> Source: [sk108624](https://support.checkpoint.com/results/sk/sk108624)
# sk108624 - Check Point R80 Known Limitations
| Property | Value |
|----------|-------|
| Solution ID | sk108624 |
| Date Created | 2015-11-11 |
| Last Modified | 2022-12-02 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, SmartConsole, Multi-Domain Security Management Server, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R82.00.X, R81.10.X, R82.20 |
| OS | Gaia |
## Solution
This article lists all of the **R80** specific known limitations.
[Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108624) to see the list of R80 Known Limitations.
This article lists all of the **R80** specific known limitations.
This is a live document that may be updated without special notice. We recommend registering to our weekly updates in order to stay up to date. To register go to [UserCenter](https://usercenter.checkpoint.com/) -\> ASSETS / INFO -\> My Subscriptions.
**Important notes:**
* To get a fix for an issue listed below [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) with the issue ID.
* To see if an issue has been fixed in other releases, search for the issue ID in Support Center.
* For more information on R80, see the [R80 Release Notes](http://supportcontent.checkpoint.com/documentation_download?ID=46538) and [R80 Home Page](http://supportcontent.checkpoint.com/solutions?id=sk108623).
Visit [Check Point CheckMates Community](https://community.checkpoint.com/) to ask questions or start a discussion and get our experts assistance.
**Table of Contents**
|-------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| * General * Upgrade * Networking * Gaia * Security Management Server * Multi-Domain Security Management * Licensing * Compliance * SmartConsole | * SmartEndpoint * IPS * Threat Prevention * Application Control / URL Filtering * SmartEvent * SmartUpdate * SmartView Monitor * SmartLog * Logging | * Mobile Access * VPN * Desktop security * QoS * Small and Medium Business Appliances (SMB) * vSEC Controller * VSX * 60000 / 40000 appliances |
Enter the string to filter the below table:
{#General}{#Upgrade}{#Networking}{#Gaia}{#Security Management}{#MDS}{#Licensing}{#Compliance}{#SmartConsole Management}{#SmartEndpoint}{#IPS}{#Threat Prevention}{#URL Filtering}{#SmartEvent}{#SmartUpdate}{#SmartView Monitor}{#SmartLog}{#Logging and Monitoring}{#Mobile Access}{#VPN}{#Desktop security }{#QoS}{#SMB}{#vSEC Controller}{#VSX}{#60000 / 40000 appliances}
|----------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ID | Symptoms |
| General ||
| - | These blades and features are not supported in R80: * SmartMap * Legacy Management Portal - Web-based management functionality - Similar and more advanced functionality can be implemented with the new API in R80. * SmartEvent Intro * Session authentication |
| Upgrade ||
| 01887799 | In R80, indexing is done by a new process called *Indexer* . *Indexer* works similar to SmartLog R77.xx but has its own configuration files stored in *$INDEXERDIR* directory. Customers who defined manually indexing configuration from remote Log servers (via LEA) in SmartLog R77.x or below should manually move them to the new configuration files. To copy settings from SmartLog R77.x configuration files to the new *Indexer* process configuration files: * **For SmartLog servers only** : After upgrading to R80, copy the remote Log servers configured in *$SMARTLOGDIR/smartlog_settings.txt* file to *$INDEXERDIR/log_indexer_custom_settings.conf* . * **For SmartEvent with SmartLog server** : Remote Log servers configured in *$SMARTLOGDIR/smartlog_settings.txt* file are not automatically upgraded. Manually configure the Log servers in SmartEvent GUI -\> correlation unit policy. For more, refer to the [R80 Logging and Monitoring Administration Guide](http://supportcontent.checkpoint.com/documentation_download?ID=46535). |
| 01815141 | Policy revisions are not migrated to R80 Management server during the upgrade process. |
| 01505445 | After upgrading to R80, SmartConsole disconnects from the server during the first policy install. Before a first policy installation on Standalone servers, allow the CPM service in the Services \& Applications column of the rulebase. |
| 01868136 | After upgrading, the Gateway Properties -\> HTTP inspection page shows "*Failed to load Plug-in Page: SSLInpectionPage* ". To resolve the issue, perform the following on the Security Management server: 1. Run *cpstop* 2. Delete the *$FWDIR/conf/newDleSchema.xsd* file 3. Run *cpstart* |
