• General
  • General
  • Gaia OS
  • Hardware
  • Management and Policy

• Infrastructure
  • SecureXL
  • VSX

• Networking
  • Networking
  • IPv6
  • Carrier Grade NAT (CGNAT)

• Software Blades
  • Firewall
  • VPN
  • Threat Prevention
  • HTTPS Inspection
  • DLP
  • SmartView Monitor
  • QoS
  • SmartProvisioning

VSX Gateway: Application Control / URL Filtering / Anti-Virus / Anti-Bot updates do not take place for two hours after installing a policy on a newly installed VSX Gateway / VSX Cluster.

Workaround:

1. Connect with SmartDashboard to Security Management Server / Main Domain Management Server that manages this VSX Gateway / VSX Cluster.
2. Open the VSX Gateway / VSX Cluster object.
3. Enable the Application Control blade and/or the URL Filtering blade and/or Anti-Virus blade and/or Anti-Bot blade on the VSX Gateway / VSX Cluster.
4. Install the policy on this VSX Gateway / VSX Cluster object.
5. Check these software blades are able to perform the updates.
6. Connect with SmartDashboard to Security Management Server / Target Domain Management Server that manages the relevant Virtual System.
7. Open the Virtual System object.
8. Enable the Application Control blade and/or the URL Filtering blade and/or Anti-Virus blade and/or Anti-Bot blade on the Virtual System.
9. Install the policy on this Virtual System object.
10. Connect with SmartDashboard to Security Management Server / Main Domain Management Server that manages this VSX Gateway / VSX Cluster.
11. Open the VSX Gateway / VSX Cluster object.
12. Disable the Application Control blade and/or the URL Filtering blade and/or Anti-Virus blade and/or Anti-Bot blade on the VSX Gateway / VSX Cluster.
13. Install the policy on this VSX Gateway / VSX Cluster object.

The VSX Gateway can not be managed from data ports.
The supported Management interfaces are:

• eth1-Mgmt1, eth1-Mgmt2, eth1-Mgmt3, eth1-Mgmt4
• eth2-Mgmt1, eth2-Mgmt2, eth2-Mgmt3, eth2-Mgmt4

R76SP.50 Jumbo Take 96

These SSL ciphers are supported on internal HTTPS servers when the value of kernel parameter choose_active_streaming is set to 0:

• RSA+AES
• RSA+RC4
• RSA+3DES

• "Ask User" action
• UserCheck (Portal and Agent)
• Watermarking
• FTP protocol

• General
  • General
  • Gaia OS (Global Shell / Commands)
  • Hardware
  • Management and Policy
  • Multiple Security Groups
  
  
  
• Installation
  • Installation / Upgrade
  • Licensing

• Infrastructure
  • Security Gateway
  • VSX
  • SecureXL
  • CoreXL
  
  
  
• Networking
  • Networking
  • Dynamic Routing
  • IPv6

• Software Blades
  • IPS
  • VPN
  • Threat Prevention
  • URL Filtering
  • HTTPS Inspection
  • Identity Awareness
  • ConnectControl
  • DLP

• Monitoring
  • SNMP
  • CPView

If time synchronization fails, the Skew too high error message shows when you run "asg diag verify <clock_id>".

This can occur because the value of the "replies_from_any_port" parameter was set to "true" for the "ntp-udp" service using the GuiDBedit Tool.
The SGMs cannot complete local NTP synchronization because the SGM that receives the response does not know to which SGMs to send the response.

To correct this NTP synchronization issue:

1. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.).
   Verify by running the "cpstat mg" command on Security Management Server / in the context of each Domain Management Server.
2. Connect with GuiDBedit Tool to Security Management Server / Domain Management Server.
3. In the upper left pane, go to Table - Services - services.
4. In the upper right pane, select the ntp-udp object.
5. Press CTRL+F (or go to Search menu - Find) - paste replies_from_any_port - click on Find Next.
6. In the lower pane, right-click on the replies_from_any_port - select Edit... - select "false" - click on OK.
   
7. Save the changes: go to File menu - click on Save All.
8. Close the GuiDBedit Tool.
9. Connect with SmartDashboard to Security Management Server / Domain Management Server.
10. Install the policy.

Gaia Clish command "show snapshots" can display an error:
"NMSNAP9999  Timeout waiting for response from database server".

Gaia Clish command "show snapshots" can display an error:
"NMSNAP0042  Snapshot mechanism is not supported in this system".

