Table of Contents:

• Introduction
• Availability
• Important Notes
• List of resolved issues per HotFix
• Installation instructions
• Uninstall instructions
• Legacy CLI instructions
• List of replaced files
• Revision History

 

Introduction

R80 Jumbo Hotfix Accumulator is an accumulation of stability and quality fixes resolving multiple issues in different products.

This Incremental Hotfix and this article are periodically updated with new fixes.

The list below describes each resolved issue and provides a Take number, in which the fix was included. A resolved issue is included in the Incremental Hotfix starting from the Take number listed in this table (inclusive). In addition, you can find the date when the take was published in the table below.

 

Availability

• General Availability Take

  R80 Jumbo Hotfix Accumulator is a General Availability release that can be directly downloaded from Check Point Cloud using CPUSE (Check Point Update Service Engine) and from this article:

  • Online installation - using CPUSE either in Gaia Portal, or in Gaia Clish.
  • Offline installation - using offline / exported package either in Gaia Portal, or in Gaia Clish.
  
  

  Take	Date	CPUSE offline package	SmartConsole package
  Take_76	22 September 2016	(TGZ)	(EXE)*

  Legacy CLI package can be downloaded from here.
  
  * Effective November 20th, 2016, SmartConsole package has been updated with additional support for SHA-256. See sk114579.

 

Important Notes

• For CPUSE installation, must use CPUSE Agent build 1127 and above (refer to sk92449).

• Each "Take" of this Jumbo Hotfix Accumulator is always based on latest GA Take of Check Point R80.

• Effective July 3rd, 2016, the R80 Gaia image has been replaced. By installing the new Gaia image, the R80 Security Management will automatically install R80 Jumbo Hotfix Take 29 on top of the R80 installation.

• It is recommended to install Jumbo Hotfix Accumulator on all the R80 Security Management Servers running on Gaia OS.

• This Jumbo Hotfix Accumulator is suitable for these products and configurations:

  • Security Management Server
  • Multi-Domain Security Management Server
  • Log Server
  • Multi-Domain Log Server
  • SmartEvent Server

• It is recommended to install the new SmartConsole package provided by this Jumbo Hotfix Accumulator.

• R80 Security and stability enhancements for Security Management server (Hotfix #1) content is part of R80 Jumbo Hotfix Accumulator.

• This Jumbo Hotfix Accumulator has to be installed only after successful completion of Gaia First Time Configuration Wizard.

 

List of resolved issues per HotFix

Enter the string to filter the below table:

ID	Symptoms
R80 Jumbo HotFix - Take 76 (22 September 2016)
Security Management
02093495	Administrator without permissions to edit layers is allowed to create/edit/delete rules inside the layers via CLI or API.
02336729	Administrator suddenly fails to log in.
02350035	Running Policy Verification while the Policy Installation task is still running can cause the policy to be incorrectly installed.
VPN
02339829	Enhancement: The 3DES encryption algorithm is supported (see sk113114 for instructions).
Logging
02346523	Logs do not have the Domain field.
02348052	Incorrect field values in SmartLog GUI.
R80 Jumbo HotFix - Take 63 (24 August 2016)
Cloud Demo
-	The Jumbo Hotfix #3 Accumulator includes the R80 Cloud Demo. For details, see sk103431 - Check Point R80 Demo.
Logging
-	Enhancement: Logging Capacity improvements. Refer to sk112797.
02068363	Enhancement: New menu item "Hide Identities" which will enable exchange of identity log field values with asterisks.
02092189	No Events / Logs on SmartEvent / SmartLog servers configured with external LEA connections.
02083980, 02046226	Empty logs entries in logs view, since filtering of Qos product was not configured in LEA filter logs in log_indexer_settings.conf file.
02074068	SmartView, WebUI and Logs Views statistics widgets do not show an estimation of the logs data.
02069539	Logs and monitor tab load slowly.
02022108	An administrator without superuser Multi-Domain permission profile cannot connect to the Multi-Domain Server from the SmartView Web Application.
02071820, 02049053	includeEmptyValues="false" in estimated request query causes to failing to find data in cache and as a result, an empty response is sent instead.
02071933	Administrator can see log files, but does not have permission to open them via "Open log file" pane (no data inside).
02071939, 01954397, 02071976	URL encoding problem: any query containing '#' (hash sign) does not return, any two non-consecutive '#' query fail and restart.
02071980, 02033272	After import the smartlog_server process is terminated after receiving the old configuration.
02128375	Filtering correlated events in SmartEvent by event name returns no result.
02192646	The following dbsync problems may arise when SmartEvent R80 is connected to the Security Management R77.xx: dbsync crashes on the start and the synchronization of objects is not finished. dbsync crashes during synchronization - the synchronization takes long time and there are dbsync core dumps in /var/log/dump/usermode/ directory. the objects are synchronized multiple times with the same name – the policy tab in SmartEvent contains multiple objects with the same name.
02278578	FWD process crashes during logswitch and cannot start.
02190280	No logs are shown after uninstalling the hotfix.
02158472	Query containing two consecutive hash signs (##) is ignored from GUI query and is not resolved.
02208899	Machine become unresponsive when disabling Log indexing
02128379	Not all objects from CMAs are synhronized and administrator cannot see logs from all Domains in SmartEvent GUI when SmartEvent R80 connected to R77.xx.
Multi-Domain Management Server
02103573, 02099799	Protections changes are not enforced on 1100 gateways in Multi-Domain Management Server / single domain configuration.
02070268	Gateway with radius_accounting_setting configuration defined on Domain's level is not seen when connected to Multi-Domain Management Server.
02157451	When reassigning global policy to more than ~40 domains, it works only for the first ~40.
Security Management
02049207	Global policy assign fails with 'More than one object named 'autoupdate_and_obj_user_modified' exists' error.
02036290	HA sync / set Active to Standby fails when Endpoint blade is enabled on one of the Security Management objects.
02015346	"An internal error has occurred" error on reassignment of Global Access and Threat Policies failure.
02002865, 01987757	MDS removal attempt fails with the "Certificate Athority on <MDS name> is in Read Only Mode. Try to run it again on the Multi-Domain Server that holds the active global Domain" message when user is connected to the MDS, on which the global domain is active.
02007020	Advanced upgrade crashes with core dump due to corrupted cache in IBM SR9 FP20. The IBM version was promoted to SR9 FP30.
02019255	SmartConsole crashes when several administrators work simultaneously on TP rulebase.
02015548	"An error occurred while performing a rulebase operation" message after removing assigned global policy.
02015300	Rulebase error and reload due to multi-user work on the rulebase and changing it's structure.
02002930	"... Administrator <name> is connected from IP null with application CPM Server ...." error on creation of secondary Domain / Log server failure.
02002922	Global manager administrator with Read Only permissions to Domain can select to run Global policy assignment on the domain, causing "Unexpected error".
02200824	Session disconnects when opening log file (non-index mode).
02172205	Removing AGP finished unsuccessfully with a server crash.
02209010	No logs after disabling log indexing; the session is invalid or expired.
02160321	On AGP, when there are multiple errors, they do not show any additional info.
SmartConsole
02170680	Fail-Close engine setting for Threat Prevention is not enforced after upgrade to R80 Security Management. Refer to sk112533.