| 01876717 | SmartEvent blade disabled after advanced upgrade to R80 Management. On the Security Management server, run "*evconfig*" to enable the SmartEvent server. |
| 01732941 | After upgrading to R80, there is no visible way to switch between Classic mode and Wizard mode to create a Security Gateway object. New gateways can only be created depending on the setting in Global Properties -\> SmartDashboard customization prior to upgrade. To restore both options: 1. Close all SmartConsole windows. 2. Connect to Security Management / Domain Management Server with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009). 3. On the Tables tab, open Global Properties -\> Properties. 4. Select the *firewall_properties* object. 5. In the Field Name column, select "*hide_use_CP_GW_wizard*". 6. Change the value to *false*. |
| 01970614 | After Multi-Domain Server upgrade, the Domain Management Server version and operating system are not updated. You must manually update this information in SmartConsole. |
| 01929622 | After upgrading to R80, the Gateways \& Servers view does not show version numbers in the Version column. To see the version numbers, open the gateway object for editing, make sure the correct version is selected and click OK. |
| 01905978 | In a High Availability deployment of Multi-Domain Security Management Servers, until the MDS that hosts the active Domain server has been upgraded, it is not possible: * To edit an administrator assigned to that Domain * To edit a client assigned to that Domain * To view global assignments of that Domain |
| 01986530 | Importing a large SmartEvent database can take a long time to complete. Check the upgrade status for progress. |
| 01972676 | CPUSE is not supported for installation of / upgrade to R80. |
| Networking ||
| 01622840 | IPv6 addresses for management interface are not supported on R80 Security Management Server. |
| Gaia ||
| 01995629, 01985269 | If you refresh the browser while running the First Time Configuration Wizard, or try to run the Wizard twice, one of these messages will show: * *Cannot install Check Point Security Management Server. Incompatible hardware* * *Internal Error: Cannot install Check Point Security Management Server* * *Cannot install Check Point Security Management Server. Please contact Check Point Technical Support.* After seeing one of these messages, you must reinstall the device or revert to the factory image. |
| 01441743 | If you change the members of a Gaia Cloning Group with many members down, you are logged out of the Gaia Portal with an incorrect error message: "*Unable to connect to server* ". The correct message is: "*An error occurred while applying configuration change to all cloning group members*" - the operation was successful only for online members. This is the normal behavior of the cloning group. This error does not indicate a critical failure. |
| 01967996 | When connecting to the network interfaces page in the Gaia Portal, an "*Unable to connect to server*" error shows. To resolve, disable the Adblock EasyPrivacy extension of the Adblock plus add-on and try again. |
| 01983922 | The last stage of the First Time Configuration Wizard takes a long time on some machines. To see the progress of the First Time Configuration Wizard, the user must check if these files were created on the machine: * */etc/.wizard_accepted* - means that the First Time Configuration Wizard has finished. * */var/log/ftw_install.log* - means the First Time Configuration Wizard has started and the user must wait until the file */etc/.wizard_accepted* is created. |
| 02415816, 02425190 | Different numbers of recommended updates are displayed in R80 SmartConsole and in R80 Gaia Portal. Refer to [sk115456](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115456). |
| 02483806, 02490757 | External NIC is not detected after upgrade to R80 / clean install of R80. Refer to [sk116587](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116587). |
| Security Management Server ||
| 02017237 | When the Gaia portal on the Security Management server does not use the default port 443, the following issues may occur: * Management commands using the GUI do not work. * Management commands using the Management command line "`mgmt_cli`" tool do not work. * Management commands using clish do not work. * The `api status` command fails with "test failed" error. Refer to [sk111075](http://supportcontent.checkpoint.com/solutions?id=sk111075). |
