R82 Jumbo Hotfix Take 41

Take 41 - New Functionality

PRJ-62356

Security Management

NEW: Web SmartConsole now supports Spark Firewall Apppliances and Security Gateways with a Dynamic IP Address (DAIP).

PRJ-60279,

PMTR-114156

Application Control

NEW: This Take introduces the Dynamic URL List feature is an enhancement to the Custom Applications / Sites object (sk165094), allowing to maintain a dynamic list of URLs based on a feed file.

Refer to R82 Security Management Administration Guide> > Topic "Creating Application Control and URL Filtering Rules".

Take 41 - Improvements and Resolved Issues

PRJ-63329,

PRHF-41560

HTTPS Inspection,

VPN

UPDATE: Updated CRL and OCSP validation in Remote Access VPN, Site-to-Site VPN, and HTTPS Inspection to use HTTP/1.1 instead of HTTP/1.0. This ensures continued compatibility with DigiCert's updated requirements and prevents certificate validation failures. Refer to sk183884.

PRJ-63136,

PMTR-116712

Security Management

UPDATE: Added a new Gaia Clish command "cplic ignore_expired_ngtx 1" that allows administrators to disable license status monitoring for expired Next Generation Threat Extraction (NGTX) licenses in SmartConsole. Run this command on each Cluster Member or Virtual System that reports an error and restart the services with the "cpstop;cpstart" commands.

PRJ-62387,

PMTR-117127

Security Management

UPDATE: Added a new API version (2.0.1). Refer to the Management API Reference.

PRJ-62454,

MGMTPROD-1952

Security Management

UPDATE: Added new Management API commands to configure synchronization with User Center: "show sync-with-user-center" and "set sync-with-user-center" which was previously only configurable through the SmartConsole GUI. Refer to sk94064.

PRJ-61286,

PRHF-39744

Security Management

UPDATE: The upgrade duration for the Security Management Server and Multi-Domain Security Management Server has been reduced by up to 60%.

• The fix will only be applied if the upgrade to R82 Jumbo Hotfix Accumulator Take 41 or higher is done using a Blink image or the Advanced Upgrade method.

PRJ-59285,

PRHF-38115

Security Management

UPDATE: JRE is updated from version 8.0_8.26 to version 8.0_8.35.

PRJ-62308,

PMTR-117039

Security Management

UPDATE: Added the "show-only-local-domain" field to API queries to return only objects from the current local Domain.

PRJ-61672,

PMTR-89079

Security Management

UPDATE: Improved the "fw tab" CLI command help by adding descriptive explanations for each option.

PRJ-62157,

PMTR-116839

Logging

UPDATE: Extended the "show logs" API to support Infinity Copilot queries in on-premises logs.

PRJ-61188,

FMW-3427

URL Filtering

UPDATE: URL Filtering provides now better categorization for non-inspected HTTPS connections by proactively re-validating certificates before the "Categorize-HTTPS" cache entry expires.

PRJ-61816,

PRHF-20323

VPN

UPDATE: Modified the default behavior of the legacy Policy Server daemon (DTPSD). By default, this daemon now starts in the "DOWN" state unless explicitly configured otherwise. Refer to sk183803.

PRJ-61642,

PMTR-115412

Gaia OS

UPDATE: In the Gaia Portal login, added support for the period character (".") in RADIUS and TACACS usernames. This feature is disabled by default. Refer to sk183201.

PRJ-62423,

VSECPC-10838

CloudGuard Network

UPDATE: Added support for GCP NSI (Google Cloud Platform Network Security Integration) solution.

PRJ-59472,

PMTR-109854

Scalable Platforms

UPDATE: Added option to use the local IP address 127.0.0.1 for license creation for Maestro Security Group members.

PRJ-61577,

HEC-1383

Scalable Platforms

UPDATE:

Added ElasticXL support for Virtual Machines with Virtual Machines. Refer to sk183513.

Additionally, in the Insights tool:

• Added support for the Insights tool, which was previously only available on Scalable Platforms. Use the "insights --activate" command to activate the tool in non-scalable environments.

