# QUANTUM SOFTWARE R82

## FEATURE LIST

---

# Threat Prevention

## 1. AI-based Prevention Engines

- **ThreatCloud Graph—knowledgebase to form relationship attack patterns**
- **Kronos—Behavioral algorithms detecting malicious activity**
- **Deep Brand Clustering—Prevent phishing campaigns based on local/global brands**
- **Dynamic classification of uncategorized websites—Dynamic URL categorization**

## 2. Improved DNS Security Capabilities

- **Advanced DNS protection against Non-Existent Domain (NXNS) Attack**
- **Support for DNS over HTTPS (DoH) protocol**
- **Configuration granularity—Adv DNS Security settings in the Threat Prevention profile**
- **Detailed DNS Security statistics—Now available in the SmartView Dashboard**

## 3. Automatic Security Services

- **Zero Phishing, Anti-Virus, Anti-Bot and IPS blades more accessible, simpler and easier user experience**
- Zero Phishing Automatic mode—simplifying the configuration to make activation even easier
- Anti-Virus and Anti-Bot blades are now activated by default in newly created gateways/clusters—SK182106
- Automatically load and update SNORT rules file as IoC feed, enforced as new IPS protections

## 4. Web Security

- **Support of HTTP/3 protocol over QUIC transport (UDP) for Network Security, Threat Prevention, and Sandboxing**

### p .2

---

# 5. HTTPS Inspection

- **Enhanced UI—fully managed from SmartConsole**
- Enhanced policies
- Dedicated policy for inbound inspection
- Enhanced default outbound policy
- Certificate management views for inbound and outbound policies
- Trusted CA package—New view to manage Trusted certs
- Advanced settings—New view to configure advanced settings, including R82 new features
- **Client Side Fail mode**
- Automatically detect client-side SSLi failures, such as pinned certs, and automatically flags connections to be bypassed in future attempts. AI learning capabilities from these failures to identify similar connections.
- Endpoint Detection—Identifies endpoints without deployed outbound CA certificate
- **Bypass under load**
- Optional bypass in case of high CPU load
- **Learning mode**
- Gradual & Smart deployment
- Activated during deployment of SSLi, inspecting minor percentage of traffic over two weeks
- Network Learning
- Collects insights into network behavior and detects potential connectivity issues for AI consideration
- Performance Prediction
- Estimates the performance impact on Security Gateways when HTTPS inspection is fully implemented
- **HTTPS Inspection Monitoring**
- SSLi statistics view within SmartView, including bypass/inspect stats

## p .3

---

# Security Gateway

## 1. New Clustering Technology

- **ElasticXL (active/active Orchestrator-less cluster)**
- Single management object (SMO) for simplified configuration of all cluster members
- Automatic sync of configuration and software packages between all cluster members

## 2. Dynamic Access Layer

- **Fully automated API-controlled dynamic policy layer implementing changes to the GW in seconds**

## 3. Identity Awareness

- **New PDP-Only mode allowing GW to act only as a policy decision point**
- **New identity sharing cache mode to improve resiliency**
- **Gateway’s can now use IDP’s defined within Infinity Portal. Centralizing managed identities across multiple products**

## 4. Remote Access

- **Gateway’s support IKEv2 protocol for Client to Site remote access (E88.40 or higher)**

## 5. Performance and Infrastructure

- **HyperFlow support for SMB/CIFS and QUIC protocols**

### p .4

---

# 6. IPsec VPN

- **Support for ML-KEM (Kyber768), required for FIPS 203. Uses Post-Quantum Cryptography (PQC)**
- **Automatic detection and adjustments of configuration changes in AWS, Azure, and GCP**
- **Enhanced Link Selection**
- Interoperability
- Uses Public IP address as tunnel identifies to establish separate tunnels for each link
- Support for Dead Peer Detection (DPD) as link probing
- Redundancy—VPN tunnel redundancy including third-party and native cloud VPN peers
- Granularity—Ability for the gateway to use different VPN interfaces in different VPN communities
- **Advanced VPN Monitoring tool showing health and performance of tunnel**