| 01786890 | If you create an administrator in *cpconfig* , you must run *cpstop* and *cpstart* , as instructed by *cpconfig* . After *cpstart* , no administrators are shown in *cpconfig* . Administrators configured before the upgrade to R80 are also not shown in *cpconfig*. Manage administrator accounts through SmartConsole. |
| 01999344, 02000493 | Login to the Secondary Management from the Management High Availability window fails. Make sure the SmartEvent Server and SmartEvent Correlation Unit blades are not be enabled on the secondary Management object. |
| 01989947 | Fail to add a VSX objects (router, switch, or system) from the secondary Multi-Domain Server when the primary server is powered off. The creation wizard fails to open and an "Operation finished successfully message" shows. To resolve the issue, power on the primary Multi-Domain Server and try again. |
| 01536203 | When selecting the "*Use Gaia administrator: admin*" option in the First Time Wizard, it lets to reuse the Gaia administrator password for SmartConsole. If you later change this password in SmartConsole, the Gaia administrator password remains unchanged. |
| 01984835 | Connection to the Security Management server after running *cpstart* command fails. The *cpstart* process may not have finished. Give it more time then try again. |
| 01810119 | High Availability CLI commands like '*set standby* ' and '*set active* ' that are part of the *send_command* tool, are no longer available. |
| 01989012 | Domain server fails to start with "*Check valid* *license* " error message. If licensing is not the issue, make sure the name of the domain server starts with a letter (and not with a number). * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 01493302 | Internal user names must contain only English language characters. Names in other languages (unicode) will show as question marks in the Users and Administrators window. |
| 01861349 | "Check your connection settings (Proxy, DNS and gateway)" error shows after IPS and Application Control \& URL Filtering update fails if there is no proxy defined. To resolve the problem, run *cpstop* and *cpstart* and try again. |
| 01647690, 01646000 | If policy installation fails on R75.20 1100 gateways, the selected version of the gateway object is probably incorrect. Solution: In the gateway object properties, make sure the correct version is selected. |
| 01884883 | Publishing fails with validation error regarding unique names. SmartConsole will let you create new objects with the same name as an existing object. But before you publish you must give the object or objects a unique name. |
| 01908530 | These commands are not supported in the SmartConsole's CLI: *login, logout, discard* and *publish*. Use the SmartConsole GUI instead. |
| 01848420 | Applications like *Provider.exe* and *Fwpolicy.exe* (SmartDashboard) cannot be used to connect directly to the Security Management server or the Multi-Domain Security Management server. |
| 01861412 | When creating a new object with IP address or name of a deleted object, the following message might show: 1. "There is another network object with the same IP address, are you sure you want to continue?" 2. "Name already used!" To resolve the issue, close and reopen SmartConsole. |
| 01859599 | After converting a gateway to a cluster member and publishing, this error message shows: "*com.checkpoint.management.coresvc.ObjectNotFounfException: Satellite object of type GatewayAggregator not found for core object..* ." To resolve, click Discard. |
| 01950023 | SIC is not allowed by default with upgraded OPSEC applications (OPSEC applications not compiled with SHA-256 support). To fix: 1. On the Security Management server, run:*cpca_client set_sign_hash sha1* (refer to [sk103840](http://supportcontent.checkpoint.com/solutions?id=sk103840)) 2. Install Database. |
| 01948138 | The initial full synchronization of a new High Availability server, either Security Management or Multi-Domain, can take a long time in large environments. |
| 01965750 | If you create or delete Domain servers of the same Domain from many Multi-Domain Servers, the Domain can become corrupted, with recovery from Check Point Support required. |
| 01963189 | Changing the Security Management server's time, for example using an NTP server, while there are SmartConsole clients connected, may cause the client to disconnect from the server. |
