R81.20 Jumbo Hotfix Take 26
R81.20 Jumbo Hotfix Take 26
| Download Jumbo Hotfix Accumulator Takes | Download Previous Recommended Takes |
| Note - This Take contains all fixes from all earlier Takes. |
Download CSV
| ID | Product | Description |
|---|---|---|
| Take 26 Released on 14 August 2023 and moved to Recommended on 13 September 2023 |
||
| PRJ-44227, PMTR-89589 |
Compliance | NEW: Compliance Software Blade is enhanced with 5 new Firewall Best Practices: - FW174 - Check that there are no Access Control rules that contain "Any" in the "Source" column and contain "Accept" or "Ask" in the "Action" column. - FW175 - Check that Access Control rules do not contain "Any" in "Destination", and "Accept" or "Ask" in "Action". - FW176 - Check that Access Control rules do not contain "Any" in "Services and Applications", and "Accept" or "Ask" in "Action". - FW177 - Check that there are no temporary Access Control rules (based on the "Name" column). - FW178 - Check that there are no temporary Access Control rules (based on the "Comments" column). |
| PRJ-44577, PMTR-90463 |
Internal CA | NEW: Previously, the Internal CA certificate required manual renewal process. Now it will be automatically renewed one year before its expiration date. |
| PRJ-44672, PMTR-90420 |
Security Management | NEW: - Added support for 1595 Slim Ruggedized appliances. - Added support for 1535 / 1555, 1575 / 1595 Quantum Spark Pro appliances. |
| PRJ-44359, PMTR-90221 |
Security Management | NEW: Added a new Management API " mgmt_cli show ha-status". It provides synchronization information for the currently active domain. - When running the command from the Active Domain in the local/Global Domain, it retrieves details about the synchronization status of the other standby peers and the overall synchronization status for the Domain. - When running the command from the system Domain, it only displays the general synchronization status, as all peers are active. |
| PRJ-44747, PMTR-89334 |
Security Management | NEW: Added support for multiple languages in the Change Report. |
| PRJ-44421, ACCESS-458 |
Security Management | NEW: Added a new field to the output of " mgmt_cli show updatable-objects-repository-content" command. This field displays the object's unique name as it is saved in the updatable objects repository. |
| PRJ-43522, PMTR-89420 |
Security Management | NEW: It is now possible to add tags to Access rules and sections. A new field "tags" is added to the existing " add/set rule & section" Management APIs . For example: - mgmt_cli add access-section layer "Network" position 1 name "New Section 1" tags mytag - mgmt_cli add access-rule layer "Network" position 1 name "Rule 1" tags mytag |
| PRJ-44421, ACCESS-458 |
Security Management | NEW: Added a new field to the output of " mgmt_cli show updatable-objects-repository-content" command. This field displays the object's unique name as it is saved in the updatable objects repository. |
| PRJ-45679, PRJ-45678 |
CloudGuard Network | NEW: CloudGuard Controller for NSX-T - Starting from NSX-T 4.0.0.x and higher, Manager Mode APIs are deprecated, it is recommended to use Policy Mode. - Import NSX-T Tags (NSgroups and VMs) is now supported. - Import NSX-T Virtual Machine objects is now supported. Note: Importing Virtual Machines can be enabled only using Policy Mode APIs. When enabled, the amount of API requests toward the NSX-T manager increased. |
| PRJ-45491, PRHF-28303 |
Security Management | UPDATE: Significant performance improvement for policy installation when using many layers (up to four times faster). |
| PRJ-46243, PMTR-86894 |
Security Management | UPDATE: A Security Management Server/Domain Management Server can now manage up to 500 Security Gateways/Cluster members, allowing concurrent policy installation on all Security Gateways/Cluster members at once. |
