R82 Jumbo Hotfix Take 14

NEW:

• Added ARP Next-Hop prober to enhance support for additional network topologies.

• Introduced HTTP prober to reflect real-time Web Access metrics.

• Implemented Link Aggregation mode proportional to Download and Upload bandwidth.

• Administrators are now able to override SD-WAN interface Circuit configuration.

• Integrated Forward Error Correction to ensure successful traffic delivery by adding error correction code packets to the Overlay packet stream.

• Introduced Dynamic Objects (SD-WAN Internet, My VPN Domain, and Peer VPN Domain) to better represent Overlay and Internet address spaces.

• Added administrator control for Symmetric Packet Return, forcing Ingress Traffic to be replied on the same ISP.

• Enabled SD-WAN Overlay establishment across different Domains using Global VPN Community (MDS).

• Allowed SD-WAN Overlay to operate on top of Route-based VPN.

• Increased maximum Overlay size to support up to 500 Security Gateways.

• Improved accuracy of SD-WAN decision-making during policy installation.

• Enabled setup of IPv4 SD-WAN overlay when non-SD-WAN IPv6 interfaces are configured.

UPDATE: Resolved CVE-2024-52888 - Mobile Access File Share applications are vulnerable to stored XSS attacks. Refer to sk183055.

UPDATE: The Global Domain automatic purge settings now automatically restore and reschedule after a Security Management Server restart.

UPDATE: Reduced memory usage of LDAP keepalives and improved connection error handling, resulting in improved system reliability and security performance.

UPDATE: Added a new Gaia Clish parameter to ignore the Autonomous System (AS) Path when aggregating routes: "set aggregate <IP Address>/<IP Mask> aspath-ignore {on | off}". Note, enabling "aspath-ignore" will disable "aspath-truncate" if configured.

UPDATE: Optimized memory management when processing Jumbo Frames.

UPDATE: In ElasticXL, restoring Gaia OS backup is now supported.

In VSNext ElasticXL Load Sharing environments, traffic latency and interface flapping may occur between two members in the Virtual Switch (VSW), when the switch is configured on non-management interfaces and both members are on the same site.

In SmartConsole, in the Quantum Spark Cluster object, editing the interfaces (manually or with the "Get Interfaces" action) fails with an unclear error message "Failed to save object".

In rare scenarios:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

Scheduled Snapshot Issues:

• Gaia may not recognize the Remote Server as a known host during scheduled backup creation, even after following sk164234 instructions.

• The "Remote server identity is not known by Gaia" error is displayed despite proper HBA configuration.

• The "set snapshot-scheduled recurrence monthly" command fails when using the "all" option.

Refer to sk182665.

In some scenarios, SmartTasks triggered by "after submit", "approve" and "reject" events fail to run.

In some scenarios, deleting a Security Gateway object fails if the Security Gateway is a participant in the Global VPN Community.

In the "Gateways and Servers" tab, when opening a shell on a specific Security Gateway, a "Connection failed" message pops up.

Performing changes to the Global Properties may not be possible if:

• Encryption algorithms in Remote Access > VPN-Authentication and encryption are SHA384 or SHA512.

• There is at least one Security Gateway configured with a version lower than R81.

In rare scenarios, an upgrade of Multi-Domain Security Management Server, handling Domain Log Server certificates, may get stuck.

• The fix will only be applied if the upgrade to R82 Jumbo Hotfix Accumulator Take 14 or higher is done using a Blink image or the Advanced Upgrade method.

In some scenarios, in Log Servers or Multi-Domain Log Modules (MLM):

• The SOLR process consumes high CPU.

• There is a delay in displaying logs in the Logs view.

GTP-U traffic may be dropped because of incorrect message type handling.

Security Gateway with QoS enabled may crash because of a rare race condition.

In the HTTP/2 connection scenario, the tenant restriction header injection mechanism encountered an issue affecting the connectivity.

In a rare scenario, the FWK process may exit when HTTPS Inspection is enabled and TLS connections are inspected on non-standard ports (ports other than 443 or 8080).

Android devices' HTTP HEAD requests to Google services are blocked by Security Gateway proxy, generating excessive logs that impact Security Gateway performance through high CPU usage. Refer to sk182990.

PPPoE interface fails to restart when it is disconnected from the Server side. Refer to sk182154.

In a rare scenario, the PDPD process may unexpectedly exit during the PDP sharing flow.

HTTPS Site Categorization fails to properly handle unsupported QUIC protocol versions, causing classification errors instead of following the configured fail-mode (open/close) policy.

The DLP blade may not block the password-protected files of a specific type, although it should.

HTTPS inspection session logs lack detailed explanations in the "explanation" field, displaying generic messages that do not clarify action reasons. This is a cosmetic issue.

During cluster startup with routing separation enabled, a mismatch between routing and firewall process initialization can trigger premature full synchronization pnotes when the routing process is not fully synchronized.

In some scenarios, a memory leak occurs in the FWK process when SecureXL fails to update an existing route's next hop.

SecureXL User Mode crashes if an acceleration card interface has an MTU above 9000 and receives frames larger than 9234 bytes.

Static routes may get permanently deleted from the kernel during rapid interface configuration changes when there is a large number of routes.

Capsule VPN connectivity failures may occur after a configuration change of the VPND daemon table parameters.

Authentication failure may occur when an IKEv2 VPN Endpoint client connects using a machine certificate configured for a specific realm.

When configuring machine authentication without an LDAP server, the computer is authenticated during the connection with the RA VPN. However, the logs in SmartConsole do not display the "Authenticated machine ..." message as expected.

Different members in a Quantum Maestro environment may show different statuses for VPN probes.

Remote Access VPN client repeatedly reconnects to a VPN Virtual System when it connects through another Virtual System on a Scalable Platform in the VSX/ VSNext mode. Refer to sk183052.

The ROUTED daemon fails to start when a VTI is configured with a local IP address that matches the next-hop address used in the static route configuration. Refer to sk182848.

Security Group Member may be in Down state during the license distribution to Maestro Security Group members. Refer to sk181245.

In a Maestro environment, a Security Gateway may enter a reboot loop because of sync issues of the settings.fwset file.