| 01829764, 01381300 | For Gateways below R80, 2nd layer behaves like Application Control policy. |
| 01713602, 01626242, 01896195, 01626310 | A SmartView Monitor email alert sometimes has a closing "*_NextPart_...* " boundary, which causes the email to be blocked by some mail servers as spam. Refer to [sk105578](http://supportcontent.checkpoint.com/solutions?id=sk105578). |
| 01896673, 01282706 | At irregular intervals, the session information fails to update. To see the most updated session, switch to another view and then switch back. |
| 01968118 | Automating a Check Point Management server using the Management API blade is supported only on Gaia OS Management servers. |
| 01964575 | Login to primary Domain SmartConsole fails with "*Database is locked by another application* " error. To resolve, run the *cprestart* command on the Security Management Server. |
| 01825584 | Sync failure between primary and secondary servers in a High Availability deployment. To prevent this, make sure the interfaces are enabled before starting the processes (*cpstart, mdsstart*). |
| 01988291 | Install database task hangs if SmartConsole is closed before the task completes. Reconnect and install the database again. |
| 01459162 | R80 does not support Security Gateway / VSX gateway conversion, or conversion in the opposite direction. |
| 01952495 | *lvm_manager* fails to resize partitions with "*ERROR :Cannot kill process (id XXXXX)*". Workaround: Boot the machine into Maintenance Mode and then run *lvm_manager*. |
| 01984056 | "*Internal error occurred during the verification process* " during policy installation after reverting to a previous policy revision that has a disabled rule with an object that has been deleted since then. Refer to [sk110614](http://supportcontent.checkpoint.com/solutions?id=sk110614). |
| 01990873 | In a High Availability deployment, purging revisions causes the High Availability incremental sync to all Standby Security Management servers to fail with "*NGM Failed to import data*" error message. To resolve the issue, after purging revisions, perform a full sync. * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 01989615 | "Authentication to server failed"error shows when logging in to the SmartEvent server using the local administrator account (created in *cpconfig* ). Create a new administrator account with a name not used on the remote SmartEvent server or the Multi-Domain server managing the SmartEvent server. |
| 01785216, 01996056 | OSE devices are not supported in R80. The Pre-Upgrade verifier warns about this and policy installation from R80 Security Management on an OSE Device fails. |
| 01545489 | The CLI command *fwm dbexport* is not supported. After running the command to export the user database, the process finishes successfully but the file contains only headers, no data. |
| 01986179 | Global assignment removal fails with "*Object could not be deleted because it is referenced by other objects* " error. If the search fails to locate the object in the domain, check each application object in the Domain for a reference to the permission profile specified in the error message. Refer to [sk110630](http://supportcontent.checkpoint.com/solutions?id=sk110630). |
| 02349143, 02349405, 02350931 | Although it is possible to create a Time group object with a long name, policy installation fails with "*Time objects name cannot be more than 11 characters* " error. Refer to [sk113498](http://supportcontent.checkpoint.com/solutions?id=sk113498). |
| 02458624 | Migration of Security Management server or CMA R80.x to R80.x Multi-Domain Security Management is not supported. |
| 02459792, 02462601, 02468700 | Publishing Gateway objects rewrites manual changes in database. Refer to [sk116194](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116194). |
| 02036535, 02483434 | "Get Interfaces" in the Cluster object does not update the Topology after changing a physical interface to VLAN interface with the same IP address, or vice versa. Refer to [sk116582](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116582). |
| 02512117, 02512194 | Wrong license status for 'virtual systems' blade for VSX objects in R80 SmartConsole. Refer to [sk117675](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117675). |
| 02530338, 02530675 | SMS daemon does not start on startup. Refer to [sk118083](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk118083). |
| Multi-Domain Security Management ||