By default, the "asg diag resource verifier" option only shows a warning about resource mismatches between SGMs.
The verification test results show as "Passed" in the output and no further action is taken.
You can change the default behavior with this procedure:

1. Edit the $FWDIR/conf/asg_diag_config file:
   [Expert@HostName:0]# vi $FWDIR/conf/asg_diag_config
2. Search for the parameter MismatchSeverity
3. Set the value of this parameter to one of these values:
   
   • fail - Verification test result will be set to "Failed"
   • warn - Verification test result will be to "Passed", and a warning will be shown
   • ignore - Verification test result will be to "Ignore", and no errors will be shown

• In VSX mode - When there is a bond configured with no VLANs.
• In Bridge mode - When the bridge interface is not configured.

Verification is needed after changing QSFP mode on SSMs:
"show smo verifiers print name <Port_Speed>".

If verification failed, then change the QSFP mode on SSMs again:
"set ssm id <SSM_ID> qsfp-ports-mode <Port_Speed>"

Dynamic Objects configured in SmartDashboard are not synchronized on all SGMs.

Workaround:
After you add a Dynamic Object to a rule and install the policy, run the relevant "dynamic_objects ..." command on every SGM to manually add the desired Dynamic Object(s).
For example: dynamic_objects -n object -r 192.168.1.1 192.168.1.40 -a

You cannot install 41000 Security System licenses with SmartUpdate versions earlier than R77.20.

Workaround:

1. Copy the license file to /var/log/ directory on all SGMs.
2. In gclish, run the following command to install the license file: cplic put -l /var/log/<License_File>

Traffic inspected by the following Software Blades does not survive cluster Connectivity Upgrade:

• Mobile Access
• DLP
• VPN - Remote Access
• IPv6
• Dynamic Routing
• Identity Awareness (if a session authenticated with Identity Awareness is open when you start Connectivity Upgrade, then the session will be terminated)

When running setup wizard and configuring the first SGM, pressing CTRL+C keys after clicking on "Finish", cancels the installation, and the SGM state remains unstable.

When running the First Time Wizard from PuTTY, the Backspace key does not work.

Workaround: Change the configuration of the Backspace key in PuTTY:

• Go to "Terminal" - "Keyboard".
• In "The Backspace key" section, select "Control-H.
  

In VSX environment, where a Virtual System is connected with a Wrp interface to a Virtual Switch, and that Virtual Switch is connected to a physical interface (VS, wrp -- wrpj, VSW - ethX), and the Distribution mode on the Wrp interface is different from the Distribution mode on the physical interface, changing of the Distribution mode on the Wrp interface might lead to the traffic being dropped as out-of-state (with the log "First packet isn't syn").

• Topology: eth1-01 --- [VS1] wrp128 --- wrpj128 [VSW] eth2-01
• Interface eth1-01 on VS has a USER distribution mode
• Interface wrp128 on VS has a USER distribution mode
• Interface eth2-01 on VSW has a NETWORK distribution mode
• Changing the distribution mode of wrp128 on VS to NETWORK might cause some connections to be dropped

When the FWK process is down, and there is no connectivity in the chassis, the only way to restore connectivity is to restore snapshot from the local hard disk. It is also possible to restore to the factory default image.

• To check if the FWK process is down, run this command in Expert mode:
  [Expert@HostName]# fw ctl affinity -l -x -vsid 0 | grep fwk

• To restore a snapshot, from gclish, run:
  HostName:0> set snapshot revert <Snapshot_Name>

• To restore to factory default image, reboot and from Boot menu choose "Restore Default".

When pushing a VSX configuration to a VSX Gateway object in SmartDashboard (by clicking on "OK" in the VSX Gateway object) or removing/adding a VLAN interface in gclish and changing the VLAN enhancement state, the Active and Standby chassis freeze for 5 seconds. This is by design.

If the freeze happens during another Chassis HA freeze, the previous freeze stops and a new freeze starts.

The reasons for the Chassis HA freeze are:

1. After every regular failover (not caused by one chassis going to "Down" state), the chassis is in freeze mode for 30 seconds.
   Refer to sk32488.
2. When the grade of Standby chassis is changed, and this chassis becomes Active because of the new grade, there is another freeze before the chassis becomes Active.
   The reason for this freeze is to let the chassis grade stabilize before the chassis becomes Active, and to avoid grade flapping (for example: fan goes up, down, up, down, ...).

Activating the IPS blade in the context of VSX Gateway itself (VS0) may cause failures in firmware file transfer between SGMs and SSMs.