# 7. Mobile Access

- **Mobile Access Policy and Capsule Workspace configurations are now in SmartConsole**
- **SAML authentication support for Mobile Access clients**
- **New Management API calls for Capsule Workspace configuration**

# 8. Dynamic Routing

- **Added support for new dynamic routing capabilities**
- BGP Extended Communities (RFC 4360)
- BGP Conditional Route Advertisement and Injection
- Routing Table Monitor for Event Triggers
- IPv4 and IPv6 Router Discovery on cluster members
- Router Preference and Route Information option
- Route age information
- IPv4 PIM-SSM with non-default prefixes
- IPv4 PIM with BFD
- IPv4 PIM neighbor filtering
- IPv4 PIM RPT to SPT switchover control
- IPv6 Protocol Independent Multicast (PIM) and Multicast Listener Discovery (MLD)
- **Added support for new dynamic routing API calls**
- REST API calls for: BGP, PIM, MLD, Route Redistribution, Inbound Route Filters, NAT pools, and IGMP

## p .5

---

# 9. Quantum Maestro, Scalable Chassis, and ElasticXL

- **Support REST API calls on Maestro Orchestrator to configure and monitoring Security Groups, Sites, and Ports. Including Gaia REST APIs on Scalable Platform Members**
- **Support First Time Wizard on Orchestrators, with ability to configure Maestro Site settings**
- **Support for SNMP queries on each Scalable Platform Member**
- **Support for LLDP on Uplink, Sync, and Management ports of Orchatrators**
- **New Ports page showing a summary and interactive view of port configuration**
- **New Cluster Management page showing state and performance of Scalable Platform Members**
- **New CLI tool “insights” to monitor entire cluster in both Expert and gClish**
- **New gClish commands “show cluster” and “set cluster”**
- **Improved boot time and reduction in required reboots of Scalable Platform Members when there is a change in the Gaia OS config**
- **Automatic CPUSE Deployment Agent updates on Scalable Platforms**
- **Removed the requirement of “sp_upgrade” script starting with upgrades to R82 or higher**
- **Additional snapshot mechanism for small Gaia OS snapshots (lightshots)**

# 10. VSNext

- **New VSX architecture**
- Simpler configuration, easier & faster provisioning, and a similar experience to a physical Security Gateway. Upgrade as a regular gateway
- Unified management experience between physical Security Gateways and Virtual Gateways, including capability to manage each BS from a different Management Server
- Management features and API parity between VS GW and physical GWs
- Improved provisioning performance/experience
- Create, modify, delete Virtual GWs and switches in Gaia portal, Clish, or REST API
- Management of different Virtual Gateways with different Security Management Servers, in addition to different Domain Management Servers on the same Multi-Domain Security Management Server

# 11. New Tools and Utilities

- **“connview”—consolidated troubleshooting tool for viewing connections on the Gateways running in User Space Firewall (USFW) mode**
- **“up_execute”—performs virtual Access Control / NAT Rule Base execution. Given inputs based on logs or connections, the execution provides detailed information**

p .6 **such as matched rules and classification information**

---

# Gaia OS

## (Applies to Gateways, Management and Log Servers)

## 1. New OS kernel

## 2. Enhancements in OS

- **Support for Link Layer Discovery Protocol in VSX mode**
- **DHCPv6 server, DHCPv6 client, and DHCPv6 client for prefix-delegation in Gaia Portal and Gaia Clish**
- **Ability to configure order of “AAA” authentication (TACACS, RADIUS, Local auth) in Gaia Portal and Clish**
- **DNS Proxy forwarding of domains. Allows configuring specific DNS servers per DNS suffix**

