R82.10 Jumbo Hotfix Take 50

Take 50 - New Functionality

PRJ-71834,

PRJ-71512

SmartConsole

NEW: Added support for Assigned Global Policy, IPv6 network objects, Allowed / Non-Violating Services, and enhanced Audit Log & Change Report in the Policy Auditor.

PRJ-68781,

PMTR-123894

Scalable Platforms

NEW: Upgrade monitoring is now available in the Insights Monitor providing visibility into the upgrade state of each member.

Take 50 - Improvements and Resolved Issues

PRJ-72500,

ODU-4636

Automatic Update

UPDATE: Added Take 235 of Connecting Management Server to Check Point Portal Release Updates. Refer to sk177205.

PRJ-72300,

ODU-4721

Automatic Updates

UPDATE: Added Take 179 of Web SmartConsole. Refer to sk170314.

PRJ-71730,

ODU-4570

Automatic Updates

UPDATE: Added Take 12 of CloudGuard Controller Release Updates. Refer to sk181842.

PRJ-72269,

ODU-4728

Automatic Updates

UPDATE: Added Take 326 of CME (Cloud Management Extension) for Cloud Firewall Release Updates. Refer to sk157492.

PRJ-71869,

ODU-4657

Automatic Updates

UPDATE: Added Take 44 of Check Point Portal REST API Adapter. Refer to sk183186.

PRJ-71872,

ODU-4643

Automatic Updates

UPDATE: Added Take 96 of HealthCheck Point (HCP) Release Updates. Refer to sk171436.

PRJ-71880,

ODU-4664,

PRJ-72391,

ODU-4714

Automatic Updates

UPDATE: Added Take 100 and Take 101 of Policy Insights Release Updates. Refer to sk183421.

PRJ-72407,

ODU-4626

Automatic Updates

UPDATE: Added Take 156 of OpenTelemetry Agent (OtlpAgent) Release Updates. Refer to sk181615.

PRJ-72404,

ODU-4612

Automatic Updates

UPDATE: Added Take 232 of OpenTelemetry Collector (CPotelcol) Release Updates. Refer to sk180522.

PRJ-72401,

ODU-4619

Automatic Updates

UPDATE: Added Take 99 of OpenTelemetry CPviewExporter Release Updates. Refer to sk180521.

PRJ-72594,

ODU-4882

Automatic Updates

UPDATE: Added Take 42 of CPM Doctor Release Updates. Refer to sk171505.

PRJ-70570,

PRHF-46358

Security Management

UPDATE: Added the mds_backup parameter to limit the collection of migrate log files by age during Multi-Domain Security Management Server backups.

PRJ-69921,

PMTR-129145

Security Management

UPDATE: JRE is updated from version 8.0_8.60 to version 8.0_8.65.

PRJ-69615,

PMTR-128681

Security Management

UPDATE: Added search capabilities to the Confirm Policy Override window.

PRJ-70798,

PRHF-34516

Security Management

UPDATE: Improved rulebase search accuracy and expression processing in SmartConsole and the Management API by addressing issues with IP address searches, special character handling, and logical operators.

PRJ-72284,

PRHF-42905,

PRJ-72288,

PRHF-42963

Security Management

UPDATE: Policy installation performance has been significantly optimized for environments containing thousands of Domain objects or External User Groups.

PRJ-70489,

PRHF-45670

Logging

UPDATE: Added automatic maintenance for PCAP blob data stored in the DLP blob database file for more than 14 days. This is configurable in the $FWDIR/conf/log_policy.C file.

PRJ-65943,

PMTR-120965

Security Gateway

PRJ-69045,

AAD-10027

Identity Awareness

UPDATE: Rebranded "Infinity Identity" references to "Identity and Trust".

PRJ-69653,

PMTR-129995

Gaia OS

UPDATE: Outbound HTTP requests now consistently use the HTTP/1.1 protocol, ensuring compatibility with strict load balancers and enabling successful completion of downloads.