• Added Virtualization table (a VSX feature) when running Insights from VS0.

• The Performance widget is now also accessible with the Gaia Clish command "show cluster info performance".

PRJ-62023,

PRHF-40184

Security Management

In SmartConsole, deleting a license in the Licenses tab of a Security Cluster object fails with the "Domain Management Server licenses cannot be removed from the Domain Management Server level" error.

PRJ-61293,

PRHF-39777

Security Management

The $MDS_FWDIR/log/ directory may contain multiple api_status_UUID.json files.

PRJ-61290,

PRHF-39256

Security Management

In rare scenarios, login to the Security Management Server may fail with timeout.

PRJ-58577,

PRHF-36096

Security Management

In some scenarios, the PostgreSQL database fully utilizes disk space on the Security Management Server.

PRJ-59085,

PRHF-37999

Security Management

Policy installation is delayed because of the FWM process load. Refer to sk183563.

PRJ-63369,

PRHF-41564

Security Management

Backup file size on the Security Management Server grows after an upgrade. Refer to sk183835.

See Critical Information for R82 Jumbo Hotfix Accumulator.

PRJ-61322,

PRHF-39817

Security Management

Reassigning Global Policy takes a few hours after updating IPS Snort protections.

PRJ-59928,

PRHF-38237

Security Management

In some scenarios, the Changes Report is not attached to the email sent by the SmartTask configured with the "After Publish" trigger and the "Send Mail" action.

PRJ-62184,

PMTR-116869

Security Management

SAML authentication fails for Web SmartConsole on port 4434, redirecting to an invalid URL (https://localhost:4434:4434/smartconsole/transport) and preventing SSO login, while SmartConsole GUI authentication works normally.

PRJ-61669,

PRHF-39885

Security Management

In some scenarios, SmartConsole disconnects when installing policy if there are 50 installation targets or more.

PRJ-59666,

PRHF-37860

Security Management

Compliance scan finishes successfully but does not show any data in SmartConsole.

PRJ-62138,

PMTR-115488

Security Management

Running the Management API "show-object on access-role object" command may fail with "generic_server_error".

PRJ-59760,

PMTR-108985

Security Management

The Management API command "add-custom-ca-certificate" may fail with a "general error" if the administrator does not provide the Base64-certificate parameter.

PRJ-62230,

MGMTPROD-436

Security Management

The Management API command "set-access-rule" returns the error "You must enable the Granularity option 'Session' for the Track option 'Log' if the rule specifies an application or a Contact Type" when adding an application to an Access Control rule with "service" set to "none" and "track" set to "log".

PRJ-57314,

PRHF-36228

Security Management

In some scenarios, the Management API command "where-used" with details-level set to "full" may fail with a "generic_internal_error" message, if the queried object is part of a Threat Prevention Exception Group.

PRJ-62093,

PRHF-40268

Security Management

In SmartConsole, when viewing the License tab of a Security Gateway object, multiple duplicated VSEC licenses with the same signature may be shown.

PRJ-62314,

PRHF-40748

Security Management

The FWM daemon may leak and then exit.

PRJ-60678,

PMTR-114726

Security Management

The Management API commands "add-lsm-gateway" or "add-lsm-cluster" may report success even when IKE certificate creation fails.

PRJ-61533,

PRHF-39869

Security Management

In the Compliance view, when clicking the picker in the "Source" or "Destination" columns while creating a custom Firewall Best Practice, the network objects list shows "Loading" and loads slowly.

PRJ-63105,

PMTR-118295

CPView

In a VSX environment, the CPVIEWD daemon may exit and produce a core dump file.

PRJ-59194,

PRHF-38042

Logging

When viewing certain reports in SmartView, the "No data found" error may appear even when matching logs exist.

PRJ-58762,

PRHF-37638

Security Gateway

Incorrect bonds may be shown in the Data Plane when using MDPS and running the Gaia Clish command "show configuration bonding".

PRJ-61352,

PMTR-115638

Security Gateway

In the CPView > Network > Templates > Accept-Templates, the concurrent templates may have a bogus value such as 18,466,744,073,709,551,585.