| - | Unsupported Multi-Domain Security Management Domain features: * Global VPN Communities * Dynamic Global Objects * Install policy from Multi-Domain Server - the ability to directly install the policy on all Domain gateways as part of assigning the Global Policy on the Domains is not supported. Install the policy from the specified Domains. * For Multi-Domain Log Servers, Remote Log Servers that are not defined as Domain Log Servers are not supported. |
| 01916186 | After you upgrade a Multi-Domain Server with a IP address change, you must remove the license with the old IP address. If you do not do this, failures will occur in the License view and on some Management Blades. |
| 01810161 | A Security Management server cannot be installed as a secondary Management for a Domain server. |
| 01605414 | There is no cross-Domain search for network objects. Search in each Domain for the specific network object. |
| 01995628, 01993689 | After a Global policy has been assigned to a Domain, the revert option in the Domain "Network Layer -\> History" window no longer functions. |
| 01654519, 01606491 | You cannot assign only the Global objects used in a specific Access Control policy or Threat Prevention policy. All the global objects are assigned to the Domain. |
| 01961532 | Multi-Domain Management server unexpectedly terminates after assigning a Global policy to a Domain imported using the *cma_migrate* command. To avoid the issue, run *mdsstop;mdsstart* after running the *cma_migrate* command. |
| 01989136 | An administrator defined on the Multi-Domain Server, can log in to the Global SmartEvent server in read-only mode only. To resolve this, connect to the SmartEvent server with the local administrator account (created in *mdsconfig*), configure the relevant Domains and install the Event policy. |
| 01964862 | Some domains might be missing from the drop-down list of the Multi Domain Security Management connection launcher. To resolve this, run: *mdsstop;mdsstart* |
| 01582933 | Private sessions are not synchronized between Multi-Domain Servers. A session that is open on one Multi-Domain Server cannot be seen or moved to a different Multi-Domain Server |
| 01537986 | An administrator with Manage Session permissions on a Multi-Domain Server but not on a specific domain, can manage the session from sessions view in the MDS level. Session publish may fail. |
| 01718384 | You cannot add licenses from the Multi-Domain Server or Domain Management configuration windows or wizards. To add licenses, click "Manage Licenses and Packages" in the SmartConsole main menu. |
| 01694997 | Administrator groups and Domain groups are not supported in R80 and cannot be viewed or used in the SmartConsole. |
| 01891116 | In Multi-Domain Security Management, OPSEC application permission profiles are not visible on the Domain's object bar. Use the OPSEC application editor to change the permissions. |
| 01967817, 01982135 | The Multi-Domain Management Server must have 4 or more cores. |
| 01954364 | When upgrading a Multi-Domain Security Management environment, you can change the IP address of the primary MDM, but not the IP address of secondary MDMs. |
| 01976542, 01980886 | Each database can be migrated only once with *cma_migrate* . If you try to migrate the same database to another Domain Server, migration fails with the "*Internal runtime error"... "The folder in the dleObject can't be null.*" error. |
| 01980812 | After you define the SmartEvent object in the global database, first you must assign Global Policy to Domain Servers in order the Domain Level Only administrators can log in to SmartEvent. |
| 01933775 | Multi-Domain Super User has no permission to install policy when connected the Domain Server. Workaround: Restart SmartConsole, connect to the Domain server, and try again. |
| 01987333, 02002922 | "*Unexpected error* " message is shown when an administrator with insufficient permissions on a Domain assigns or reassigns a Global Policy to the Domain. Make sure the administrator account has the required permissions. |
| 02359963, 02361015, 02361167 | Multi-Domain Management server (MDS) creates a snapshot during the OS level backup procedure, causing the backup to fail or be extremely small. Refer to [sk113740](http://supportcontent.checkpoint.com/solutions?id=sk113740). |
| 02486936 | FWM daemon becomes unstable when using RADIUS Authentication. |