Workaround:

1. Open the VSX Gateway object - disable the IPS blade and click on OK - install the policy
2. Copy the firmware to all SSMs
3. Open the VSX Gateway object - enable the IPS blade and click on - install the policy

If you reduce the Connections Table limit of a Virtual System ,and one of the SGMs has more or the same number of connections than the limit, the new value is rejected for that SGM.
The new Connections Table limit may be accepted by other SGMs.

Notes:

• To see the current number of entries in Connections Table, run this command in Expert mode:
  [Expert@HostName:0]# fw tab -t connections -s

• To configure the Connections Table limit of a Virtual System:
  In SmartDashboard - open the Virtual System object - go to "Capacity Optimization" pane - set the value in the field "Limit the maximum concurrent connections" - click on OK - install the policy

When an interface is defined as VLAN trunk with no VLAN interfaces and no link, the chassis grade is reduced.

Workaround:

1. Open the the VSX Gateway object
2. Go to the "Physical Interfaces" pane
3. Clear the "VLAN Trunk" checkbox
4. Click on OK to push VSX configuration

After changing the Distribution Mode with the "asg dxl dist_mode set" command, the change is automatically verified.
This verification can fail with a message "Found matrix inconsistency" and "verification failed".

If this happens:

1. Ignore the message.
2. After a few seconds, run the "asg dxl dist_mode verify" command to make sure the verification succeeded.
3. After a few seconds, run the "asg dxl dist_mode verify" command again to make sure the verification succeeded.

The Alerts configuration wizard does not allow setting of performance thresholds per Virtual System.
You can manually configure thresholds for Virtual Systems using the "dbset" command from the Expert shell:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:<alert_name> <value>

Where <value> is the percentage of the default threshold per SGM.

Example:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:packet_rate_threshold_high 30
In this example, alert is triggered when any Virtual System packet rate is higher than 30% x 1.8MB (1.8MB is the default packet rate threshold per SGM)

Default values:

• [Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:concurr_conn_threshold_high 10
  Default value is: 10% x 3000000
• [Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:conn_rate_threshold_high 10
  Default value is: 10% x 90000
• [Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:throughput_threshold_high 10
  Default value is: 10% x 16000000000
• [Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:packet_rate_threshold_high 10
  Default value is: 10% x 1800000

Notes:

• One ratio applies to all Virtual Systems.

The "fw ctl affinity -l -r" command does not provide correct information about interface affinity to CPU cores.
The 60000 / 40000 Security System supports multiple queues on network drivers, and each driver can have an affinity to multiple CPU cores.

Mandatory steps to connect remotely to a Chassis with enabled "Unique IP address per Chassis" (UIPC):

1. Create a security rule that allows UIPC traffic (remote connections to unique IP addresses configured on Chassis).
2. Install the policy on all SGMs.

In order to activate Jumbo Frames on chassis installed with SSM60, follow these steps for each SSM60 in the chassis.
In a Dual Chassis systems, perform this procedure for both Chassis.

1. Connect to the SSM from one of the SGMs over Telnet (the default password is admin).
2. Go to the Enable mode:
   # enable
3. Go to the configuration terminal:
   # configure terminal
4. Configure all the downlink interfaces:
   # interface range 1/2/1-1/14/1
5. Configure the MTU:
   # packet-size-limit 9146
6. Configure the required front panel ports:
   # interface range 1/15/1-1/15/5
7. Set the required MTU:
   # packet-size-limit 9146
8. Close the configuration terminal:
   # end
9. Save the configuration:
   # write

Follow these steps to disable Jumbo Frames configuration in VSX environment where VLAN interfaces are configured:

1. In SmartDashboard, set the MTU values on all VLAN interfaces back to standard 1500
2. From Expert mode, manually set the MTU value to standard 1500 on each physical/bond interface that has VLAN configured. Run the following command for each such interface:
   [Expert@HostName:0]# dbset interface:<Name_of_Interface>:mtu 1500

1. Per-port distribution mode is limited to 1024 interfaces at the SSM level.
2. The total number of topology interfaces that are allowed to be configured decreases
   when Bond interfaces are configured with multiple slave interfaces on the same SSM.
   Each VLAN is counted per each Bond slave interface, on which it is configured.

Example:

1. Bond interface bond3 is configured with slave interfaces eth1-03 and eth1-04.
2. Both of these slave interfaces are located on the same SSM.
3. VLAN 300 is configured on bond3 interface (bond3.300) on the Security Gateway.
4. SSM1 counts VLAN 300 twice - once for port eth1-03 and once for port eth1-04.