PRJ-67326,

PMTR-125405

VPN

UPDATE: Hardened brute-force protection for Capsule VPN Remote Access authentication.

PRJ-70218,

PMTR-129591

VPN

UPDATE: Hardened brute-force protection for IKEv2 Remote Access authentication.

PRJ-68848,

PRHF-45471

VPN

UPDATE: An improved VPN management process reduces policy installation time and output size for R81.20 Security Gateways, when managed by newer Management versions, through the R81.20 Backward Compatibility package.

PRJ-66882,

PRHF-44016

Upgrade Tools

In certain scenarios, Security Management upgrade may fail with the "HV000028: Unexpected exception during isValid call" error when managing a large number of Spark Firewall Appliances. Refer to sk184946.

PRJ-71200,

PRHF-47306

Security Management

In some scenarios in a Multi-Domain Security Management Server environment, SmartConsole may fail to connect to a domain if its FWM process becomes an unmonitored zombie process that the mdsstop_customer command cannot terminate.

PRJ-70193,

PRHF-45993

Security Management

The FWM process may crash on the Security Management Server during a license contract update, resulting in intermittent failures of management API calls and SmartConsole logins with an authentication error.

PRJ-70402,

PMTR-129675

Security Management

Accelerated Install Policy fails on Security Gateways running versions lower than R82 with a Dynamic IP Address (DAIP) with the "No IP address found in the peer object definition" error message.

PRJ-69319,

PRHF-45586

Security Management

In some scenarios, deleting a Domain fails with the message: "Delete Domain Server completed on MDS <Multi-Domain Server Name> but sync to remote MDSs failed."

PRJ-70722,

PRHF-46769

Security Management

Policy installation may be slow when the policy includes large groups with exclusions.

PRJ-68500,

PRHF-45171

Security Management

In rare scenarios, deleting a policy package fails with the "Object with uid=<UUID> was deleted from database but its object map mirror wasn't found" error message.

PRJ-70646,

PRHF-46607

Security Management

The PostgreSQL process on the Security Management Server may intermittently experience high CPU usage.

PRJ-71388,

PRHF-47401

Security Management

Users may be unable to log in to a domain using the Management API command login-to-domain on the Multi-Domain Security Management Server. Refer to sk185248.

PRJ-71600,

PRHF-47762

Security Management

When launching SmartProvisioning from SmartConsole, SmartProvisioning may prompt for administrator credentials instead of automatically using Single Sign-On (SSO). Refer to sk1000063.

PRJ-67336,

PMTR-125404

Security Management

In a Multi-Domain Security Management Server environment, the FWM daemon at the MDS level may fail to start when TCP port 18190 is bound to more than one IP address.

PRJ-69413,

PRHF-45782

Security Management

In some scenarios, upgrading a Security Management Server may fail during the database import with a "Failed to parse the upgrade data" error if the environment contains more than 32,000 IPS protections.

PRJ-71205,

PMTR-130404

Security Management

The Management API command show-best-practices may fail when using the gateway-name argument.

PRJ-67481,

PRHF-44561

Security Management

In some scenarios, the FWM process may unexpectedly exit and generate a core dump file on both Security Management High Availability members.

PRJ-71227,

PRHF-47362

SmartProvisioning

In rare scenarios, the "Update Corporate Office Gateway" action in SmartProvisioning may fail when used on Traditional VSX Gateways.

PRJ-69982,

PRHF-46008

Logging

In some scenarios, when scrolling through logs in SmartConsole, log loading may stop before showing all matching results.

PRJ-69121,

PRHF-40124

Logging

In SmartView, exporting logs to CSV may return only 100 entries, even if a higher export limit is selected, when network objects with special characters in their names are included.

PRJ-69287,

PRHF-45700

Logging

In some scenarios, the LOG_INDEXER process may crash unexpectedly when multiple log server connections are active, and one of the connections is disconnected.

PRJ-71685,

PRHF-41582

Logging

In some scenarios, certain Mobile Access log fields in SmartConsole may display no data or appear mismatched between the log view and the logs table. In addition, including all log fields may lead to the log view breaking.

