R82.20 Jumbo Hotfix Take 14

Take 14 - New Functionality

PRJ-72370

PRJ-72331

SmartConsole

NEW: Added support for External and others segment in the Policy Auditor.

PRJ-73053

ODU-4840

Logging

NEW:On IPv6-only Security Management Servers, exported logs now include the IP address in the origin field.

PRJ-71885

PMTR-131333

URL Filtering

NEW: Optimized the internal URL Filtering cache behavior to reduce browsing latency through Security Gateways with URL Filtering enabled.

PRJ-72333

SD-WAN

NEW: Introducing SD-WAN Management from Smart-1. Smart-1 now provides a full management plane for SD-WAN. With this release, you can configure SD-WAN interfaces, policy, and traffic steering directly from SmartConsole and Web SmartConsole, without requiring cloud connectivity.

Take 14 - Improvements and Resolved Issues

PMTR-134138

PMTR-134407

FMW-11504

PMTR-132772

PRJ-74199

ODU-5120

ODU-5113

PRJ-72317

PMTR-132329

Security Management

UPDATE: Policy Preset installation in Multi-Domain Security Management is now performed in parallel rather than preset-by-preset.

PMTR-112936

PRJ-72747

MLS-6013

Security Management

UPDATE: Reduced Policy Package cloning time for policies with rulebases containing hundreds of rules.

PRJ-72204

PMTR-115991

PMTR-133511

To increase it, on each Cluster member, set the desired size of the fwha_boot_max_if_bum global kernel parameter in Config Point and reboot.

PRJ-70521

PMTR-114076

SecureXL

UPDATE: Added the -u parameter to print all entries in this table: fwaccel tab -t connections -u

PRJ-71801

PRHF-47934

Gaia OS

UPDATE: Updated time zone data for America/Vancouver to align with British Columbia's permanent daylight saving time policy, preventing incorrect local times after November 1, 2026.

PRJ-71998

PMTR-131884

VPN

UPDATE: Enhanced Link Selection now blocks saving a VPN community or a Security Gateway when two Security Gateways in the community would be unable to create a VPN link, because their Enhanced Link Selection interfaces share no circuit and are not directly connected.

PRJ-72963

ODU-4791

PRJ-73653

ODU-4924

PRJ-74227

Automatic Updates

UPDATE: Added Take 180, Take 181, and Take 182 of Web SmartConsole. Refer to sk170314.

PRJ-73508

ODU-4847

ODU-4735

PRJ-73032

ODU-4889

PRJ-73801

ODU-4980

PRJ-74207

Automatic Updates

UPDATE: Added Take 103, Take 105, and Take 106 of AI Insights. Refer to sk183421.

ODU-4931

PRJ-74231

ODU-5050

ODU-5099

ODU-5092

ODU-5065

ODU-4784

ODU-4903

ODU-4910

ODU-5078

PRJ-73028

ODU-4742

Automatic Updates

UPDATE: Added Take 23 of Public Cloud CA for Cloud Firewall. Refer to sk172188.

PRJ-73037

ODU-4896

PRJ-73784

ODU-4973

Automatic Updates

UPDATE: Added Take 331 and Take 332 of CME (Cloud Management Extension) for Cloud Firewall Release Updates. Refer to sk157492.

PMTR-132539

PRJ-72454

PRHF-48429

Security Management

In a Multi-Domain Security Management environment, the "Match application on 'Any' port when used in 'Block' rule" setting configured in the Global Domain is not applied to local domains after a Global Policy assignment.

PRJ-71199

PRHF-47306

Security Management

In some scenarios in a Multi-Domain Security Management Server environment, SmartConsole may fail to connect to a domain if its FWM process becomes an unmonitored zombie process that the mdsstop_customer command cannot terminate.

PRJ-72206

PRHF-45429

Security Management

In a Multi-Domain Security Management environment that manages a large number of Gateways, memory leaks in the FWM process can accumulate over time, resulting in high FWM CPU utilization, out-of-memory conditions, and Management instability.

PRJ-72859

MLS-5585

Security Management

In some scenarios, loading the AI Auditor guidelines takes more than a minute.