| PRJ-45204, ODU-843 |
Web SmartConsole | UPDATE: New features and improvements are released in Take 76 via self-updatable package. Refer to sk170314. |
| PRJ-45473, ODU-827 |
CPView | UPDATE: First release of CPviewExporter Release Updates. Refer to sk180521. |
| PRJ-45466, ODU-835 |
CPView | UPDATE: First release of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522. |
| PRJ-44609, PMTR-90504 |
Threat Emulation | UPDATE: FakeServer will now listen for packets coming from the Virtual Machine during Threat Emulation to port 18443 instead of port 8443. |
| PRJ-44321, PMTR-90945 |
Threat Prevention | UPDATE: The DCE-RPC kernel tables will now be global instead of local. This adjustment helps avoid issues with syncing between firewall instances and keeps data connections stable. |
| PRJ-45463, PRJ-46432, ODU-890, ODU-898 |
Threat Prevention | UPDATE: Added Update 18 and Update 19 of Autonomous Threat Prevention Management integration Release. Refer to sk167109. |
| PRJ-46429, TPP-3290 |
Threat Prevention | UPDATE: IPS bypass triggers will now be activated based on the average CPU load exceeding the high threshold, as opposed to the previous implementation, where a single CPU load triggered the bypass. The change will result in more effective security measures without unnecessary bypasses. |
| PRJ-43784, PMTR-89672 |
Threat Prevention | UPDATE: Ability to send packet capture on IPS / Anti-Bot silent protections to the research team to enhance the security. |
| PRJ-45912, IDA-4843 |
Identity Awareness | UPDATE: Implemented monitoring functionality and alerts for tracking the expiration date of Identity Broker certificates. |
| PRJ-46224, PMTR-92426 |
ClusterXL | UPDATE: Added support for IPv6 traffic synchronization in Multi-Version Clusters (MVC). See the Critical Information section. |
| PRJ-44719, PRHF-22566 |
SecureXL | UPDATE: Added a new kernel parameter allowing to control the size of fragments table in SecureXL. To use it, set the kernel parameter " sim_frag_limit_override" with the new value and install policy. This can prevent fragment drops when having multiple instances in the Firewall. |
| PRJ-42862, PMTR-88750 |
Zero Phishing | UPDATE: - Zero Phishing now enforces license. Customers with NGTX (Next Generation Threat Emulation & Extraction) or customers that recently renewed NGTX should have no issues. - Zero Phishing will stop working for customers who do not have a license. |
| PRJ-44762, PRHF-27893 |
Gaia OS | UPDATE: Increased the size of the scheduled snapshot database binding, allowing longer paths and passwords to be defined. |
| PRJ-47227, PMTR-92606 |
Gaia OS | UPDATE: Upgraded OpenSSL from 1.1.1t to 1.1.1u to include the latest security improvements. Refer to sk181427. |
| PRJ-44354, PRJ-44355 |
CloudGuard Network | UPDATE: Added support for Data Centers in AWS ap-southeast-4 Melbourne region. |
| PRJ-43926, PRHF-27357 |
CloudGuard Network | UPDATE: Added support for sending Data Center updates from the CloudGuard Controller to the main IP address of Active member on the Management Plane instead of the cluster VIP address on the Data Plane. Refer to the " updateClusterMemberAndNotVip" section in CloudGuard Controller R81.20 Administration Guide > Configuration Parameters. This change prevents scenarios when CloudGuard Controller fails to connect to Cluster with MDPS enabled ( sk180981). |
| PRJ-46550 | CloudGuard Network | UPDATE: Added new Security Management APIs for the CloudGuard Central License Utility: - " add-central-license" - " distribute-cloud-licenses" - " delete-central-license" - " show-central-license" - " show-central-licenses" - " show-cloud-licenses-usage". |
| PRJ-45214, MBS-14161 |
Scalable Platforms | UPDATE: Added Management Data Plane Separation (MDPS) support for Maestro Orchestrator and Chassis scalable platforms. |