02100655	Fields that contains numeric values are sorted lexicographically.
02103723	No filter of users/machines by Active Directory node in Access Role editor.
02103757	The APPI update text shown in the view does not work when machine is behind a proxy server (the connection does not use proxy settings configured on the Windows machine).
02121738	"Execution error" message when cloning the Threat Prevention global recommended protection profile at local domain.
02088167	After creating "interoperable" device and adding it to a star community, cannot add a shared secret password to this device because it is not listed in the "Shared Secret" tab. Refer to sk112182.
02043973	When connecting to another version, the link to the web points to a generic page, which does not have a download link for SmartConsole.
02035612	When the login welcome message image added by user is missing or corrupted, the SmartConsole crushes.
02041985	Latest updates are not retrieved and client reports to be update-to-date although it is not.
02082971	When opening shell, the encoded password will be written in the audit log.
02053623	Cannot scroll down to find the relevant gateway in "Satellite gateway" list in IPSec VPN Star community window. Refer to sk111736.
02056363	SmartDashboard components are not loaded when connecting with SmartConsole to CMA that is behind NAT.
02070225	GUI crash when performing "Get Interfaces" on "Network Management" page when launched from SmartDashboard.
02070227	SmartConsole does not response for a long time or crashes when there are many VLANs on a physical interface on getInterface command.
02100860	Cannot scroll down in Gateways tab of VPN Community Editor.
02110524	In rare occasions, the user.config file becomes corrupted while logging into the SmartConsole. This corruption is not being recovered well, and crashes the console.
02110528	With Anti-Spam blade enabled, when adding a comment in the MTA and publishing the change, the comment will not be saved.
02118776	QoS classes are not shown in the list on the QoS external interface tab.
02119446	"Failed to load SmartDashboard component. Please make sure Check Point SmartDashboard is installed." error when trying to view or edit an object in Gateways & Servers tab.
02012562	SmartConsole crashes when logging to domain with domain name containing illegal path characters.
02302227	IPS protection with severity NA is inactive, but appears active in the GUI.
02160397	Global policy re-assignment is not executed on all the selected domains.
02062201	SmartConsole crashes on certain scenarios when Cancel button was pressed at the administrator Editor.
02086486	On Multi-Domain Management Server, installation of Threat Prevention policy fails on 1100 / 1200R / 1400 appliances. Anti-Bot overrides are not enforced on 1100 / 1200R / 1400 appliances.
02300960	Minimum supported version of application is incorrect in SmartConsole.
Security Gateway
02119721	HTTPD process fails with core dumps created under folder /var/log/dump/usermode/ directory.
02183677	Policy installation failes caused by invalid objects (other services) configuration allowed from the SmartDashboard.
R80 Jumbo HotFix - Take 29 (09 June 2016)
Multi-Domain Management Server
02002954	Manual full sync on a Multi-Domain Management Server Domain fails.
02005764	Administrator lock status is not synchronized between primary and secondary Multi-Domain Management Servers.
01990150	After Assign Global Policy with 'Manage protection actions' and custom Threat Prevention profiles in the global domain, Remove Assign Global Policy gets stuck with a 'Server disconnected' error.
02000379	The first time that Assign Global Policy is run, global objects do not appear on the local domain.
Security Management
02007965	After installing a policy on gateways of R77.xx and lower, connectivity issues may occur if policy rules contain an RDP_TPC_UDP service group in the Application layer.
02006161	After removing a cluster member from a cluster in a user domain, synchronization in System Domain fails.
02005525	If User Check objects with Invalid names (space or special characters) are used in Threat Prevention profiles, after Threat Prevention install policy, Anti-Bot an Anti-Virus blades will not be enforced.
02013068	The path cannot be changed during restore with TFTP.
01998604	"Failed to monitor SAM rules" message appears when choosing "Show on Gateway_Name" in the Suspicious Activity Rules editor in SmartView Monitor. New SAM (Suspicious Activity Monitoring) rules cannot be added in SmartView Monitor. After Add -> Enforce (to add a new SAM rule), the "The block process failed" message appears.
02027028, 02027018	In some VSX configurations, the packet capture cannot be fetched.
02006959	"Internal error occurred during the verification process" error on policy installation failure if you revert to a policy with a disabled rule that has a non-existent object.
02011440	Application Control update does not work on 1100 Small and Medium Business Appliances.
02006013	The mgmt_cli does not work with the IP address of the domain.
02006160	After upgrade, login to a user domain fails with "Failed to authenticate null" message.
SmartConsole
02013032	Gateway status and health information is not displayed on a secondary Security Management Server.
02006088	SmartConsole shows a crash dialog on some server disconnection scenarios.