PRJ-72631

PRHF-47989

Security Management

In some scenarios, the CPM process may crash with an "Out of Memory" error during Accelerated Install Policy validation after a large number of policy changes are published.

PRJ-72450

PMTR-127690

Security Management

On a Multi-Domain Security Management Server, the mdsstat command may show a status of UP (N/A) for CPD in one or more Domains, even though the CPD process is running, as verified by the ps command output.

PRJ-72509

PRHF-47661

Security Management

The Policy Installation window may become slow or unresponsive when a policy change affects a large number of rules in a large rule base.

PRJ-71759

PRHF-47720

Security Management

In some scenarios, administrators authenticated through a SAML Identity Provider cannot open a Security Gateway object in SmartConsole, receiving the error “SmartDashboard component failed to connect to the server". Refer to sk1000067.

PRJ-72334

PMTR-132285

Security Management

When using the show changes Management API command with the user-changes-only flag, changes made by internal system sessions may be incorrectly included in the report.

PRJ-73061

PRHF-49329

Security Management

In some scenarios, Management or Log Servers may not appear in the "Connected Managements" view under Management & Smart-1 Cloud in the Check Point Portal. This issue can affect cloud services such as SD-WAN and Configuration Sharing.

PRJ-72526

PRHF-48228

Security Management

In environments with multiple interoperable devices, the "Install Database" operation on a remote server may take a long time to complete.

PRJ-72586

PRHF-47631

Security Management

Editing an administrator account may invalidate its API key if the administrator is configured to log in with an API key.

PRJ-71034

PRHF-47171

Security Management

In some scenarios, deleting a Security Gateway object associated with a VPN community in SmartConsole may fail.

PRHF-44260

PRJ-72589

PRHF-48330

Security Management

The Management API may allow users to create host, network, and address-range objects with automatic NAT rules in the Global Domain, even though this configuration is invalid and unsupported.

PRJ-72519

PRHF-48562

Security Management

Threat Prevention policy installation may fail with the misleading "Internal error occurred during the verification process" error message when the policy contains no enabled rules.

PRJ-71615

PRHF-47343

Security Management

In some scenarios, the Skyline mgmt_proc_ready metric may stop reporting data.

PRJ-72503

MLS-5297

Security Management

Searching the rulebase by rule name or by the Time column may return inaccurate results.

PRJ-72007

PRHF-48002

Security Management

In some scenarios, the Management API may return a "NullPointerException: null" error when retrieving the full details of a policy package. Refer to sk1000079.

PRJ-72766

PRHF-48346

Logging

In some scenarios, Session logs may be missing in SmartConsole when a connection is matched with both an Identity Awareness or Remote Access VPN user and a Client Authentication or Session Authentication user name.

PRJ-72941

PMTR-132922

Logging

Log Exporter Load Distribution can be enabled for a Log Exporter with an Amazon S3 target, but the setting has no effect.

PRJ-72216

PRHF-48230

Logging

In some scenarios, the Doctor Log script fails with the error message "Failed installing sme-diag package" due to an outdated version of the script.

PRJ-72430

PMTR-131371

Logging

In some scenarios, the LOG_INDEXER process may unexpectedly exit and generate a core dump while indexing logs.

PRJ-72766

PRHF-48346

Logging

In some scenarios, Session logs may be missing in SmartConsole when a connection is matched with both an Identity Awareness or Remote Access VPN user and a Client Authentication or Session Authentication user name.

PRJ-71421

PRHF-47173

Logging

Syslog configuration in Clish is missing after the upgrade.

PRJ-71573

PRHF-47551

Logging

In some scenarios, the process that handles OPSEC LEA log export may unexpectedly crash and generate a core dump file while sending logs to an external application.

PRJ-71479

PRHF-41562

Logging

In some scenarios, the SmartEvent correlation process CPSEAD may unexpectedly crash on the SmartEvent server.

PRJ-72089

PMTR-130508

Logging

In some scenarios, after upgrading a cluster member, the cpstat mg -f log_server command incorrectly displays a connected member as disconnected, even though it remains connected and continues to forward logs normally.

