-38572

Threat Prevention

In some scenarios, the Anti-Virus Software Blade fails to load external IoC feeds with an error "Can not load indicators feed without AV & AB Blades enabled, please enable AV & AB and try again", although the Anti-Virus and Anti-Bot Software Blades are enabled in a Maestro environment. Refer to sk183200.

PRJ-60570,

PRHF-39093

Content Awareness

In some scenarios, a memory leak may occur in the DLPU process. The /var/log/ directory on the Active Cluster member reaches critical disk usage levels.

PRJ-63610,

PMTR-119233

IPS

In rare scenarios, the IPS update package may become corrupted. This could cause the Security Gateway to load the initial policy instead of the active security policy.

PRJ-66118

Anti-Virus

In rare scenarios, the MTA process may crash when the Anti-Virus and Threat Emulation Software Blades are enabled.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-66541,

PMTR-123417

SSL Inspection

SSL Network Extender (SNX) package installation fails with a verification error.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-63691,

PMTR-118658

SecureXL

In some scenarios, the USIM_X86 process may become unresponsive.

PRJ-62706,

PRJ-61390

SecureXL

When configuring PIM in Sparse Mode across multiple Virtual Systems on a VSX Security Gateway, the Security Gateway may crash, resulting in loss of connectivity.

PRJ-63123,

PMTR-118217

SecureXL

The USIM process may exit with core dumps when debug information is collected.

PRJ-62250,

PMTR-116638

SecureXL

SYN Defender (Synatk) does not recognize or enforce protections on bridge interfaces.

PRJ-64300,

PMTR-120376

SecureXL

When SecureXL is working in User Mode (UPPAK) mode, some packets may sometimes appear twice in the output of the "tcpdump" command.

PRJ-61338

SecureXL

When SecureXL User Mode (UPPAK) mode may be disabled if some scripts are incorrectly edited.

PRJ-62197,

PMTR-114719

SecureXL

When the Security Gateway is working with SecureXL in User Mode (UPPAK) mode, in some scenarios, the USIM process may exit and not restart, although it should.

PRJ-66163

SecureXL

A vmcore dump may be generated when enabling kernel debugs in Kernel Mode (KPPAK) while processing multicast traffic.

PRJ-62565,

PMTR-117103

Routing

When SecureXL runs in User Mode (UPPAK), local IGMP and MLD multicast groups are not added to listener reports. This causes the output of the "show igmp groups" command to miss expected local group memberships. Additionally, the router does not send MLD reports for IPv6 multicast groups, breaking IPv6 Dynamic Routing.

PRJ-65219,

PRHF-42915

Gaia OS

SNMP monitoring systems may report format errors related to the structure of the chkpnt.mib file.

PRJ-63237,

PRHF-41507

Gaia OS

The SSHD process unexpectedly exits on the Multi-Domain Log Server (MLM) after an SSH session ends. Refer to sk183972.

PRJ-59018,

PMTR-110956

Gaia OS

LACP bonds may continue passing traffic when running SecureXL User Space Mode and the value drops below the configured minimum number of links, although the bond interface should stop passing traffic.

PRJ-65222,

PRHF-42944

Gaia OS

When integrating SNMP monitoring systems with Gaia OS, compilation of the GaiaTrapsMIB.mib file with the CHECKPOINT-MIB (chkpnt.mib) may fail. SNMP management stations or MIB browsers (such as HP OpenView, CA Spectrum, or HP Network Node Manager) return errors like "File GaiaTrapsMIB.mib failed to parse" or "ERROR : Cannot find symbol file://GaiaTrapsMIB.mib:Line XX:Column XX:multiDiskName".

PRJ-55464,

PRHF-33954

Gaia OS

On a Scalable Platform Security Group, although an SHA hash type was configured for Gaia OS passwords with the Gaia gClish command "set password-controls password-hash-type", the Gaia gClish command "set expert-password" saves the password as an MD5 hash in the Gaia OS database. Refer to sk182339.

PRJ-47248,

PMTR-91857

VPN

Capsule VPN for Android / Capsule Connect for iOS / Capsule VPN Plugin for Windows lose access to internal resources. Refer to sk180661.

PRJ-62343,

PRHF-40386

VPN

In some scenarios, only a partial list of traffic selectors may be sent during tunnel negotiation for Remote Access IKEv2 tunnels.

PRJ-63696,

PMTR-119366

VSNext

When capturing packets on a warp interface in a Virtual System (VS) of a VSX Security Gateway with SecureXL User Mode (UPPAK) enabled, certain reply packets may not be captured, for example, ICMP Echo Replies to traffic directed at the Security Gateway.

PRJ-65568,

HEC-1345

VSNext

In the VS0 context, physical resources per VS may not be visible when using the "cpview -m" command, although they are available in the CPView tool.

PRJ-64069,

PRHF-41754

SDWAN

In SD-WAN overlay environment when there is no matching rule, the /var/log/messages files may contain many the errors "could not find rule uuid for connection" and "invalid return value from callback".

PRJ-64392,

PMTR-119685

Scalable Platforms

When adding a subordinate to an LACP bond, a member may go down, which triggers a site failover.

PRJ-62493,

PMTR-119734

Scalable Platforms

In a Maestro Security Group with a Threat Prevention policy applied, performing an SIC reset may cause non-Single Management Object (non-SMO) Security Group members to enter a Down state. The affected members display an Anti-Malware pnote as the reason for the state change.

PRJ-64387,

PMTR-120706

Scalable Platforms

In a Maestro deployment, the $PPKDIR/conf/adpkern.conf file may not be synchronized across Security Group members.

PRJ-65969,

PMTR-92125

Scalable Platforms

After creating a bridge interface via Gaia Portal and rebooting, the Security Gateway state is down.

PRJ-44882,

PRHF-21006

Carrier Security

GTPv1 traffic may be dropped with code description "Invalid IE length value", "GTP info: Parsing IE type 133 failed".