| 02490895 | Getting "*Cannot create a new Domain server. Reason: License violation detected: Multi-Domain Server HostName. The license of Multi-Domain Server HostName allows to manage 0 Domain Management/Log Servers. X is already defined* " error when trying to create a new Domain. Refer to [sk116499](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116499). |
| 02528737, 02529416, 02533097 | Several *cpsm-domains-X* licenses are counted only once. Refer to [sk118316](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk118316). |
| Licensing ||
| 01909120 | These products do not support the new licensing visibility features: Network Security: Advanced Networking and Clustering, Capsule Cloud and Capsule Workspace. Security Management: Endpoint Policy Management, SmartPortal, User Directory (LDAP) Multi-Domain Security Management: Security Domain Remote Access \& Endpoint |
| 01925987 | "*Licensing status not available for current OS*" message shows in the Logs \& Monitoring view. SmartConsole does not support licensing information for Windows, SecurePlatform and Virtual Systems. Use the licenses tab in SmartUpdate to see the licensing information for the OS. |
| 01963269 | If the SmartEvent Software Blade is activated, but only the SmartEvent Intro license is installed, the License Status shows "N/A". |
| 01961299 | The Device and License Status of Threat Emulation is incorrect. Use the Logging -\> License Status view. |
| 01934260 | When loaded for the first time, web components such as the licensing or monitoring view can take up to thirty seconds to show. |
| 01972866 | In the License Status View, the Additional Info column is not available for pre-R80 gateways and servers. |
| 01972951 | The proxy that synchronizes license information with the User Center, must be an R80 server. |
| 01951434 | On a Pre-R80 SmartEvent NGSE dedicated machine, license information is not automatically updated when Installing Database. When you enable or disable a blade, one of the following will update the license information with the change: * If you force a license update, changes occur immediately. To force a license update: On the R80 Management Server, run the following command in Expert mode: *\[Expert@HostName:0\]# $CPDIR/bin/esc_db_complete_linux_50 bc_refresh \* * Automatic update at midnight * If you manually change a license or contract on a dedicated machine, changes take effect within 20 minutes |
| 01972866 | In the License Status View, quota information and quota statuses are not available for pre-R80 gateways and servers. |
| 01972797 | Automatic license activation on Check Point appliances is not available on pre-R80 appliances. |
| 01972899 | On pre-R80 gateways, license information is updated every 20 minutes. To force a license update, perform *one* of the following actions: * Either install security policy on the pre-R80 gateway * Or on the R80 Management Server, run the following command in Expert mode: * On Security Management Server: *\[Expert@HostName:0\]# $CPDIR/bin/esc_db_complete_linux_50 bc_refresh \* * On Multi-Domain Security Management Server: *\[Expert@HostName:0\]# mdsenv \* *\[Expert@HostName:0\]# $CPDIR/bin/esc_db_complete_linux_50 bc_refresh \* |
| 01913451 | License Data for all supported software blades shows on all machines, even if the blade is not relevant to the role of the machine. For example, license data for the Network Policy Management blade shows on a Log server. |
| 01976925 | Automatic license activation on a Multi-Domain Management Server machine works only on the MDS level and not on the Domain level. Add licenses manually for each Domain. |
| 01972917 | After installation, the Device License Status shows*N/A* and the Device License View is not accessible until Install Policy or Install Database is performed. When blades are enabled or disabled, the changes are not visible in the Device LIcense Views and Status until Install Policy or Install Database is performed. |
| Compliance ||
| 01958788 | The SmartConsole client is not aware of license or quota changes in real time. Reopen SmartConsole in Compliance blade to see the license changes. Quota data changes in the entitlement or Compliance will be updated after: * Compliance midnight scan * License changes * *cpstop;cpstart* |
| SmartConsole ||
| - | SmartConsole installed on a computer without access to the Internet cannot open Help files. Refer to [sk110774](http://supportcontent.checkpoint.com/solutions?id=sk110774). |