PRJ-72003

PRHF-47662

Logging

In rare scenarios, the FWD process may leak file descriptors in the log-forwarding flow and eventually crash after the descriptors are exhausted, which can also cause the Dynamic Objects process to crash.

PRJ-71359

PRHF-39587

Logging

In some scenarios, abnormally high traffic volume values may be displayed in SmartEvent and Check Point Events & AIOps (formerly Infinity Events) traffic-usage views and reports.

PRJ-71971

PRHF-47860

Logging

In some scenarios, VPN Encrypt/Decrypt logs are not displayed in SmartConsole for VPN connections that also include Identity Awareness user information.

PRJ-71136

PRHF-46946

Check Point Firewall

Re-applying an active Suspicious Activity (SAM) rule may reset its expiration earlier than expected.

PRJ-71454

PRHF-47521

Check Point Firewall

In some scenarios, users can connect to the Mobile Access/SSL Network Extender but do not have access to internal resources after the upgrade. Refer to sk185259.

PRJ-72607

PRHF-48712

Check Point Firewall

In rare scenarios, a memory leak may cause an outage when inspecting QUIC traffic.

PRHF-39725

PRJ-71295

PRHF-47222

Check Point Firewall

In some scenarios, the C-ICAP process on the Security Gateway may frequently generate core dump files when UserCheck is enabled on the ICAP server.

PRJ-72475

PRHF-46904

Check Point Firewall

Improved stability of the CPRID process.

PRJ-72723

PRHF-48959

Check Point Firewall

After an upgrade, a Security Gateway with 20 or more CPU cores may experience these issues for tens of minutes or even hours after a reboot, cluster failover, cpstart, or policy installation:

• Very high load average, with a single CPU core at 100%.
• VPN tunnels, HTTPS Inspection, or Identity Awareness repeatedly disconnecting and recovering.
• Slow or failed policy installation and, in clusters, unexpected failovers.
• In CPView, one CPU core is saturated while the other cores are mostly idle.

The Security Gateway usually recovers on its own after the traffic load decreases.

PRJ-71781

PRHF-47781

Check Point Firewall

Improved CPU utilization of the CPVIEWD process on Security Gateways with a large number of interfaces (for example, Maestro and VSX deployments).

PRJ-73642

PMTR-134044

Check Point Firewall

In some scenarios, very large Network Feeds cause Security Gateway instability or crashes when the feed exceeds the supported limit of 25,000 domains, including Domain objects and their "www." variants.

PRJ-72616

PMTR-132448

Identity Awareness

In some scenarios, the PEPD daemon crashes intermittently during the Identity and Trust integration flow.

PRJ-71229

PRHF-33065

Identity Awareness

The Portal Title configuration in Captive Portal Customization may not take effect.

PRJ-72839

PRHF-48815

Application Control

In some scenarios, SSH and SFTP connections through the Explicit Proxy may be reset immediately after the CONNECT tunnel is established, generating the following log message: "Application Control - Internal system error (4)."

PRJ-73397

PRHF-49769

Application Control

In a rare scenario, the Security Gateway may crash with an FWK process core dump.

PRJ-72260

PRHF-46265

Anti-Virus

Anti-Virus may allow common file types whose hashes are not in the local database without querying ThreatCloud, even when Deep Scan is enabled.

PRJ-72445

PRHF-48204

Anti-Bot

In some scenarios, internal networks that span multiple subnets may not be excluded from Anti-Bot email classification. As a result, repeated errors such as "Session is down", "Bad http status: HttpError 502/503", and "Connection timeouts to Resolver.chkp.ctmail.com" may appear in the system logs.

PRJ-72930

PMTR-132713

Anti-Bot

In rare scenarios, an SGM Security Gateway may become unresponsive when the Anti-Bot is enabled.

PRJ-72374

PRHF-44071

UserCheck

In some scenarios, when configuring a UserCheck message with the send original email option, clicking this option returns "An unexpected error has occurred" or "HTTP 500 response when accessing the relevant UserCheck action" errors. Refer to sk184649.