02001594	"Failed to apply shared licenses" error on synchronization failure.
02024604	The Group Selected Objects command in a rule can cause a crash.
02006112	Domain Management Server names must begin with an alphabetical character. But there is no input validation to stop you from naming a Domain Management Server with a string that starts with a numeric character.
02000497	An administrator without "HA Operations" permissions is not blocked from performing switch-to-active on a standby Domain server.
02021024	SmartConsole crashes when the DLP tab is opened twice.
02024591	Closing the Compliance tab causes other Compliance tabs to be stuck with a white screen.
02007535	Image of 1470/1490 SMB appliances is incorrectly presented.
02021021	SmartConsole becomes unresponsive after opening the Audit Log from Revisions view.
01953640	Client connection lost while editing a VS in a Multi-Domain Security environment.
02009867	Creating/Editing a Threat Prevention profile in one domain, blocks all the profile's operations in all other domains.
01996714	Clone Threat Prevention profile will not copy the IPS static protection overrides from the cloned profile.
02010661	There are duplicate profile activations in IPS Static or Inspection Settings protection editor, in a post upgrade environment with assign global policy and 'Manage protection actions'.
01991664	An administrator without write permissions on IPS protections appears to have the ability to create or edit a Threat Prevention profile, but the profile cannot be saved.
02002862	Removing Virtual Router my cause a crash.
02006842	The show threat-rule-exception-rulebase command cannot work with UID.
02013455	If you use the set command to edit the mask length of a network object, the command does not work and it locks the object.
02016221	API commands fail when working with non-standard ports.
01987575	After assigning a Global Access policy, the ‘Where Used’ feature may show an incorrect number for objects in the access policy.
02000508, 01945475	An OPSEC application is automatically removed, if it refers to a host that was changed.
02002956	A global manger can edit the GUI client in Domain view, but the operation fails with "General Error". The GUI client object remains locked.
01991160	After the assigned policy is deleted from the Global domain, policy re-assign fails with "Global assignment failed: cannot find parameter for class com.checkpoint.management.threat.coresvc.IpsAgpProvider class" error.
02001875	SmartConsole generates an unexpected error on launch of a Domain Management Server from a Multi-Domain Management Server that was connected with CAPI.
01962431	Navigation to Threat Prevention rules from the Log view of a Multi-Domain Server shows "could not navigate to rule" message.
SmartEvent
02022132	Custom View name cannot be change through action.
02022116	No option to clone and edit reports.
02020919	SmartEvent does not filter by the Application Risk field.
02008340	R80 SmartEvent cannot connect to an R77.30 Multi-Domain Management Server.
02012424	When connecting to a global SmartEvent with SmartConsole, in Logs view, only local logs (monitoring) of the SmartEvent server are displayed. Logs from Domain Management Servers are not shown. If a SmartView is opened, there are data and widgets for drill down in the Logs view.
02022051, 01962293	After upgrade, some network objects may appear more than once in Global SmartEvent.
02022076	Global SmartEvent is not updated with global changes made when it is down.
SmartLog
02012419	A high number of GEO protection logs affects performance (disk space, indexing rate, etc.).
02022112	The Audit Logs view shows logs' card with log details.
02012416	Logs from forwarded log files are not indexed (only one file is indexed when there are several log files with the same file ID).
02012415	Groups with exclusions are not searchable immediately after creation.
02020052	Interface names are not searchable in SmartLog for logs of type "firewall".
R80 Security and stability enhancements for Security Management server (Hotfix #1) (25 Apr 2016)
01996434, 01998604	When choosing "Show on Gateway_Name" in the Suspicious Activity Rules editor in SmartView Monitor, the following message appears: "Failed to monitor SAM rules". New SAM (Suspicious activity Monitoring) rules cannot be added in SmartView Monitor. The following message appear after using the Add -> Enforce option to add a new SAM rule: "The block process failed".
01997794, 02006927	In rare scenarios login to SmartDashboard in Management HA environment fails after failover.
01999269, 02004412, 02015303	Primary Multi-Domain Management server may crash with cpm core file. All FWM processes were in pending state and machine was out of memory.
01998131, 02005525, 02005566	If the Threat Prevention profiles action is Ask, malicious sites can be reached with no redirection to the Anti-Virus ask page.
01998970, 02000508, 02004471, 01945475	OPSEC Server Application object is missing after database import to R80.
02001921, 02016425	RDP (UDP/port 259) is changed to RDP (UDP/port 3389) after upgrade to R80.
02004016, 02016247	Pre-Upgrade Verifier crashes on export if the GUI client list ($FWDIR/conf/gui-clients) includes an empty line.
02020403, 02020470, 02020452	"Services port conflict" warning when installing Security policy after upgrade to R80. Refer to sk111114.