| PRJ-43863, PMTR-89393 |
Scalable Platforms | UPDATE: Added a new log file - /var/log/pull_config_report.log. It includes the summary of the "pull_config" action when it is performed on a member to indicate the reason for pull_config pnote/failures. |
| PRJ-45908, ODU-946 |
Scalable Platforms | UPDATE: Added Take 23 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414. |
| PRJ-44959, PMTR-85311 |
Scalable Platforms | UPDATE: Added a new log file to indicate the reason of member reboots if they are triggered by configuration mismatch - /var/log/configuration_reboot_info.log. |
| PRJ-45389, ODU-914 |
HCP | UPDATE: Added Update 12 of HealthCheck Point (HCP) Release. Refer to sk171436. |
| PRJ-44461, PRHF-27327 |
Security Management | In some scenarios, the " run-script" Management API command may fail with " Null Pointer Exception" when using root user permissions. |
| PRJ-45874, PRHF-28640 |
Security Management | In some scenarios, Access Policy Verification fails but the name of the failed rule is not specified. |
| PRJ-43569, PRHF-27059 |
Security Management | After Full synchronization, SmartConsole login from a Domain Management Server to the Security Management Server that is configured as High Availability may fail. |
| PRJ-45156, PRHF-28175 |
Security Management | APP_ID may not be initialized when adding a new Check Point application via API, this may cause blocked access to several websites. |
| PRJ-42040, PRHF-25898 |
Security Management | Editing an object in SmartConsole may fail with " Server error is: Object not found (Code: x08003001D, Could not access file for write operation)". |
| PRJ-44086, PRHF-27440 |
Security Management | Login with SmartConsole to a Security Management Server may fail if using a DNS name instead of an IP address. Refer to sk180514. |
| PRJ-46630, PMTR-92240 |
Security Management | In the Infinity Services view, the Log Sharing status may not be correct. |
| PRJ-44625, PMTR-82987 |
Security Management | In the Accelerated Policy Installation flow, there is no validation for the scenarios when there are DAIP Security Gateways in the Destination column of the Access policy. |
| PRJ-44984, PRHF-28012 |
Security Management | When using SmartTasks to send a mail before or after publishing the operation, the value inserted into the Changes and Description fields does not take effect as expected. |
| PRJ-44594, PMTR-89770 |
Security Management | In some scenarios, running the Management API " delete-exception-group" fails if the exception group is automatically attached. |
| PRJ-43813, PRHF-27187 |
Security Management | Login to SmartConsole with a RADIUS administrator from the SmartEvent Server may fail if this Server was upgraded. Refer to sk180584. |
| PRJ-46399, PRJ-46725, PRHF-28962 |
Security Management | In rare scenarios, policy installation fails with " Operation failed, install/uninstall has been improperly terminated". Refer to sk180448. |
| PRJ-46183, PRHF-28820 |
Security Management | The " verify-policy" Management API command may fail when performed on the Multi-Domain Security Management Server. |
| PRJ-43917, PMTR-83586 |
Security Management | In the Object Explorer window in SmartConsole, the IP address column is sorted alphabetically, although it should be sorted in numerical order. |
| PRJ-44592, PMTR-89373 |
Security Management | The " show object" command fails when running it on nat-section objects. It returns a " null pointer exception" message, which occurs in calculations related to the overview objects meta-info. |
| PRJ-44596, PMTR-89845 |
Security Management | When adding/setting an access rule, setting certain fields to "Any" or "None" may fail because of case sensitivity. |
| PRJ-44897, PRHF-27875 |
Security Management | Policy installation gets stuck if the known proxy group contains the policy target. |