PRJ-60754,

PRHF-39368

Security Gateway

Non-HTTP connections may be incorrectly dropped because of a missing Host header when the Gateway operates as a proxy.

PRJ-61909,

PMTR-116366

Security Gateway

Missing cleanup when template connection creation fails prevents the system from exiting new connection context mode, causing subsequent connection operations to write incorrectly to the cache instead of the connection table.

PRJ-60900,

PRHF-39414

Security Gateway

Traffic is dropped with a "MatchedOptimized Drop" message, although it is allowed by configurations in the Rule Base. Refer to sk183443.

PRJ-61425,

FMW-4633

Security Gateway

VSEC licenses may be automatically deleted and re-added on the Security Management Server (SmartCenter in Azure), creating duplicate license strings with mismatched signatures and causing intermittent "License with CK already exists" errors.

PRJ-59546,

PRHF-38154

Security Gateway

In some scenarios, the "Use of undefined constant session" warning is frequently printed in the SAML Portal's /opt/CPVPNPortal/logs/error_log file.

PRJ-61865,

PRHF-40249

Security Gateway

In rare scenarios, the WSDNS daemon may exit instead of shutting down gracefully.

PRJ-57282,

PRHF-36273

Security Gateway

The $CPDIR/bin/update_license_conf script incorrectly parses the allowed cores count, setting "ALLOWED_CORES=-1" and causing Check Point Virtual Machine system corruption and daemon failures when CPU increases.

PRJ-62107,

PRHF-40509

Security Gateway

The Clone Policy Package task in SmartConsole fails with the "The object name must not contain whitespace characters at the beginning or the end" error. Refer to sk161294.

PRJ-62462,

PRHF-27185

Security Gateway

Stability issues for Data connections (RDP / RTP / FTP / ETC). Refer to sk179651.

PRJ-62121,

PRHF-40597

Security Gateway

The SAML authentication flow may fail on a VSX Gateway.

PRJ-62418,

PRHF-31491

Security Gateway

Unexpected cluster flapping may occur during signature load.

PRJ-61012,

PRHF-39339

Security Gateway

After upgrading the Security Gateway, Remote Access IPSec VPN connections using Endpoint Security VPN E88.60 fail. Authentication succeeds, but all client connections through the Security Gateway are dropped by the Cleanup Rule.

PRJ-61053,

PRHF-39655

Security Gateway

After a system restarts (for example, reboot or cprestart), FWD process-related sub-processes such as VPND and PDP may not run. Refer to sk183446.

PRJ-60757,

PMTR-114362

Security Gateway

In rare scenarios, the local connection route may be incorrect when the ICAP client is active.

PRJ-62867

Security Gateway

In certain scenarios, the size of the $SAMLPORTAL_HOME/logs/error_log file may continuously increase, potentially consuming a significant amount of disk space.

PRJ-57055,

PRHF-28783

Content Awareness

Disk space may not be cleared as expected when Content Awareness is the only enabled Software Blade.

PRJ-62792,

PMTR-115931

URL Filtering

The FW_FULL process may exit in the Dynamic URLs list update flow.

PRJ-62257,

PMTR-116639

URL Filtering

In rare scenarios, the FWK process may crash when the URL Filtering Software Blade is enabled.

PRJ-62443,

PRHF-40727

IPS

Security Gateway blocks the download of files larger than 4 GB with the log "Application Control - HTTP parsing error occurred" in SmartConsole. Refer to sk183681.

PRJ-60271,

PMTR-113602

DLP

A potential memory leak because of many DLP/FILE_CONVERT processes spawned.

PRJ-60840,

PRJ-60821

Anti-Virus

False threat alerts may appear in Anti-Virus logs for benign traffic (action: accept). This is a cosmetic issue with no security impact.

PRJ-57445,

PRHF-36348

ClusterXL

Virtual System in a VSX VSLS Cluster does not fail over when a cluster interface goes down. Refer to sk182734.

