R82 Jumbo Hotfix Take 130

Take 130 - New Functionality

PRJ-71512

PRJ-71834

SmartConsole

NEW: Added support for Assigned Global Policy, IPv6 network objects, Allowed / Non-Violating Services, and enhanced Audit Log & Change Report in the Policy Auditor.

PRJ-69924

Security Management

NEW: Added support for Threat Prevention AI Insights. Refer to sk183313.

PRJ-68780

PMTR-123894

Scalable Platforms

NEW: Upgrade monitoring is now available in the Insights Monitor providing visibility into the upgrade state of each member.

Take 130 - Improvements and Resolved Issues

PRJ-70571

PRHF-46358

Security Management

UPDATE: Added a new mds_backup parameter to limit the collection of migrate log files by age during Multi-Domain Server backups.

PRJ-71739,

MLS-4066

PRJ-69920,

PMTR-129145

PRJ-70799,

PRHF-34516

PRJ-70490

PRHF-45670

Logging

UPDATE: Added automatic maintenance for PCAP blob data stored in the DLP blob database file for more than 14 days. This is configurable via the log_policy.C file.

PRJ-65942,

PMTR-120965

FMW-6423

PRJ-67325,

PMTR-125405

PRJ-70219,

PMTR-129591

PRJ-72301

ODU-4721

Automatic Updates

UPDATE: Added Take 179 of Web SmartConsole. Refer to sk170314.

PRJ-72501,

ODU-4636

PRJ-72392

ODU-4714

PRJ-71881

ODU-4664

Automatic Updates

UPDATE: Added Take 100 and Take 101 of Policy Insights Release Updates. Refer to sk183421.

PRJ-72595

ODU-4882

Automatic Updates

UPDATE: Added Take 42 of CPM Doctor Release Updates. Refer to sk171505.

PRJ-72405

ODU-4612

Automatic Updates

UPDATE: Added Take 232 of OpenTelemetry Collector (CPotelcol) Release Updates. Refer to sk180522.

PRJ-72402

ODU-4619

Automatic Updates

UPDATE: Added Take 99 of OpenTelemetry CPviewExporter Release Updates. Refer to sk180521.

PRJ-71873

ODU-4643

Automatic Updates

UPDATE: Added Take 96 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-71729

ODU-4577

Automatic Updates

UPDATE: Added Take 35 of CloudGuard Controller Release Updates. Refer to sk181842.

PRJ-71867

ODU-4657

Automatic Updates

UPDATE: Added Take 44 of Check Point Portal REST API Adapter. Refer to sk183186.

PRJ-72411

ODU-4626

Automatic Updates

UPDATE: Added Take 156 of OpenTelemetry Agent (OtlpAgent) Release Updates. Refer to sk181615.

PRJ-72270

ODU-4728

Automatic Updates

UPDATE: Added Take 326 of CME (Cloud Management Extension) for Cloud Firewall Release Updates. Refer to sk157492.

PRJ-66881

PRHF-44016

Upgrade Tools

In certain scenarios, the Security Management upgrade may fail with the "HV000028: Unexpected exception during isValid call" error when managing a large number of Spark Firewall Appliances. Refer to sk184946.

PRJ-67335

PMTR-125404

Security Management

In a Multi-Domain Security Management Server environment, the FWM daemon at the MDS level may fail to start when TCP port 18190 is bound to more than one IP address.

PRJ-69412

PRHF-45782

Security Management

In some scenarios, upgrading a Security Management Server may fail during the database import with a "Failed to parse the upgrade data" error if the environment contains more than 32K IPS protections.

PRJ-70723

PRHF-46769

Security Management

Policy installation may be slow when the policy includes large groups with exclusions.

PRJ-71201,

PRHF-47306

PRJ-70647

PRHF-46607

Security Management

The PostgreSQL process on the Security Management Server may intermittently experience high CPU usage.

PRJ-68499

PRHF-45171

Security Management

In rare scenarios, deleting a policy package fails with the "Object with uid=UUID was deleted from database but its object map mirror wasn't found" error message.

PRJ-72102

PRHF-47813

Security Management

In some scenarios, an administrator may occasionally fail to log in due to the password being unexpectedly rejected. Refer to sk1000158.