| PRJ-45655, PRHF-28407 |
Security Management | Packet mode search in SmartConsole may show rules that do not match the query if the query contains source, destination, and service. |
| PRJ-44996, PRHF-27895 |
Security Management | In rare scenarios, login to SmartConsole fails, and opening Security Gateway objects times out. |
| PRJ-44473, PRHF-27659 |
Security Management | Excluding a network with anti-spoofing by name on the Security Gateway using the "set simple-gateway" Management API command fails with an " Anti spoofing: excluded network object must be defined." validation error message. |
| PRJ-43267, PRHF-26404 |
Security Management | When creating several LSM objects (Security Gateways or clusters) via both Management API and SmartConsole, the LSM objects IP addresses may be duplicated. |
| PRJ-45878, PRHF-28654 |
Security Management | If an empty Network Group is linked in the source or destination fields of an Access Rule, policy verification may not generate an error. Instead, it may treat the empty group as if there is an "Any" object. |
| PRJ-42423, PRHF-26275 |
Security Management | In some scenarios, an upgrade may fail when a Network object Group contains more than 32000 members. |
| PRJ-43187, PRHF-26778 |
Security Management | If a Security Gateway is added to a group after configuring an installation policy preset, the policy may not be installed on that Security Gateway. Refer to sk181461. |
| PRJ-42553, PRHF-26118 |
Security Management | After restoring a Multi-Domain Security Management Server, High Availability synchronization may fail with " The Security Management Servers contain different Hotfixes". |
| PRJ-43192, PRHF-25274 |
Security Management | If the Security Management Server is behind NAT, remote Management API login fails. |
| PRJ-45159, PRHF-28175 |
Security Management | APP_ID may not be initialized when adding a new Check Point application via API, this may cause blocked access to several websites. |
| PRJ-43963, PRHF-27308 |
Security Management | In rare scenarios, the Security Gateway accepts all IP addresses as approved " gui_clients", although it was provided with a list of specific trusted IP addresses. |
| PRJ-46088, PRHF-28685 |
Multi-Domain Security Management | A scheduled Install Policy Preset may not have its next run time updated when: - The Multi-Domain Security Management Server was down while the preset was scheduled to run - There are over 50 presets defined |
| PRJ-44970, PRHF-28002 |
Multi-Domain Security Management | In rare scenarios, in Multi-Domain Security Management environments with over 500K network objects, login to SmartConsole fails with " Connection timed out" or " Unable to connect to server" messages. |
| PRJ-45069, PRJ-46163, PRHF-28192, PRHF-28143, PRJ-47051, PRHF-29196 |
Multi-Domain Security Management | In rare scenarios, in a Multi-Domain Security Management environment: - Login to the Security Management Server may fail with timeout. - Publish operations may take a long time. |
| PRJ-43785, PRHF-24558 |
Multi-Domain Security Management | Deleting a Domain from SmartConsole fails after a Domain Server was removed and the Domain has no Domain Servers. |
| PRJ-43599, PRHF-27209 |
SmartConsole | Typo in the Compliance report - " OSFP" instead of " OSPF". |
| PRJ-46531, PRHF-85028 |
SmartConsole | SmartConsole may crash while checking for updates. - Requires installing R81.20 SmartConsole Build 646. |
| PRJ-46510, PRHF-28930 |
SmartConsole | Data Center objects may not appear as unused objects in the Object Explorer view, although they should. |
| PRJ-45593, PRHF-28286 |
SmartConsole | In some scenarios, in SmartConsole, when clicking the picker to add Security Gateway to a Threat Prevention policy "Install On" column, no Security Gateway objects appear. Refer to sk180964. |