PRJ-71012,

PRHF-47170

Logging

In Smart-1 Cloud, logs may stop appearing in the Logs & Monitor view because the log export service fails to start when a stale process file is present.

PRJ-67132,

PRHF-44419

Logging

In some scenarios, logs in SmartConsole may be incorrectly classified under "Log Update" instead of the actual originating category.

PRJ-69960,

PRHF-46062

Logging

When viewing Application Control logs in SmartView, the Program Name column may be missing, making it difficult for administrators to identify the blocked application directly from the log view.

PRJ-71282,

PRHF-38431

Logging

In some scenarios, filtering Endpoint Security logs by destination port may result in a query failure that requires closing and reopening the logs tab.

PRJ-67936,

PRHF-45055

Logging

In some scenarios, the system may not correctly report SOLR index deletion results in the $RTDIR/log/run_maintenance.elg debug file.

PRJ-69081,

PRHF-40192

Logging

In some scenarios, a redundant "CPSEMD low disk space notification" message may appear despite ample free disk space.

PRJ-65466,

PRHF-42980

Logging

The CPSEMD process may unexpectedly exit when the Security Management Server is restarted.

PRJ-65477,

PRHF-43069

Logging

In some scenarios, the output of the fwm logexport command may differ from previous versions, leading to skewed or inaccurate results in scripts that rely on parsing this output.

PRJ-71007,

PRHF-40738

Logging

In some scenarios, the SMARTLOG_SERVER process may unexpectedly exit and generate a core dump.

PRJ-64267,

PRHF-34152

Logging

In rare scenarios, the description of IPS Logs in the Logs view may be unclear. Refer to sk182386.

PRJ-56139,

PRHF-35099

Logging

In some scenarios, the FWD process may fail to move blob files from the temporary blob directory, causing it to grow continuously and consume excessive disk space.

PRJ-70459,

PRHF-46580

Logging

In a Multi-Domain Security Management environment, when viewing logs for a specific domain in SmartConsole, a "Problems have occurred during search: Query resolution failed / Log Resolution failed" error message may appear, and logs may not display properly.

PRJ-70836,

PRHF-46574

Logging

In some scenarios, after upgrading a Security Management Server using the Advanced Upgrade method, the CPD process may unexpectedly exit and fail to restart.

PRJ-70279,

PRHF-40570

Logging

In some scenarios, the FW_FULL process may unexpectedly crash on a Maestro Security Group Member during connection log processing.

PRJ-70190,

PRHF-46182

Logging

In some scenarios, the LOG_INDEXER process may unexpectedly crash while reading log files.

PRJ-64879,

SMBGWY-16234

Security Gateway

Improved connectivity for LSV peer traffic after an ISP failover.

PRJ-70739,

PRHF-46695

Security Gateway

Improved HTTP/2 flow-control handling to prevent the dropping of legitimate long-lived connections to AI assistant tools.

PRJ-68767,

PRHF-36812

Security Gateway

In some scenarios, the Identity Awareness Gateway may fail to communicate with the LDAP Server. The "Couldn't create connection (err=5): Cannot assign requested address" LDAP leak disrupts authentication and ldapsearch" error is displayed. Refer to sk182952.

PRJ-71405,

PMTR-131337

Security Gateway

On Traditional VSX / VSNext setups, a hard reboot could result in a boot loop because of a corrupted CPU affinity file. The file is now detected and automatically rebuilt during startup to prevent this issue.

PRJ-71620,

PMTR-127891

Security Gateway

VPN traffic may generate excessive debug messages containing fwhold_send_enqueue in the $FWDIR/log/fwk.elg log file when traffic is held and later resumed. This is a cosmetic issue and does not affect traffic handling.

PRJ-68161,

PRHF-44996

Security Gateway

In some scenarios, softlockups may occur during the dynamic objects update process. Refer to sk184887.