PRJ-69318

PRHF-45586

Security Management

In some scenarios, deleting a Domain fails with the message: "Delete Domain Server completed on MDS <Multi-Domain Server Name> but sync to remote MDSs failed."

PRJ-71389

PRHF-47401

Security Management

Users may be unable to log in to a domain using the login-to-domain API command on the Multi-Domain Security Management Server. Refer to sk185248.

PRJ-66980

PRHF-44128

Security Management

In rare scenarios, the FWM process on a Multi-Domain Security Management Server may unexpectedly exit, creating a core dump file.

PRJ-70194

PRHF-45993

Security Management

The FWM process may crash on the Security Management Server during a license contract update, resulting in intermittent failures of management API calls and SmartConsole logins with an authentication error.

PRJ-71085

PRHF-47243

Security Management

In a rare scenario, the FWM process on a Multi-Domain Security Management Server may unexpectedly exit and generate a core dump file.

PRJ-66646

PRHF-44105

Security Management

When a RADIUS role-based user logs in to GuiDBEdit, the system might validate the login against the local database instead of the RADIUS template, causing a local user account to be created.

PRJ-71601

PRHF-47762

Security Management

When launching SmartProvisioning from SmartConsole, SmartProvisioning may prompt for administrator credentials instead of automatically using Single Sign-On (SSO). Refer to sk1000063.

PRHF-47005

In some scenarios, in a Management HA deployment, SmartProvisioning commands sent to Check Point Spark Firewalls remain in the "In Progress" state and do not complete when the standby management server is active.

PRJ-70403

PMTR-129675

Security Management

Accelerated Install Policy fails on Security Gateways running versions lower than R82 with a Dynamic IP Address (DAIP) with the "No IP address found in the peer object definition" error message.

PRJ-71228

PRHF-47362

SmartProvisioning

In rare scenarios, the "Update Corporate Office Gateway" option in SmartProvisioning may fail when used on Traditional VSX Gateways.

PRJ-59639

PRHF-38431

Logging

In some scenarios, filtering Endpoint Security logs by destination port may result in a query failure that requires closing and reopening the logs tab.

PRJ-70837

PRHF-46574

Logging

In some scenarios, after upgrading a Security Management Server using the Advanced Upgrade method, the CPD process may unexpectedly exit and fail to restart.

PRJ-70191

PRHF-46182

Logging

In some scenarios, the LOG_INDEXER process may unexpectedly crash while reading log files.

PRJ-70460

PRHF-46580

Logging

In a Multi-Domain Security Management environment, when viewing logs for a specific domain in SmartConsole, a "Problems have occurred during search: Query resolution failed / Log Resolution failed" error message may appear, and logs may not display properly.

PRJ-65476

PRHF-43069

Logging

In some scenarios, the output of the fwm logexport command may differ from previous versions, leading to skewed or inaccurate results in scripts that rely on parsing this output.

PRJ-70324

PRHF-44419

Logging

In some scenarios, logs in SmartConsole may be incorrectly classified under "Log Update" instead of the actual originating category.

PRJ-69959

PRHF-46062

Logging

When viewing Application Control logs in SmartView, the Program Name column may be missing, making it difficult for administrators to identify the blocked application directly from the log view.

PRJ-65465

PRHF-42980

Logging

The CPSEMD process may unexpectedly exit when the Security Management Server is restarted.

PRJ-67935

PRHF-45055

Logging

In some scenarios, the system may not correctly report SOLR index deletion results in the run_maintenance.elg debug file.

PRJ-62332

PRHF-40738

Logging

In some scenarios, the SMARTLOG_SERVER process may unexpectedly exit and generate a core dump.

PRJ-61576

PRHF-40124

Logging

In SmartView, exporting logs to CSV may return only 100 entries, even if a higher export limit is selected, when network objects with special characters in their names are included.

PRJ-69286

PRHF-45700

Logging

In some scenarios, the LOG_INDEXER process may crash unexpectedly when multiple log server connections are active, and one of the connections is disconnected.

PRJ-63764

PRHF-41582

Logging

In some scenarios, certain Mobile Access log fields in SmartConsole may display no data or appear mismatched between the log view and the logs table. In addition, including all log fields may lead to the log view breaking.