| PRJ-46171, PRJ-43171 |
CPUSE | When working in a Scalable Platforms environment, a member may get in a bootloop. The issue occurs after consequent upgrade of this member to R81.10, Deployment Agent (DA) update and enabling image auto cloning. |
| PRJ-43473 | CPUSE | In some scenarios, the task progress bar is missing during Jumbo installation from SmartConsole. |
| PRJ-43477, PRHF-26987 |
Logging | The Non-Transparent Proxy configuration is missing the IP address of the destination website in the URL Filtering logs. Refer to sk180403. |
| PRJ-45670, SL-6728 |
Logging | In specific network configurations, after installing a policy, the target IP address of the Log Server may differ from what was configured. |
| PRJ-41667, PRHF-25662 |
Logging | In some scenarios, in the Logs & Monitor view, no results are shown when filtering updatable object names by the "dst_uo_name" field. |
| PRJ-41595, PRHF-25533 |
Logging | SmartEvent may generate false Anti-Bot / Anti-Virus related logs which do not contain any information. |
| PRJ-45418, PRHF-28191 |
Logging | Source and destination IP addresses in SmartLog may not be shown correctly for duplicate packets of fragmented traffic. |
| PRJ-46074, PRHF-28787 |
Logging | After an upgrade of the Security Management Server, the " cp_log_export show" command may return the " found an ambiguous value" error in the "export_log_position" field. |
| PRJ-44408, PMTR-90258 |
Security Gateway | Global tables ( ghtab) may not be synchronized between members, this can lead to instability of traffic. |
| PRJ-46054, PRHF-28455 |
Security Gateway | The Security Gateway may crash while inspecting non-HTTP traffic. |
| PRJ-44190, PRHF-25647 |
Security Gateway | The Security Gateway may crash due to a memory issue. |
| PRJ-45804, PRHF-28559 |
Security Gateway | Resolved an issue where CPD would consume a large amount of CPU in VSX with a large number of interfaces configured (greater than 1024). Refer to sk181588. |
| PRJ-47118, PRHF-29292 |
Security Gateway | In some scenarios, after an upgrade, the FWD process may unexpectedly exit. |
| PRJ-45001, PRHF-27844 |
Security Gateway | In a Maestro environment where members are VSXs, connection over SSH or RDP from a host behind Maestro to a peer may be dropped. |
| PRJ-45091, PMTR-90992 |
Security Gateway | It is impossible to configure the total number of IPv4 CoreXL Firewall instances and IPv6 CoreXL Firewall instances to more than 64 when the Security Gateway with more than 64 CPU cores runs in the USFW mode. Refer to sk181408. |
| PRJ-43849, PMTR-86732 |
Security Gateway | Stack buffer overflow may occur in the FWGTP process. |
| PRJ-46677, PRJ-46683, PRHF-29045, PRHF-28963, PRJ-46680, PRHF-28973 |
Security Gateway | After an upgrade, GTP traffic and memory issues may occur. |
| PRJ-46335, PRHF-28842 |
Security Gateway | The Security Gateway may crash after a failure in policy installation. |
| PRJ-46139, PRHF-28806 |
Security Gateway | The " g_tcpdump -mcap" command may not merge traffic capture outputs. Refer to sk181032. |
| PRJ-44312, PRHF-27439 |
Security Gateway | In rare scenarios, modifying the " fwmultik_temp_conns_enabled" parameter on-the-fly leads to the Security Gateway crash. |
| PRJ-46688, PMTR-91240 |
Security Gateway | When adding a new connection, the "Smart Connection Reuse" feature may cause errors in fwk.elg and connection drops. |
| PRJ-42788, PRHF-22608 |
Security Gateway | In some scenarios, the Security Gateway may crash. |
| PRJ-44605, PRHF-12636 |
Security Gateway | The FWK process may unexpectedly exit while processing the mail flow and generate a core dump. |
| PRJ-45497, PRHF-28324 |
Security Gateway | On the Security Gateway with Management Data Plane Separation (MDPS) enabled: - when adding a RADIUS Server from Gaia Portal, a new MDPS task with the IP address of the Server may not be added, - when deleting a RADIUS Server, the MDPS task may not be deleted. |