When deleting an IP address from an interface with UIPC, the UIPC address is not deleted from that interface.

Connectivity issues can occur when you work with 4 SSMs and Link Aggregation LACP in these cases:

• You restart SSM1 and the LACP ports are located on SSM1 and SSM3.
• You restart SSM2 and the LACP ports are located on SSM2 and SSM4.

This occurs because the adjacent switch "sees" the LACP link on the ports as UP, but the SGMs see the ports as DOWN.

Workaround: Perform one of these steps:

• Configure the LACP ports on SSM1 and SSM4
• Configure the LACP ports on SSM2 and SSM3
• Configure fast LACP rate on the adjacent switch

Bonded High Availability mode cannot switch from "Primary Up" to "Active Up".

Cannot set slave interface to "ON" when it is part of bonding group.

Workaround:

1. Delete all slaves from bonding group:
   HostName:0> delete bonding group <bond_id> interface <slave_ifn>
2. Set the slave interfaces state to on:
   HostName:0> set interface state on
3. Add interfaces back to bonding group:
   HostName:0> add bonding group <bond_id> interface <slave_ifn>

Critical Device (pnote) named "routed" was added to prevent traffic outage by allowing RouteD daemon to synchronize BGP routes.

• In BGP DR Manager failback scenarios, old BGP DR manager will go down for 2 minutes
• When RouteD daemon restarts on BGP DR Manager, BGP DR Manager will go down for 2 minutes

Note: a system can use SSM Layer4 Distribution Mode along while IPv4 and IPv6 is inspected by the gateway. Each IP version will use a different mechanism to distribute traffic, as described above.

IPSec VPN Link Selection Limitations:

• IP Selection by Remote Peer - supports only the "Selected address from topology table" option.
• Outgoing Route Selection - supports only the "Operating system routing table" option.

Sometimes users cannot reconnect with Endpoint Security (VPN) R75 client to 60000 / 40000 Security System from a computer that is configured with different users within the same user group.

Long URL addresses through a proxy are not blocked.

Workaround:

1. Connect with GuiDBEdit Tool to Security Management Server / Domain Management Server.
2. In the upper left pane, go to Table - Global Properties - properties.
3. In the upper right pane, click on firewall_properties.
4. Press CTRL+F (or go to Search menu - Find) - paste enable_extenstive_search - click on Find Next.
5. In the lower pane, right-click on the enable_extenstive_search - select Edit... - select "true" - click on OK.
   
6. Save the changes: go to File menu - click on Save All.
7. Close the GuiDBedit Tool.
8. Connect with SmartDashboard to Security Management Server / Domain Management Server.
9. Install the policy onto this 60000 / 40000 Security System object.

Not able to load the Check Point MIB files from R76SP into MIB Browser (e.g., CA Spectrum OneClick) - MIB Browser shows multiple errors:

• Could not parse the file CHECKPOINT-MIB.
• Could not parse the file CHECKPOINT-GAIA-TRAP-MIB.
• The MIB CHECKPOINT-MIB referenced by the selected file appears to contain more than one MIB definition.
• The MIB RFC1155-SMI referenced by the selected file appears to contain more than one MIB definition.

If the CPView is running while adding SGMs to a security group, then SGM private statistics will not be presented until CPView is reopened.

After new installation or changes in hardware, it will take up to 24 hours for the CPView to automatically collect and present the hardware information in "Hardware" - "Version" tab.

"Unable to open '/vs<VSID>/dev/fw6v0': Connection refused" error is displayed when running the "cpview" command on 60000 / 40000 chassis when there are some Virtual Systems configured with both IPv6 and IPv4, and there are some Virtual Systems configured with only IPv4.

• This error message is cosmetic and does not indicate any performance / configuration issue
• This error message appears during each CPView refresh time
• This error message appears when CPView is ran from the context of a Virtual System configured with only IPv4

Example (for VS 21):

[Expert@R76SP_50_VSX-ch01-02:21:ACTIVE]# cpview
 Unable to open '/vs21/dev/fw6v0': Connection refused 
 fw_get_kernel_instance_num: Invalid instance num 0 - return 0 
|-----------------------------------------------------------------------------------| 
| CPVIEW.Scalable_Platform                       SGM:1_2 VSid:21 21Mar2017 15:48:27 | 
|-----------------------------------------------------------------------------------| 
| Scalable_Platform Local_SGM                                                       | 
... ...