PRJ-62145,

PMTR-116446

SecureXL

After an upgrade, the USIM process may exit.

PRJ-62691,

PMTR-117113

SecureXL

When the Security Gateway runs in User Mode SecureXL (UPPAK), removing a VLAN impacts connectivity on other VLANs in Bridge mode that share the same physical interface.

PRJ-63052,

PRHF-41230

SecureXL

When there are a large number of SNDs operating with Intel NICs, the system could run low on available jumbo mbufs, leading to connectivity issues. Refer to sk183771.

See Critical Information for R82 Jumbo Hotfix Accumulator.

PRJ-59180,

PRHF-37771

Routing

The multicast stream may not resolve correctly in VSX topologies. Packets are dropped with the "IP multicast routing failed (missing OS route)" message.

PRJ-59305,

PMTR-111436

VPN

IKE related core files may be generated when passing traffic through a VPN tunnel.

PRJ-60073,

AAD-5014

VPN

Rare VPN connectivity issues caused by Encryption Domain overrides in communities with third-party Gateways.

PRJ-61969,

PRHF-40481

VPN

The VPND or IKED daemon may exit during IKEv2 negotiation.

PRJ-62486,

PMTR-117252

VSX

In some scenarios, the FWM process exits during VSX provisioning, and the VSX Provisioning operation fails. Refer to sk184502.

PRJ-60693,

PMTR-114063

VSX

In rare scenarios in a VSX environment, after a Virtual System (VS) starts, it becomes stuck in Down state with a "FullSync" pnote.

PRJ-62379,

PMTR-117339

VSNext

The Security Gateway may crash when recreating a Virtual Gateway.

PRJ-61295,

HEC-1345

VSNext

In the VS0 context, physical resources per VS may not be visible when using the "cpview -m" command, although they are available in the CPView tool.

PRJ-59657,

PRHF-38449

Gaia OS

The 1.3.6.1.4.1.2620.1.6.7.5.1.5 SNMP OID (multiProcUsage) reports wrong values when HyperFlow is enabled.

PRJ-61756,

PMTR-115846

Gaia OS

Traffic routing may fail between the host and PPPoE / DNS Server through the Security Gateway, even though host-to-gateway and gateway-to-DNS connections work as expected.

PRJ-61814,

PRHF-40409

Gaia OS

SNMP Agent may report a wrong value for VLAN Interface Speed.

PRJ-62384,

PRHF-40893

Gaia OS

SNMP data types in the "asg" MIB tree (for Scalable Platform Security Groups) may be incorrect.

PRJ-62222,

PRHF-40517

CloudGuard Network

If the User Center connection fails, contracts may be retrieved incorrectly, resulting in erroneous contracts getting pushed to the Security Gateway.

PRJ-61980,

PRHF-40203

CloudGuard Network

Changes made to the JSON file of a Generic Data Center object may take a long time to appear in SmartConsole or Management API, although enforcement on the Security Gateway functions as expected.

PRJ-62129,

PMTR-116761

Scalable Platforms

In Gaia Portal, there is a hardcoded maximum limit of 32 firewall instances for CoreXL configuration, although the correct maximum should be based on the actual number of CPU cores available on the machine.

PRJ-59366,

HEC-1235

Scalable Platforms

Redundant logs from "Alerts Events" in the Insights tool. The issue is cosmetic only.

PRJ-59780,

PMTR-111817

Scalable Platforms

Policy installation may fail on newly added Security Group members because an updatable object package is missing.

PRJ-61345,

PRHF-39863

Scalable Platforms

The "asg diag verify" command reports inconsistent OSPFv3 routes on Maestro Security Group Members. Refer to sk179931.

PRJ-62519,

PMTR-117435

Scalable Platforms

The CPVIEWD daemon may exit on a VSX Gateway.

PRJ-62574,

PMTR-117483

Scalable Platforms

Security Group members changing from ACTIVE state to READY state may cause traffic impact.

PRJ-59056,

PRHF-37439

Carrier Security

The Security Gateway may crash after dropping corrupt GTP-C (control traffic) packets.