| PRJ-42531, PRHF-25233 |
Security Gateway | In some scenarios, while processing H323 traffic, the Security Gateway may unexpectedly restart. |
| PRJ-45479, PRHF-28350 |
Security Gateway | Security Gateway may crash when running kernel debugs of the "UP" module. |
| PRJ-44252, PRHF-27426 |
Security Gateway | When setting " cphwd_enable_ecmp = 1" (to route by the source and destination IP address), the Security Gateway may route the traffic to the wrong MAC. |
| PRJ-45450, PRHF-28277 |
Security Gateway | When the Security Gateway handles specific HTTP requests, memory failure may occur. CPView registers SMEM failure. |
| PRJ-44753, PRHF-27707 |
Security Gateway | Policy installation may fail with " Error 2000240" because of an IPv6 flow issue. |
| PRJ-41879, PMTR-87372 |
Security Gateway | On supported Open Servers ( sk167052), after changing the Firewall mode from Kernel Space (KSFW) to User Space (USFW) and reboot, the Security Gateway continues to boot in the Kernel Space mode. |
| PRJ-45187, PMTR-90969 |
Security Gateway | Traffic stops working after a Security Gateway Member recovers from a failure. Refer to sk180705. |
| PRJ-44106, PRHF-26013 |
Threat Prevention | Fetching custom intelligence feeds via CLI may fail because of SSL certificate issues. |
| PRJ-44571, PRHF-27749 |
Threat Prevention | After an upgrade, adding an IoC feed with IP range indicator type may fail with " Feed format problem. Bad or Empty Feed". |
| PRJ-44152, PMTR-89916 |
Threat Prevention | In a rare scenario, policy installation may fail because of IoC observables overrides. |
| PRJ-44201, PMTR-89130 |
Threat Prevention | When IPS Software Blade is enabled, the Security Gateway may crash. |
| PRJ-45925, PRHF-28533 |
Identity Awareness | In a rare scenario, the PDPD process may unexpectedly exit during user authentication flow. |
| PRJ-43748, PRHF-27158 |
Identity Awareness | The output of the " pdp monitor cv_le |
| PRJ-45429, PRHF-28304 |
Application Control | Some TLS1.3 applications without SNI do not match the rules. |
| PRJ-43976, PRHF-27284 |
URL Filtering | When applying the " appi_urlf_ssl_cn_use_sni_without_validation" kernel parameter, only the first notified application may be considered for Rule Base matching, and the rest of the apps are not detected. |
| PRJ-44181, PMTR-89863 |
IPS | In some scenarios, the FWK process may unexpectedly exit, while Threat Prevention Software Blades inspect HTTP traffic. |
| PRJ-45658, PRHF-28404 |
SSL Inspection | In a VSX environment, the WSTLSD process run by Virtual Systems may ignore proxy configuration on VS0. |
| PRJ-46280, PRHF-28749 |
Anti-Virus | Importing a custom intelligence feed containing IP ranges may fail. |
| PRJ-44671, PMTR-90550 |
Anti-Virus | Anti-Virus Software Blade may bypass inspection of URLs with sub-domain portion. |
| PRJ-46606, PRHF-28851 |
Anti-Virus | The DLPU process may stop working, creating a User Space core dump file on the Security Gateway. Refer to sk181026. |
| PRJ-44234, PRHF-15953 |
Anti-Virus | The RAD process CPU utilization may be high when Anti-Virus engine processes many reverse DNS queries. |
| PRJ-45195, PRHF-28182 |
Mobile Access | In rare scenarios, IOS users are unable to send emails using Capsule Workspace business mail. |
| PRJ-45100 | Mobile Access | SSL Network Extender (SNX) may randomly disconnect after a version upgrade. Refer to sk173765. |
| PRJ-45852, PRHF-28379 |
Mobile Access | Mobile Access Security Gateway does not recognize Office 365 URL This can cause OAuth 2.0 authorization to fail, it may not be possible to view the mail. |
| PRJ-46403, PRHF-28925 |
Mobile Access | Sending emails with attachments via Capsule Workspace may fail on iOS. |
| PRJ-46506, PRHF-28936 |