PRJ-71940

PRHF-44391

ClusterXL

In some scenarios, when QoS is enabled in a cluster environment, the USIM process may crash.

PRJ-72976

PRHF-49283

ClusterXL

In some scenarios, site failover is not triggered when all slave interfaces in a Load Sharing Bond are down.

PRJ-72890

PRHF-46051

ClusterXL

In some scenarios, NAT64 connections fail on Scalable Platforms.

PRJ-72416

PRHF-48298

SecureXL

Expanded support for bridged non-IP Layer 2 traffic, allowing the bridge logic to process a wider range of Ethernet frames.

PRJ-72913

PMTR-131514

SecureXL

Increased latency can occur when non-accelerated packets or accelerated packets processed by Active or Passive Streaming pass between Virtual Systems through a Virtual Router or Virtual Switch on a VSX Security Gateway with SecureXL User Mode enabled.

PRJ-71122

PRHF-47248

SecureXL

PRJ-72915

PMTR-132146

SecureXL

In some scenarios, routing traffic through interfaces configured on a bridge takes significantly longer than normal on a Security Gateway when SecureXL User Mode is enabled.

PRJ-72268

PRHF-46611

SecureXL

MaaS tunnel communication may fail when traffic is directed to the cluster VIP.

PRJ-73323

PRJ-73347

SecureXL

In an ElasticXL cluster with IPv6 enabled, a cluster member that is still booting may reboot unexpectedly if it receives IPv6 multicast traffic, such as a Router Solicitation.

PRJ-72610

PRHF-48564

Gaia OS

In some scenarios, SNMP displays an incorrect VS name.

PRJ-72882

PMTR-132890

Gaia OS

In some scenarios, files in the /tmp and /var/tmp directories are incorrectly deleted after 10 and 30 days of inactivity, respectively. Refer to sk1000227.

PRJ-71287

PRHF-46746

Gaia OS

Improved traffic stability after DHCP lease renewal on Security Gateways with Dynamically Assigned IP addresses (DAIP).

PRJ-71131

PRHF-46820

Gaia OS

In some scenarios, repeated "unexpected header length" warnings appear in the snmpd log file.

PRJ-71581

PRHF-47601

Gaia OS

Improved the Gaia Clish show configuration command output to eliminate duplicate interface comment entries for bond member interfaces.

PRJ-71797

PRHF-46625

Gaia OS

Improved Clish logging. The daily "Warning! LOGNAME is missing" message is no longer generated during Health Check Point (HCP) runs.

PRJ-72444

PRHF-47439

Gaia OS

Improved the Gaia REST API on Multi-Domain Servers. API requests are no longer rejected with the error "Invalid X-Forwarded-Host header value" when the request includes the server hostname and port.

PRJ-72474

PRHF-45870

Gaia OS

Improved Gaia Job Scheduler handling of jobs migrated from R81.10, allowing their settings to be edited after an upgrade. Refer to sk185019.

PRJ-71953

PRHF-48025

Gaia OS

Improved the Gaia OS unlock user command to support locked-out non-local (RADIUS / TACACS+) users.

PRJ-71682

PRHF-47747

Gaia OS

Improved permission handling in the Gaia Portal for non-local administrators (RADIUS/TACACS+) when editing Virtual Systems and ElasticXL pages on VSNext. Refer to sk1000014.

PRJ-72623

PRHF-48807

Gaia OS

Following a previous incorrect VMAC calculation in ElasticXL VSNext mode, the system now verifies that all Virtual System (VS) MAC addresses assigned to port numbers 8 and higher are correctly configured and consistent across all members.

PRJ-71566

PRHF-47476

Gaia OS

After a fresh installation, restoring from a backup may fail. Refer to sk105883.

PRJ-71944

PRHF-47589

Gaia OS

In some scenarios, DHCP server leases fail when using ClusterXL High Availability (HA). Refer to sk1000015.

PRJ-73057

PMTR-132897

VSNext

In some scenarios, creating a Virtual Switch or Virtual Gateway with an interface that is already assigned to another Virtual Switch fails or leaves the interface attached to the original Virtual Switch bridge.

