• General
  • General
  • Gaia OS
  • Hardware
  • Management and Policy

• Infrastructure
  • SecureXL
  • VSX

• Networking
  • Networking
  • IPv6
  • Carrier Grade NAT (CGNAT)

• Software Blades
  • Firewall
  • VPN
  • Threat Prevention
  • HTTPS Inspection
  • DLP
  • SmartView Monitor
  • QoS
  • SmartProvisioning

R80.20SP does not support:

• DHCP Client configuration
• DHCP Server configuration
• Dynamically Assigned IP (DAIP) configuration

• Scalable Platforms 40000 / 60000
• Small Business and Branch Offices appliances 3000, 1400, 1200R, or lower.

The Gaia Portal on Maestro Hyperscale Orchestrator supports these web browsers:

• Google Chrome 71.0 and later
• Microsoft Edge 40.15063 and later
• Microsoft Internet Explorer 11.0.50 and later
• Firefox 64.0 and later

Maestro Security Appliances do not support Central Management of Gaia Device Settings:

1. In SmartConsole, click on "Gateways & Servers" on the navigation panel.
2. Right-click on the Maestro Security Appliance gateway object. 
3. The "Scripts" menu and "Actions" menu are not supported.  

• 10 GbE and 40 GbE
• 10 GbE and 100 GbE

All Security Appliances in the same Maestro Security Group must have identical Expansion Cards installed (the type and the number):

• All Security Appliances must have either 1 x Quad-Port NIC, or 2 x Dual-Port NICs.
• All other Expansion Cards must be removed from all Security Appliances, even if these Expansion Cards are not used.

The VSX Gateway can not be managed from data ports.
The supported Management interfaces are:

• eth1-Mgmt1, eth1-Mgmt2, eth1-Mgmt3, eth1-Mgmt4
• eth2-Mgmt1, eth2-Mgmt2, eth2-Mgmt3, eth2-Mgmt4

• General
  • General
  • Gaia OS (Global Shell / Commands)
  • Hardware
  • Management and Policy
  
  
  
• Installation
  • Installation / Upgrade
  • Licensing

• Infrastructure
  • Security Gateway
  • VSX
  • SecureXL
  • CoreXL
  • Cluster
  • Hyper-Threading
  
  
  
• Networking
  • Networking
  • Dynamic Routing
  • IPv6

• Software Blades
  • IPS
  • VPN
  • Threat Prevention
  • URL Filtering
  • HTTPS Inspection
  • Identity Awareness
  • ConnectControl
  • DLP
  • Logs

• Monitoring
  • SNMP
  • CPView

Gaia OS does not support Bond interface in Round Robin mode.

Maestro appliances do not support the following Gaia Clish commands: 

• set chassis id VALUE alert_threshold cpus_temperature_threshold_low VALUE
• set chassis id VALUE alert_threshold fans_threshold_high VALUE
• set chassis id VALUE alert_threshold fans_threshold_low VALUE
• set chassis id VALUE alert_threshold power_consumption_threshold_perc_high VALUE
• set chassis id VALUE alert_threshold power_consumption_threshold_perc_low VALUE
• set chassis id VALUE modules_amount cmm VALUE
• set chassis id VALUE modules_amount fans VALUE
• set chassis id VALUE modules_amount power_units VALUE

• show chassis high-availability factors sensor cmm
• show chassis high-availability factors sensor fans
• show chassis high-availability factors sensor power_supplies
• show chassis id VALUE alert_threshold cpus_temperature_threshold_high  
• show chassis id VALUE alert_threshold cpus_temperature_threshold_low  
• show chassis id VALUE alert_threshold fans_threshold_high
• show chassis id VALUE alert_threshold fans_threshold_low
• show chassis id VALUE alert_threshold power_consumption_threshold_perc_high
• show chassis id VALUE alert_threshold power_consumption_threshold_perc_low
• show chassis id VALUE modules_amount cmm
• show chassis id VALUE modules_amount fans
• show chassis id VALUE modules_amount power_units

Gaia Clish command 'show snapshots' might display the following error: "NMSNAP9999 Timeout waiting for response from database server".

Workaround: Run the 'show snapshots' command again.

Gaia Clish command 'show snapshots' might display the following error: "NMSNAP0042 Snapshot mechanism is not supported in this system".

Workaround: Run the 'show snapshots' command again.

A CLI command that uses a range for the parameter can only operate if all the relevant SGMs are defined in the security group.

The arguments of the global commands are processed before the local (native) arguments, and this can cause the local arguments to be ignored. For example, the 'g_ls -l /tmp/' command is processed as 'ls /tmp/' on the local SGM instead of as 'ls -l /tmp/' on all SGMs.

Relocating the local arguments within the command (where applicable) can resolve the problem. For example, run the 'g_ls /tmp/ -l' command instead of the 'g_ls -l /tmp/' command.

When exporting or importing a snapshot, you must export from or import to the /var/log directory.

• To export a snapshot, run the 'set snapshot export <image_name> path /var/log/' command.
• To import a snapshot, run the 'set snapshot import <image_name> path /var/log/ name <new_name_for_image>' command.