 

Installation instructions

Important Notes:

• This Jumbo Hotfix Accumulator has to be installed only after successful completion of Gaia First Time Configuration Wizard.
• In Management HA environment:
  Jumbo Hotfix Accumulator must be installed on both Management Servers.
• It is recommended to install Jumbo Hotfix Accumulator on all the R80 machines in the environment running on Gaia OS.
• For CPUSE installation, must use CPUSE Agent build 1127 and above (refer to sk92449).
• Installation of a newer Take of Jumbo Hotfix Accumulator on top of the current Take when running CPUSE Agent build 1127 and above (refer to sk107320):
  
  • If the previous Take of Jumbo Hotfix Accumulator was installed using Legacy CLI, then the next Take can be installed using the CPUSE.
  • If the previous Take of Jumbo Hotfix Accumulator was installed using CPUSE, then all subsequent Takes must also be installed using CPUSE.

 

Procedure:

• Show / Hide instructions for installation in Gaia Portal - using CPUSE (Check Point Update Service Engine)
  
  

  For detailed installation instructions, refer to sk92449 - CPUSE - Gaia Software Updates (including Gaia Software Updates Agent) - section "(4) How to work with CPUSE".

  • Online installation for General Availability Take

    1. CPUSE Software Updates Policy should be configured to allow self-update of CPUSE Agent.
       Otherwise, users should manually install the latest build of CPUSE Agent from sk92449.
    2. Connect to the Gaia Portal on your Check Point machine and navigate to Upgrades (CPUSE) section - click on Status and Actions.
    3. Select the hotfix package Check Point R80 Jumbo hotfix T<number> for sk111536 - click on More button on the toolbar - click on Verifier (or right-click on the package and click on Verifier).
    4. Select this hotfix package and click on Install Update button on the toolbar.

  • Offline installation

    Note: Either get the offline package from Check Point Support, or export the package from a source Gaia machine, on which this package was already downloaded / installed (for package export instructions, refer to sk92449 - section "(4-D) "How to ..."").

    1. Install the latest build of CPUSE Agent from sk92449.
    2. Connect to the Gaia Portal on your Check Point machine and navigate to Upgrades (CPUSE) section - click on Status and Actions.
    3. In the upper right corner, click on the Import Package button.
    4. In the Import Package window, click on Browse... - select the CPUSE package (either offline TGZ file, or exported TAR file) - click on Import.
    5. Above the list of all software packages, click on the Showing Recommended packages button - select All.
    6. Select the imported package Check Point R80 Jumbo hotfix T<number> for sk111536 - click on More button on the toolbar - click on Verifier (or right-click on the package and click on Verifier).
    7. Select this package and click on Install Update button on the toolbar.

  
  
  
• Show / Hide instructions for installation in Gaia Clish - using CPUSE (Check Point Update Service Engine)
  
  

  For detailed installation instructions, refer to CPUSE - Gaia Software Updates (including Gaia Software Updates Agent) - section "(4) How to work with CPUSE".