PRJ-70833

PRHF-46406

Traditional VSX

Improved SNMP daemon (SNMPD) stability during SNMP walk operations performed by third-party monitoring tools.

PMTR-134217

PRJ-72376

PRHF-47875

Mobile Access

Improved connectivity and reduced CPU utilization when handling Mobile Access WebSocket-based web applications through the Pinger process.

PRJ-72910

PRHF-49166

Mobile Access

In some scenarios, Mobile Access Citrix applications fail to connect to their servers after an upgrade, and the HTTPD process crashes. Refer to sk1000300.

PRJ-72233

PRHF-48208

VPN

In rare scenarios, the FWK process crashes on a cluster member after it joins the cluster while using Remote Access VPN.

PRJ-72238

PRHF-48242

VPN

In some scenarios, simultaneous VPN tunnel monitoring changes prevent RIM routes from being added or removed for some peers in environments with multiple peers and multiple IKED instances.

PRJ-71538

PRHF-47675

VPN

Remote Access VPN IKEv2 (Visitor Mode) traffic may be dropped with the error: "ipsec_encrypt failed: encrypted packet too big".

PRJ-72128

PRHF-45971

VPN

Enabling the "Exclude external IP from the VPN domain" option may incorrectly exclude the Security Gateway's main IP address, even when it is not configured as an external IP address.

PRJ-71660

PRHF-47754

VPN

In rare scenarios, a cluster member may enter a boot loop during an upgrade.

PRJ-72354

PMTR-131778

VPN

Improved Enhanced Link Selection handling when the Link Selection interface is down.

PRJ-71793

PRHF-47786

VPN

In some scenarios, the IKE process crashes during RIM startup.

PRJ-72534

PRHF-46914

VPN

VPN tunnel statuses are displayed as "Up-Phase 1" in SmartView Monitor. The issue is cosmetic.

PRJ-72710

PRHF-40667

VPN

In rare scenarios, the FWK process crashes during cryptographic random number generation.

PRJ-72348

PMTR-132256

SD-WAN

In a Multi-Domain Security Management Server with a Global VPN Community, changes to a Security Gateway configuration in one Domain are not reflected when a policy is installed on a Security Gateway in another Domain.

PRJ-72865

PMTR-133386

Cloud Firewall

Cloud Firewalls that run on modern GCP instance types and use gVNIC may fail to boot when configured with five or more network interfaces.

PRJ-73064

PMTR-132950

Cloud Firewall

In some scenarios, accessing Gemini in a web browser results in a blank page when HTTPS Inspection is enabled.

PRJ-72953

PMTR-130819

Cloud Firewall

Azure Cloud Firewall Gateways become unresponsive during reboot and fail to complete the restart process. Refer to sk185130.

PRJ-72084

CGNSIS-3011

Cloud Firewall

License distribution to Security Gateways may fail on a Security Management Server configured to use a non-default Web API port.

PRJ-72469

PMTR-132444

Scalable Platforms

On MHO-200, the Web UI Orchestrator Ports page may show an incorrect port state after you edit a port.

PRJ-71842

PMTR-131522

Scalable Platforms

Adding a VTI interface to a Virtual System in WebUI may fail.

PRJ-72703

PMTR-132629

Scalable Platforms

In some scenarios, creating a new scheduled backup to an SCP server fails.

PRJ-72754

PMTR-130701

Scalable Platforms

Disabling the Maestro Fastforward feature may fail with an error on the MHO side, preventing the deletion of rules.

PRJ-72223

PMTR-132214

Scalable Platforms

In some scenarios, a Security Group Member that fails to retrieve its configuration from the SMO may not perform the scheduled automatic reboot and may remain in the DOWN state until it is rebooted manually.

PRJ-72431

PMTR-132104

Scalable Platforms

The mass_tunnel interface may not come up during an upgrade when management traffic is routed through a data interface, causing policy installation to fail. Refer to sk184660.

PRJ-71780

PMTR-131289

Hardware

In some scenarios, transceiver hot-swapping between different speeds does not work due to firmware remaining in a stale state, requiring a reboot for the transceiver to function correctly.