Running the 'asg_hard_shutdown' command on an SGM two times, one after the other, causes a reboot and not a shutdown.

It takes one minute for the SGM to shut down after running the 'asg_hard_shutdown' command. During this interval, do not run the 'asg_hard_shutdown' command again.

When you run multiple gclish 'set ...' commands, one after another, some of these commands can stop running. When this happens, the message "Processing Transaction" shows in the output.

Verification is needed after changing QSFP mode on SSMs:
"show smo verifiers print name <Port_Speed>".

If verification fails, change the QSFP mode on SSMs again:
"set ssm id <SSM_ID> qsfp-ports-mode <Port_Speed>"

The Ethernet ports on the SGMs are not used. Each SGM has two Ethernet ports that are not used by the system and must not be configured. The output of the 'ifconfig' command displays these ports as eth1 and eth2.

Transceivers for Maestro Security Appliances are not interchangeable with transceivers from other Check Point appliances. Only transceivers provided with the Maestro Security Appliances are certified for this system.

Asymmetric VoIP connections of SIP and SKINNY protocols do not survive cluster failover. 

R80.20SP does not support Multi Bridge (support for multiple bridge interfaces on a Virtual System in Bridge Mode).

A reset of SIC between the Security Appliances in VSX mode and the Management Server might cause the non-SMO members to change their state to DOWN.

To recover: Reboot the non-SMO members.

To create a VSX Gateway object in SmartConsole for a Maestro Security Group:

1. Assign at least two interfaces to the Security Group.
2. Install the R80.20SP Jumbo Hotfix Accumulator (sk155832) on all Security Appliances in the Security Group.
3. In SmartConsole, create a VSX Gateway object.

If you lower the Connections Table limit of a Virtual System, and one of the SGMs has more or the same number of connections than the limit, the new value is rejected for that SGM. The new Connections Table limit may be accepted by other SGMs. 

Notes:

• To see the current number of entries in the Connections Table, run this command in Expert mode: [Expert@HostName:0]# fw tab -t connections -s
• To configure the Connections Table limit of a Virtual System: In SmartDashboard, open the Virtual System object - go to the "Capacity Optimization" pane - set the value in the "Limit the maximum concurrent connections" field - click on OK - install the policy.

The Alerts configuration wizard does not allow setting of performance thresholds per Virtual System.

You can manually configure thresholds for Virtual Systems using the 'dbset' command from the Expert shell:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold: <alert_name> <value>

Where <value> is the percentage of the default threshold per SGM.

Example:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:packet_rate_threshold_high 30

In this example, an alert is triggered when any Virtual System packet rate is higher than 30% x 1.8MB (1.8MB is the default packet rate threshold per SGM).

Note:

One ratio applies to all Virtual Systems.

After installation, a static route to 192.168.1.254 is automatically created due to the preconfigured subnet for the eth1-Mgmt4 interface.

If you need to configure another static route for the eth1-Mgmt4 interface:

1. Remove the current static route to 192.168.1.254
2. Add the required static route for the eth1-Mgmt4 interface. 

If you installed a 40 GbE card or a 100 GbE card on a Check Point appliance you wish to connect to the Maestro Security Orchestrator, and you did not receive this card as part of the Maestro product, make sure this card meets the minimal requirements:

1. Connect to the command line of the Check Point appliance.

2. Log into Expert mode.

3. Run this single long command:

[Expert@Appliance:0]# for NIC in $(ifconfig | grep ethsBP | awk '{print $1}') ; do echo $NIC: ; ethtool -i $NIC | grep firmware ; done

4. The 'firmware-version' has to be '12.22.1002' or higher.

Example output:

ethsBP4-01:
firmware-version: 12.22.1002
ethsBP4-02:
firmware-version: 12.22.1002

When VLAN traffic needs to traverse the Security Group in Bridge mode, you must configure all relevant VLAN IDs on the Uplink ports assigned to the Security Group in the Gaia Portal on the Maestro Orchestrator.

Note: Configure these VLAN IDs in the Gaia Portal on the Maestro Orchestrator.

Example Topology: (VLAN Trunk port) ==== (Uplink ports on Maestro Orchestrator that are assigned to a Security Group in Bridge mode).

Interfaces cannot be shared between Security Groups.

Critical Device (pnote) named routed was added to prevent traffic outage by allowing the RouteD daemon to synchronize BGP routes.

• In BGP DR Manager failback scenarios, the old BGP DR manager will go down for 2 minutes.
• When RouteD daemon restarts on BGP DR Manager, BGP DR Manager will go down for 2 minutes.

• Site-to-Site VPN with IPv6 peers is not supported.
• Remote Access VPN from IPv6 clients is not supported.

VPN traffic on a VSX Virtual System that is connected to a VSX Virtual Switch is supported only when the distribution mode configured for the WRP interface is the same as the distribution mode configured for the physical interface on the VSX Virtual Switch.

Example of a VSX topology:

(Virtual System) === wrp100 === (Virtual Switch) === (eth1-01)

The same distribution mode must be configured for the interface wrp100 as was configured for the interface eth1-01.

• Main address
• Selected address from topology table
• Statically NATed IP