  • Online installation for General Availability Take

    1. CPUSE Software Updates Policy should be configured to allow self-update of CPUSE Agent.
       Otherwise, users should manually install the latest build of CPUSE Agent from sk92449.
    2. Connect to command line on Gaia OS.
    3. Log in to Clish.
    4. Acquire the lock over Gaia configuration database:
       HostName:0> lock database override
    5. Show the packages that are available for download:
       Note: Refer to the top section "Hotfixes" - refer to "Check Point R80 Jumbo hotfix T<number> for sk111536"
       HostName:0> show installer packages available-for-download
    6. Verify that this R80 Jumbo Hotfix Accumulator package can be installed without conflicts:
       HostName:0> installer verify <Package_Number>
    7. Download the package from Check Point cloud:
       HostName:0> installer download <Package_Number>
    8. Install the downloaded package:
       HostName:0> installer install <Package_Number>
       Note: The progress (in per cent) will be displayed in Clish.

  • Offline installation

    Note: Either get the offline package from Check Point Support, or export the package from a source Gaia machine, on which this package was already downloaded / installed (for package export instructions, refer to sk92449 - section "(4-D) "How to ..."").

    1. Install the latest build of CPUSE Agent from sk92449.
    2. Connect to the Gaia Portal on your Check Point machine and navigate to Upgrades (CPUSE) section - click on Status and Actions.
    3. On the toolbar, click on the More button and select Import Package.
    4. In the Import Package window, click on Browse... - select the CPUSE package (either offline TGZ file, or exported TAR file) - click on Upload.
    5. Transfer the offline package (TGZ) / exported package (TAR) to the target Gaia machine (into some directory, e.g., /some_path_to_jumbo/).
    6. Connect to command line on target Gaia OS.
    7. Log in to Clish.
    8. Acquire the lock over Gaia configuration database:
       HostName:0> lock database override
    9. Import the package from the hard disk:
       Note: When import completes, this package is deleted from the original location.
       HostName:0> installer import local <Full_Path>/<Package_File_Name>.TGZ_or_TAR
    10. Show the imported packages:
        Note: Refer to the top section "Hotfixes" - refer to "Check Point R80 Jumbo hotfix T<number> for sk111536"
        HostName:0> show installer packages imported
    11. Verify that this R80 Jumbo Hotfix Accumulator package can be installed without conflicts:
        HostName:0> installer verify <Package_Number>
    12. Install the imported package:
        HostName:0> installer install <Package_Number>

 

Uninstall instructions

Important Notes:

• This Jumbo Hotfix Accumulator removes all its packages during uninstall.
• Requires CPUSE Agent build 1127 and above (refer to sk92449).
• In case the UEPM process is not running after uninstalling this Jumbo Hotfix Accumulator, refer to sk113023.

Procedure:

• Show / Hide instructions for uninstall in Gaia Portal - using CPUSE (Check Point Update Service Engine)
  
  

  1. CPUSE Software Updates Policy should be configured to allow self-update of CPUSE Agent.
     Otherwise (and if this machine is offline), users should manually install the latest build of CPUSE Agent from sk92449.
  2. Connect to the Gaia Portal on your Gaia machine and navigate to the 'Upgrades (CPUSE)' section - click on 'Status and Actions'.
  3. Above the list of all software packages, click on the 'Showing Recommended packages' button - select 'All'.
  4. Right-click on the Jumbo Hotfix Accumulator package - click on 'Uninstall'.
  5. A warning will be displayed that after this uninstall, the machine will be automatically rebooted.
     Click on 'OK' to start the uninstall.

  
  
  
• Show / Hide instructions for uninstall in Gaia Clish - using CPUSE (Check Point Update Service Engine)
  
  

  1. CPUSE Software Updates Policy should be configured to allow self-update of CPUSE Agent.
     Otherwise (and if this machine is offline), users should manually install the latest build of CPUSE Agent from sk92449.
  2. Connect to command line on Gaia OS.
  3. Log in to Clish.
  4. Acquire the lock over Gaia configuration database:
     HostName:0> lock database override
  5. Uninstall the package:
     HostName:0> installer uninstall <Package_Number>
     Note: The progress (in per cent) will be displayed in Clish.
  6. Machine will be rebooted automatically.

  
  
  

 

Legacy CLI instructions

 

List of replaced files

List of files replaced by this Jumbo Hotfix Accumulator can be provided upon request by Check Point Support.

 

Revision History