PRJ-69147

PRHF-35099

Logging

In some scenarios, the FWD process may fail to move blob files from the temporary blob directory, causing it to grow continuously and consume excessive disk space.

PRJ-71013

PRHF-47170

Logging

In Smart-1 Cloud, logs may stop appearing in the Logs and Monitor view because the log export service fails to start when a stale process file is present.

PRJ-70992

PMTR-130811

Logging

When closing the SmartEvent application, the "Check Point SmartEvent Client has experienced a serious problem and must close immediately. Technical information will be saved in <SmartConsole path>. If this problem persists, please contact technical support." error message appears. Refer to sk185212.

PRJ-61856

PRHF-40192

Logging

In some scenarios, a redundant "CPSEMD low disk space notification" message may appear despite ample free disk space.

PRJ-69981

PRHF-46008

Logging

In some scenarios, when scrolling through logs in SmartConsole, log loading may stop before showing all matching results.

PRJ-64878

SMBGWY-16234

Security Gateway

Improved connectivity for LSV peer traffic after an ISP failover.

PRJ-70740

PRHF-46695

Security Gateway

Improved HTTP/2 flow-control handling to prevent the dropping of legitimate long-lived connections to AI assistant tools.

PRHF-36812

PRJ-66697,

PRA-5192

PRJ-71368

PRHF-47526

Security Gateway

Google reCAPTCHA failed to load in Firefox with HTTPS Inspection enabled. Refer to sk185265.

PRJ-68160

PRHF-44996

Security Gateway

In some scenarios, softlockups may occur during the dynamic objects update process. Refer to sk184887.

PRJ-71406

PMTR-131337

Security Gateway

On Traditional VSX / VSNext setups, a hard reboot could result in a boot loop because of a corrupted CPU affinity file. The file is now detected and automatically rebuilt during startup to prevent this issue.

PRJ-72113

PRHF-47698

Security Gateway

Websites returning large HTTP/2 response headers may fail to load when HTTPS Inspection is enabled.

PRJ-70879

PMTR-126185

Security Gateway

When the Priority Queue feature is enabled, SGM may crash creating a vmcore file.

PRJ-69232,

PMTR-128018

PRJ-71621

PMTR-127891

Security Gateway

VPN traffic may generate excessive debug messages containing fwhold_send_enqueue in the fwk.elg log file when traffic is held and later resumed. This is a cosmetic issue and does not affect traffic handling.

PRJ-58159

PRHF-37101

Identity Awareness

The identity deletion process returned an incorrect error message "HTTP 500: GENERIC_INTERNAL_ERROR ... Failed to send disassociation to PDP" even though the identity was successfully removed from the database.

PRJ-70408

PRHF-45776

Identity Awareness

In rare scenarios, a failover on a PDP operating within a Maestro dual-site environment may result in missing identities on the PEP side. Refer to sk185057.

PRJ-69620

PRHF-45953

IPS

Improved handling of rejected HTTP/2 cleartext (h2c) upgrade attempts to ensure connections recover gracefully and prevent inconsistent failure states.

PRJ-65888

PRHF-43440

Anti-Virus

In some scenarios, Anti-Virus may drop traffic with the message "HTTP parsing error occurred" in the SmartConsole log when inspecting WebSocket traffic. Refer to sk184605.

PRJ-71391

PMTR-131300

SSL Inspection

In rare scenarios, Security Gateway memory consumption may gradually increase while inspecting TLS connections.

PRJ-68834

PRHF-45470

ClusterXL

In rare scenarios, traffic forwarded between cluster members via the Sync interface is not routed properly.

PRJ-70802

PMTR-130359

SecureXL

When deleting a GRE or VXLAN interface, the Security Gateway may fail to fully release dynamically allocated resources if SecureXL User Mode is enabled.

PRJ-62834

PRHF-41024

SecureXL

Adding SecureXL Rate Limiting rule with country codes fails on VSX. Refer to sk112454 and sk183992.

PRJ-66929

PRHF-44063

Gaia OS

In some scenarios, incorrect CPU usage statistics are displayed by the cpstat command and through SNMP on Maestro systems.

Refer to sk184654.