PRJ-66698,

PRA-5192

Security Gateway

In rare scenarios, when an HTTPS connection is in bypass mode, it may match a Captive Portal rule without being redirected to the portal.

PRJ-67323,

PMTR-125330

Security Gateway

New drop templates are not created if any of the policy layers are configured with an "Any-Any" rule.

PRJ-71367,

PRHF-47526

Security Gateway

Google reCAPTCHA failed to load in Firefox with HTTPS Inspection enabled. Refer to sk185265.

PRJ-72112,

PRHF-47698

Security Gateway

Websites returning large HTTP/2 response headers may fail to load when HTTPS Inspection is enabled.

PRJ-69233,

PMTR-128018

Security Gateway

In rare scenarios, the Security Gateway may generate an incorrect security verdict while inspecting specific types of network traffic.

PRJ-70407,

PRHF-45776

Identity Awareness

In rare scenarios, a failover on a PDP operating within a Maestro Dual Site environment may result in missing identities on the PEP side. Refer to sk185057.

PRJ-68479,

PRHF-37101

Identity Awareness

The identity deletion process returned an incorrect error message "HTTP 500: GENERIC_INTERNAL_ERROR ... Failed to send disassociation to PDP" even though the identity was successfully removed from the database.

PRJ-64965,

PMTR-122227

Identity Awareness

In some scenarios, sessions received from Identity and Trust may appear with an "Unknown" client type in the PEP CLI output.

PRJ-69621,

PRHF-45953

IPS

Improved handling of rejected HTTP/2 cleartext (h2c) upgrade attempts to ensure connections recover gracefully and prevent inconsistent failure states.

PRJ-65292,

PRHF-42748

IPS

In some scenarios, IPS may drop legitimate DNS traffic due to Core Protection with an "Unknown Resource Record" message. Refer to sk184403.

PRJ-70886

Anti-Virus

In some scenarios, SmartConsole windows are blocked while the Threat Prevention Insights window is open.

PRJ-65889,

PRHF-43440

Anti-Virus

In some scenarios, Anti-Virus may drop traffic with the message "HTTP parsing error occurred" in the SmartConsole log when inspecting WebSocket traffic. Refer to sk184605.

PRJ-71390,

PMTR-131300

SSL Inspection

In rare scenarios, Security Gateway memory consumption may gradually increase while inspecting TLS connections.

PRJ-68835,

PRHF-45470

ClusterXL

In rare scenarios, traffic forwarded between cluster members via the Sync interface is not routed properly.

PRJ-70801,

PMTR-130359

SecureXL

When deleting a GRE or VXLAN interface, the Security Gateway may fail to fully release dynamically allocated resources if SecureXL User Mode is enabled.

PRJ-70317,

PRHF-46286

SecureXL

DHCP or other local services may stop functioning correctly after running tcpdump or cppcap when SecureXL User Space Mode is enabled.

PRJ-70953,

PMTR-126219

Gaia OS

Improved the IDNS resolver to handle empty configuration files, which previously caused Domain objects to not populate and led to policies referencing those objects to fail to match traffic. Refer to sk185150.

PRJ-70016,

PMTR-123717

Gaia OS

CIFS traffic may experience instability caused by flow control settings on Check Point Firewall 3920 and 3950 appliances' switch ports.

PRJ-72719,

PMTR-132662

Gaia OS

In some scenarios, RADIUS authentication fails when processing overly long credentials during login.

PRJ-71384,

PRHF-47560

Gaia OS

Check Point Process Manager (PM daemon) fails to correctly monitor the DNSMASQ process.

PRJ-70309,

PMTR-125052

Gaia OS

In some scenarios, Gaia backup may fail on a Security Gateway or Smart-1 Security Management appliance if it has multiple volume groups.

PRJ-72198, PRHF-48214

Routing

In some scenarios, when using routing separation and dynamic routing, dynamic routing synchronization may not function properly after an upgrade.

PRJ-71467,

PRJ-71556

Traditional VSX

The vsx_util upgrade command may fail to properly update the Security Management database when upgrading.