ClusterXL | Some IPv6 connections randomly stop passing through ClusterXL in High Availability mode. Refer to sk180969. |
| PRJ-45163, PMTR-91017 |
ClusterXL | A VRRP cluster member may be stuck in boot after a cluster upgrade. |
| PRJ-42772, MBS-15783 |
ClusterXL | Asymmetric UDP traffic may be dropped with " First Packet isn´t Syn". |
| PRJ-43640, PMTR-89506 |
SecureXL | In some scenarios, incorrect MSS value calculation may lead to traffic drops and performance instability. |
| PRJ-44365, PRHF-27633 |
SecureXL | When running tcpdump on the Multi-Domain Security Server, an " error /bin/cp-tcpdump.sh: line 11: sxlmode: command not found" message is shown. The issue is cosmetic only. |
| PRJ-41959, MBS-16159 |
Routing | In some scenarios, a Security Group Member failover can trigger routes to be lost on other members in the Security Group. |
| PRJ-44710, PRHF-27240 |
Routing | An IGMP group with an expiration time of 7101 weeks should be deleted when it reaches 0 seconds, but instead, it may remain at 7101 weeks until a membership report is sent, then it resets to the interval of that interface. |
| PRJ-44706, PRHF-27225 |
Routing | Multicast receivers send IGMP membership reports, but the outbound interfaces are missing from the routing table. |
| PRJ-45380, PRJ-46303 |
Routing | A VRRP/VRRP6 interface may go into Master/Master state. |
| PRJ-46133, ROUT-2838 |
Routing | When two interfaces with the same local address are configured, BGP may use an incorrect interface to reach a peer. |
| PRJ-41962, MBS-16158 |
Routing | Routing log messages generated when Standby cluster members reconnect to members in Master state are not clear. |
| PRJ-43828, PRHF-27339 |
VPN | In a Site to Site VPN, when one of the sites is a cluster in Load Sharing mode, it can cause incorrect destination member calculation for asymmetric connection and the traffic might be dropped. Refer to sk180855. |
| PRJ-44313, PRHF-24641 |
VPN | The " failed to terminate session" error is displayed when using RAsession_util to terminate Endpoint client. |
| PRJ-44992, PRJ-46303 PRHF-27569, PRJ-44830, PRHF-28061 |
VPN | - OCSP is disabled on the user's IIS Server, but the Security Gateway does not fall back to the CRL method. Refer to sk179434. - Security Gateway sends defaultCert to the third party instead of an OCSP certificate. An unexpected OCSP response may cause a VPN gateway to stop using its certificate until the next policy installation. Refer to sk180683. |
| PRJ-45469, PRHF-28353 |
VPN | StrongSWAN Remote Access authentication fails when the LDAP lookup type is not the default method. |
| PRJ-44219, PRHF-27548 |
VPN | The " vpn/ike debug ikeon/ikefail" commands may fail when used with the " -s" flag. |
| PRJ-45920, PRHF-28589 |
VPN | The FWM process may unexpectedly exit at startup because of an incorrect VPN key initiation. |
| PRJ-46952, PRHF-92538 |
VSX | An upgrade of VSX cluster members configured as VSLS from SmartConsole may fail. |
| PRJ-45146, PRHF-28154 |
VSX | Some packets may disappear when using the i40e driver, and VMAC is configured on the cluster. |
| PRJ-45006, PRJ-28080 |
VSX | A VSX Security Gateway may crash while attempting to collect statistics after running the " cpstop" command. |
| PRJ-44123, PMTR-88803 |
VSX | Changing the main IP address of a Virtual Router may cause the FWM process to exit. |
| PRJ-44746, PMTR-90616 |
VSX | Virtual System's interfaces may be missing when running the Clish command " show/save configuration". |
| PRJ-44090, PRHF-27224 |
VSX | Values provided by the VSX OID tree: 1.3.6.1.4.1.2620.1.16.22.5.1 may be incorrect. |
| PRJ-45402, PRHF-28365 |
VSX | Warp interfaces may appear in VS0 and disrupt connectivity when editing a Virtual Switch with a bond and VLANs. |
| PRJ-45864, PMTR-91668 |
Gaia OS | Gaia backup may fail, leaving a temporary partition behind. Any new attempt to create a new backup returns an error. |