PRHF-48564

PRJ-68247

PRJ-71187

Gaia OS

Added Multi-Queue support for Azure and Hyper-V gateways using the synthetic network driver (hv_netvsc) without SR-IOV (Accelerated Networking).

PRJ-72720,

PMTR-132662

PRJ-71385

PRHF-47560

Gaia OS

Check Point Process Manager (PM daemon) fails to correctly monitor the DNSMASQ process.

PRJ-69652

PMTR-129995

Gaia OS

UPDATE: Outbound HTTP requests now consistently use the HTTP/1.1 protocol, ensuring compatibility with strict load balancers and enabling successful completion of downloads.

PRJ-70952

PMTR-126219

Gaia OS

Improved the IDNS resolver to handle empty configuration files, which previously caused Domain objects to not populate and led to policies referencing those objects to fail to match traffic. Refer to sk185150.

PRJ-72199

PRHF-48214

Routing

In some scenarios, when using routing separation and dynamic routing, dynamic routing synchronization may not function properly after an upgrade.

PRJ-71556

PRJ-71467

Traditional VSX

The vsx_util upgrade command may fail to properly update the Security Management database when upgrading.

PRJ-70137,

PMTR-129460

PRJ-70267,

PMTR-129382

PRJ-67830

PRHF-45025

VPN

In some scenarios, users are unable to create a tunnel in Traditional Mode VPN.

PRJ-70283

PRHF-46268

VPN

Intermittent RADIUS communication issues affecting Remote Access VPN users.

PRJ-69235

PMTR-126602

VPN

In Remote Access, a mobile client may fail to connect to the Security Gateway even though a supported integrity algorithm is available in the supported algorithms list.

PRJ-70778

PRHF-46720

VPN

In some scenarios, access roles may intermittently fail to match with IKEv2 Remote Access clients.

PRJ-70479

PMTR-129839

VPN

In some scenarios, IKEv2 tunnel narrowing may be incorrect in the Encryption Domain per community configuration with a Check Point peer.

PRJ-70519

PRHF-46560

VPN

In some scenarios, Site-to-Site VPN tunnel against 3rd-party flaps every 2 minutes.

PRJ-69038

PRA-5212

VPN

In some scenarios, a memory leak may occur in the DPD flow in IKEv1 and IKEv2.

PRJ-65881

PRHF-41703

VPN

Frequent Site-to-Site VPN Phase 1 tunnel renegotiations may cause connectivity disruptions.

PRJ-70306

PRHF-46355

VPN

Site-to-Site tunnels with third-party devices may go down intermittently as a result of DPD collisions when MEP or Permanent Tunnel is enabled.

PRJ-72536

PRHF-46914

VPN

VPN tunnel statuses are displayed as "Up-Phase 1" in SmartView Monitor. The issue is cosmetic.

PRHF-41872

RHF-47675

VPN

Remote Access VPN IKEv2 (Visitor Mode) traffic may be dropped with the error: "ipsec_encrypt failed: encrypted packet too big".

PRJ-67297

PRHF-44381

SD-WAN

In rare scenarios, SD-WAN overlay probing packets may be improperly handled under specific VPN routing configurations.

PRJ-65677

SDWANGW-5963

SD-WAN

In some scenarios, SD-WAN may fail to establish overlay tunnels when used with a Cross AZ cluster.

PRJ-70244

PRHF-46338

Scalable Platforms

In rare scenarios, invalid site count values in Maestro dual-site Security Groups may cause cluster flapping and traffic impact.

PRJ-71212

PMTR-129898

Scalable Platforms

Contracts downloaded from the User Center by a Security Group Member may get deleted after Policy Installation because the SMO member's contract file overwrites the member's local file.

PRJ-71327

PRJ-71164

Scalable Platforms

Upgrades with a Fast Deployment Package may revert CoreXL configurations to their default settings.

PRJ-70254

PMTR-126562

Scalable Platforms

On Maestro running in VSNext mode, configuring a data.vlan interface as the management interface does not update the MHO's uplink with the corresponding VLAN ID.

PRJ-70727

PRHF-46898

Scalable Platforms

When enabling the Maestro Fastforward feature, ARP checks may fail on non-SMO members during activation.