## 3. New items in OS

- **Two-Factor Authentication for Gaia OS login using authenticator apps (Google/Microsoft Authenticator)**
- **Support NTP pools and a larger number of NTP servers**
- **NFSv4 configuration**
- **Keyboard layout**
- **TLS configuration for a remote Syslog server**

## 4. Backups in Gaia Portal

- **Support for cloud backup into Amazon S3 and MSFT Azure Storage**
- **Ability to notify on scheduled backups**
- **Restores provide must more detail**
- **Backup date, Hostname, Hardware, Version, JHF take, Role**
- **Restore verification checks if restoring into a different version/take**

### p .7

---

# Management

## 1. SMS Enhancements

- **Use of LDAP Account Unit object server name and cert for LDAP trust**
- **VSX GW and Cluster configurations via Management API**
- **Data Type object definition for DLP and Content Awareness via Management API**
- **Management of Gateways with SMS behind public cloud or third-party NAT device**
- **Manage up to 500 Gateways/Cluster Members with concurrent policy installation on all**
- **Support SAML login on SmartConsole with Gaia portal on a different port than 443. SK182032**
- **Ability to verify Access Control policy with unpublished changes**

## 2. SmartConsole

- **Enhanced Gateways & Server view to see and manage recommended JHF and Updates for Gateways and Host objects**
- **HealthCheck Point (HCP) tests are integrated and visible as part of the Gateway Status (disabled by default)**

## 3. Central Software Deployment

- **SmartConsole enhancements to include:**
- Uninstallation of Jumbo Hotfixes
- ClusterXL High Availability mode “Switch to higher priority cluster member”
- Ability to upgrade Secondary Management servers, Dedicated log servers, Dedicated SmartEvent servers, Standalone servers
- Clusters of Spark appliances
- Package Repository per Domain on Multi-Domain Management Server

### p .8

---

# 4. Web SmartConsole new capabilities

- **Threat Prevention rule base**
- **HTTPS Inspection rule base**
- **NAT rule base**
- **Rule base search**

# 5. SmartProvisioning adding Star VPN community support for Maestro and VSX

# 6. Multi-Domain SMS

- **Ability to clone an existing Domain on the same Multi-Domain SMS**
- **Improved upgrade time of large environments**
- **Support for IPv6 configurations**
- **Automatic refresh of modified Global objects**
- **Ability to select the Access Control, Threat Prevention, or both policies in a Policy Preset object**

# 7. Compliance

- **Gaia OS Best Practices for Maestro Security Groups, Quantum Spark Appliances, Management, and Log servers**
- **Added new regulations**
- Center for Internet Security Benchmarks
- Cyber Essentials v3.1
- Cybersecurity Maturity Model Certification
- Essential Eight & Strategies to Mitigate Cyber Security Incidents
- IEC 62443-2-1 201
- ISO 27001:2022
- Israeli Cyber Defense Methodology 2.0
- Network and Information Systems Directive 2
- PCI DSS 4.0
- TISAX 5.1

## p .9

---

# CloudGuard Network Security

## CloudGuard Controller

- **Identity Awareness PDP (Identity Sharing)**
- **Policy Mode APIs for importing of objects from NSX-T Manager**
- **Supports VMware NSX-T Global Manager to allow integration with VMware NSX-T v4.1**
- **Multi-Domain SMS support for Data Center Objects and queries within the Global Policy**

### p .10

---

# Harmony

## Endpoint Web Management

- **Client optimization for Windows Servers**
- **Performance Diagnostic checks as a push operation on endpoint clients**
- Reports CPU and RAM status
- Presents suggestion exclusions for performance improvements
- **Easier addition of exclusions for Global or Per Rule exclusion. Exclusions can now have a description added for comments**
- **Application control for macOS**
- **New/Updated Asset Management views**
- Filters
- Asset Management Table
- Columns reorder
- **Linux Offline package support**
- **Harmony Endpoint Management API support for on-premises server (disabled by default)**

**References** R82 Release Page with Key Links sk181127—Check Point Quantum R82

p .11