| PRJ-41910, PRHF-25737 |
Gaia OS | Gaia Portal logs are printed with "info" severity. |
| PRJ-45566, ACCHA-2110 |
Gaia OS | The $FWDIR/log/fwd.elg file may get corrupted during log rotation. Refer to sk180728. |
| PRJ-42780, PRHF-26416 |
Gaia OS | Scheduled SCP snapshots to a Windows Server may fail with the " Failed to connect to remote server. Please validate connection". |
| PRJ-43199, PMTR-88966 |
Gaia OS | Appliance with a Dual Image installed cannot reboot after restoring to the factory default of a Dual Image. Refer to sk180331. |
| PRJ-46945, PRHF-29014 |
Harmony Endpoint | KAV updater on the Server may fail to receive updates when proxy is used. |
| PRJ-45541, PRHF-27987 |
CloudGuard Network | AWS Data Center mapping fails when an interface subnet is missing from the list of subnets. |
| PRJ-44479, PMTR-90345 |
CloudGuard Network | Azure scan fails if a Virtual Machine Scale Set (VMSS) is deleted after the scan started. |
| PRJ-44615, PRHF-27502 |
VoIP | In rare cases, SIP UDP traffic may cause Security Gateway to crash because of a memory allocation issue. |
| PRJ-46476, PMTR-90803 |
VoIP | SIP traffic may be dropped and " kiss_htab_bl_infra_slink: failed "earlynat_sport_ghtab_bl":3 reason: KISS_HTAB_BL_SLINK_LIMIT_REACHED" is printed in the fwk.elg file. |
| PRJ-43719, PRHF-26939 |
VoIP | After an upgrade, VoIP, and SIP / H323 traffic may be dropped in the VPN tunnel. Refer to sk179651. |
| PRJ-42783, PMTR-88669 |
Scalable Platforms | Adding more than 250 VLANs on an Orchestrator MHO-175 Maestro Uplink interface causes intermittent traffic outages. Refer to sk180340. |
| PRJ-45253, ACCHA-2021 |
Scalable Platforms | Excessive " cphwd_get_device_accelerated_ifs: too many interfaces (32,XXX)" messages may log to $FWDIR/log/fwk.elg. Refer to sk180439. |
| PRJ-44548, PRJ-44587 |
Scalable Platforms | The " orch_info" command may freeze, when running it on Maestro Orchestrator. |
| PRJ-45696, PRJ-45480 |
Scalable Platforms | Querying the HW status via SNMP (OIDs .1.3.6.1.4.1.2620.1.6.7.*) or via the " cpstat os -f sensors" command may fail on Maestro Orchestrator. |
| PRJ-45302, PRHF-28238 |
Scalable Platforms | In rare scenarios, the Single Management Object (SMO) may go to Down state after clicking a packet capture link in the IPS log in SmartConsole. |
| PRJ-47985, PRJ-47745 |
Scalable Platforms | Uninstalling Jumbo Hotfix Take 106/107 on Maestro Orchestrator (MHO) may cause an outage. |
| PRJ-45363, PMTR-91252 |
Scalable Platforms | Maestro Orchestrator sx_api scripts (e.g. sx_api_ports_dump.py) return the " /usr/bin/env: python: No such file or directory" error. |
| PRJ-44437, PMTR-90202 |
Scalable Platforms | WRP interfaces cannot be used for Source / Destination in a specific Fast Forward rule. |
| PRJ-44022, PMTR-89909 |
Scalable Platforms | Policy validation may fail if the Fast Forward feature is enabled. |
| PRJ-44288, PMTR-88429 |
Scalable Platforms | The " set/show trace" command may fail in gClish. |
| PRJ-45886, PMTR-90935 |
Scalable Platforms | In VSLS mode, SNMP traffic may incorrectly be forwarded to SMO instead of DR manager of the corresponding Virtual System. |
| PRJ-46646, PRHF-28694 |
Carrier Security | Incorrect parsing of GTP-U traffic may cause anti-spoofing drops. |
| PRJ-43225, CST-316 |
Carrier Security | Security Gateway drops GTP Echo Response traffic with the reason " Wrong Destination Port". See sk181507. |
| PRJ-43221, CST-312 |
Carrier Security | Security Gateway drops GTP traffic with the reason " Static IP not allowed". See sk181506. |
| PRJ-46674, PRHF-28770 |
Carrier Security | Packet corruption, leading to traffic and performance issues. |
| PRJ-43358, PRHF-24044 |
Carrier Security | GTP traffic may be dropped and tunnels are not registered in gtp_tunnels. |