R81 Jumbo Hotfix Take 25

NEW: Improved FWM process performance during Security policy or database installation.

UPDATE: In High Availability environment, Assign and Reassign Global Policy actions are not supported for a Domain if the active Domain Server for this Domain is a Security Management device. The assignment will be performed after change-over to the primary Domain Server.

In some scenarios, the log file of PostgreSQL (postgres.elg) may become very large.

In some scenarios, delete partial domain with createDomainRecovery.sh script fails when there are several RadiusGroup objects with the same name in different domains.

Policy Installation may fail with "Error code: 0-2-2000245" message when using IPv6.

In rare scenarios, the initiation of the Management server may take a long time.

In some scenarios, the Purge Revisions task may stop and show 0% for hours or fail with the "An error has occurred while performing revision purge operation" message in SmartConsole.

In some scenarios, when connecting to an existing session in SmartConsole from a different IP address, a wrong "Client IP" is shown in Audit Logs view.

High load may occur on the Management Server when searching for a prefix of IP address that has more than 10 thousand matches.

The Multi-Domain session APIs "view sessions" and "show last-published-session" results may include sessions that were not filtered according to the administrator's permissions profile.

• A Domain manager running the API will be notified when the results will be filtered and will be asked to run the command again with the "ignore-warnings" flag

In some scenarios, HA Full Sync on the System Domain fails after upgrade on a Multi-Site environment with multiple Multi-Domain Servers. Refer to sk171059.

After a network interface is removed by cluster API, a network group assigned to that interface remains as used by cluster members and cannot be deleted.

When there are no search results, search in Access Control Policy displays "An error occurred while searching" instead of "No Items Found".

In some scenarios, the "show gateways-and-servers" Management API command fails when running it with "details-level full" and when connected to the Global Domain. Refer to sk170895.

In some scenarios, the "show-access-rulebase" Management API command fails when running it with details-level "full" and there is a network group with more than 50000 objects on one of the rules. Refer to sk170435.

In some scenarios, FWM process logs show Provisioning/LSM activity even though LSM is not in use. Refer to sk171905.

In some scenarios, a validation warning may appear on an updatable object with the following message: "Object is no longer supported. Enforcing security for this object is not possible." However, the object is still available in the updatable objects picker.

In some scenarios, an incorrect Compliance status for Gaia OS Best Practices is displayed.

NEW: Log Server now supports up to 4 billion logs per day in Index mode (previously it stopped indexing with a limit of 2 billion logs).

In a rare scenario, CPD process may use a random port for AMON communication instead of port 18196.

Removed potential XSS vulnerability in the MAB Login page.

In some scenarios, PPTP or GRE traffic may be dropped. Refer to sk170293.

Security Gateway may crash when "Categorize HTTPS Websites" feature is enabled and categorization mode is set to "Hold".

The VMCore file may be created during reboot after the upgrade procedure.

In a rare scenario, Security Gateway may crash when CPcode is running within Content Awareness or parser flow.

Added optimization for PDP when handling Terminal servers Multi-User Host Agent (MUH).

UPDATE: Improved Anti-Virus buffer allocation to reduce stack size.

In rare scenarios, a memory leak may occur in a crypto module.

When MDPS is configured, the output of "cphaprob syncstat" may show unreadable characters for the speed of the sync interface.

Security Gateway may crash when there are interfaces that do not need the ARP resolution (VTI).

NEW: Added support for Smart-1 6000-L/XL appliances. Refer to sk171903.

CVE-2020-25705: ICMP reply rate.

In some scenarios, the "rhost" value may be missing from logs when the user tries to access the WebUI.

Messages log level in /var/log/messages file for ERR level was changed to INFO level when fetching proxy configuration from Clish/WebUI/Gaia API.
Example: [DATE TIME] <daemon.err> ... xpand[25958]: proxy_live_get_proc: Started...

When upgrading with enabled Management Data Plane Separation (MDPS), an additional reboot may be required.

In some scenarios, policy installation on a Check Point Gateway in Azure causes the Gateway to crash and load a default policy. Refer to sk171553.

After running "vsx_util vsls" and selecting option #6, the operation may fail with the "Internal Error: got empty reply set" error. Refer to sk171352.

UPDATE: Added:

• VPN Remote Access StrongSwan IKEv2 client logs.
• Key install logs with StrongSwan IKEv2 client improvement to show the correct authentication method.
• RAsession_util with StrongSwan IKEv2 client improvement.

Added VPN Remote Access stability improvement.

Mobile Access SNX may fail to connect to the Security gateway when the realm used by the client is different for the SSL VPN realm.

On the SmartEndpoint Reporting page, the "Endpoint Connectivity" report that is filtered by a virtual group returns an empty list.

Adding devices to virtual group using the epmcommands tool may fail.