PRJ-67872,

PMTR-125971

VPN

In some scenarios, removing a gateway from a Remote Access community configured with an Encryption Domain may fail due to an API error.

PRJ-70518,

PRHF-46560

VPN

In some scenarios, Site-to-Site VPN tunnel against 3rd-party flaps every 2 minutes.

PRJ-67831,

PRHF-45025

VPN

In some scenarios, users are unable to create a tunnel in Traditional Mode VPN.

PRJ-70282,

PRHF-46268

VPN

Intermittent RADIUS communication issues affecting Remote Access VPN users.

PRJ-69039,

PRA-5212

VPN

In some scenarios, a memory leak may occur in the DPD flow in IKEv1 and IKEv2.

PRJ-70266,

PMTR-129382

VPN

In some scenarios, a memory leak may occur in the TCPT flow.

PRJ-69236,

PMTR-126602

VPN

In Remote Access, a mobile client may fail to connect to the Security Gateway even though a supported integrity algorithm is available in the supported algorithms list.

PRJ-71539,

PRHF-47675

VPN

Remote Access VPN IKEv2 (Visitor Mode) traffic may be dropped with the error: "ipsec_encrypt failed: encrypted packet too big".

PRJ-67154,

PMTR-124571

VPN

In VSX Route-Based VPN (VTI) deployments, locally generated outbound BGP traffic is not matched by Directional Community Rules, requiring a separate Access Control rule for the BGP service.

PRJ-70478,

PMTR-129839

VPN

In some scenarios, IKEv2 tunnel narrowing may be incorrect in the Encryption Domain per community configuration with a Check Point peer.

PRJ-70777,

PRHF-46720

VPN

In some scenarios, access roles may intermittently fail to match with IKEv2 Remote Access clients.

PRJ-70305,

PRHF-46355

VPN

Site-to-Site tunnels with third-party devices may go down intermittently as a result of DPD collisions when MEP or Permanent Tunnel is enabled.

PRJ-70136,

PMTR-129460

VPN

Stabilization of IKEv2 Remote Access connection establishment.

PRJ-65882,

PRHF-41703

VPN

Frequent Site-to-Site VPN Phase 1 tunnel renegotiations may cause connectivity disruptions.

PRJ-71946,

PMTR-131853

VPN

Remote Access VPN users with Machine Certificates configured were unable to connect when using IKEv2 and the Endpoint Client.

PRJ-69536,

PRHF-44381

SD-WAN

In rare scenarios, SD-WAN overlay probing packets may be improperly handled under specific VPN routing configurations.

PRJ-69540,

SDWANGW-5963

SD-WAN

In some scenarios, SD-WAN may fail to establish overlay tunnels when used with a Cross AZ cluster.

PRJ-70726,

PRHF-46898

Scalable Platforms

When enabling the Maestro Fastforward feature, ARP checks may fail on non-SMO members during activation.

PRJ-69538,

SDWANGW-6834

Scalable Platforms

In some scenarios, a newly joined member of ElasticXL or Maestro may begin accepting traffic before the SD-WAN policy is fully installed, which may result in traffic being handled incorrectly during that time.

PRJ-68655,

PMTR-125348

Scalable Platforms

Reduced overall CPU load caused by monitoring processes on Maestro Orchestrator.

PRJ-70947,

PMTR-130701

Scalable Platforms

Disabling the Maestro Fastforward feature may fail with an error on the MHO side, preventing the deletion of rules.

PRJ-71211,

PMTR-129898

Scalable Platforms

Contracts downloaded from the User Center by a Security Group Member may get deleted after Policy Installation because the SMO member's contract file overwrites the member's local file.

PRJ-69478,

PMTR-128575

Scalable Platforms

In some scenarios, failure to install a license using the g_cplic command occurs when the license IP is set to 127.0.0.1.

PRJ-70245,

PRHF-46338

Scalable Platforms

In rare scenarios, invalid site count values in Maestro dual-site Security Groups may cause cluster flapping and traffic impact.