| 01854287 | "Import Applications / Sites" option (the same feature that was under "Application \& URL Filtering" tab - \> "Applications/Sites" - \> Actions - \> Import) is missing in R80 SmartConsole. * For workaround, refer to [sk111054](http://supportcontent.checkpoint.com/solutions?id=sk111054). |
| 01878112 | Cannot log into SmartConsole after changing the time in the Gaia Portal. To resolve the problem, restart the Management server using *cpstop;cpstart* commands or, for Multi-Domain Security Management, run *mdsstop;mdsstart* |
| 01944489, 02007657 | These rules are not shown in SmartConsole: 1. Implied rules. 2. A VPN rule created using the "Accept all encrypted traffic" option in the VPN community object. |
| 01996428 | Slow rendering and reaction to user interactions. SmartConsole is a Windows-based application that uses the Windows Presentation Foundation (WPF) for rendering graphics and the user-interface. WPF applications are optimized to work with hardware acceleration. Under certain circumstances, the framework falls back on software-rendering only, causing SmartConsole to render slowly and react slowly to user interactions. This occurs when SmartConsole runs: 1. Via Remote Desktop session (RDP). 2. When installed on Windows-Server 2012. 3. In environments with old graphics hardware drivers. 4. In virtual environments that lack the required integration with graphics hardware. |
| 01748274 | "` is used by another object and cannot be deleted`" error in R80 SmartConsole when attempting to delete a newly created VSX object (Virtual System, Virtual Router, VSX Gateway / VSX Cluster). Refer to [sk113932](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113932). |
| 01800770 | Disconnecting the SmartConsole session while creating or configuring VSX objects, can cause the management database corruption and Administrator will be unable to do any changes with VS. "*Internal Error: Cannot get object XXX from table vs_slot_object*" message pops-up. |
| 01864532 | After a failure in the VSX cluster creation wizard, if Cancel is clicked, the wizard closes, but the VSX cluster and VSX cluster member objects are not deleted. Workaround: Delete the VSX cluster and VSX cluster member objects manually. |
| 01652566, 01693617 | When publishing remote session, through the Sessions View, there is no option for updating the session name and the description. Before you can publish a session, you must connect to it and set the session name and description. |
| 01931336, 01816368 | A customized role that has no write permissions, does not appear as read-only in the session view, although it is actually read-only. |
| 01960696 | The Tasks tab -\> Script Results supports up to 10,000 characters only. |
| 01953640 | "*The communication with the server was lost* " error shows after pushing the configuration to VSX objects - Virtual Systems, Virtual Routers, and Virtual Switches. To resolve the issue: 1. Open the directory where SmartConsole is installed. 2. Open "*SmartConsole.exe.config*" file in some advanced editor. 3. Locate: "*\* 4. Change all three instances of *00:01:00* to *00:05:00* . 5. Save and close. 6. Reconnect with SmartConsole. |
| 02053188, 02053623, 02053974 | Cannot scroll down to find the relevant gateway in "Satellite gateway" list in IPSEC VPN Star community window. Refer to [sk111736](http://supportcontent.checkpoint.com/solutions?id=sk111736). * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 02066282 | Sorting is not correct in the Security Gateways \& Servers view in SmartConsole. Refer to [sk111846](http://supportcontent.checkpoint.com/solutions?id=sk111846). * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 02085892, 02088162, 02088167 | After creating "interoperable" device and adding it to a star community, cannot add a shared secret password to this device because it is not listed in the "Shared Secret" tab. Refer to [sk112182](http://supportcontent.checkpoint.com/solutions?id=sk112182). |
| 02346641, 02351839 | In SmartConsole, "Get topology" button is not displayed. Refer to [sk113455](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113455). |
| 02279544, 02459709 | Different numbers of recommended updates are displayed in R80 SmartConsole and in R80 Gaia Portal. Refer to [sk115456](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115456). |
| 02034329, 02290957 | R80 SmartConsole crashes when FIPS is enabled on Windows OS. Refer to [sk111585](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111585) |
| PMTR-10186, PMTR-567 | SmartConsole is not disconnected after time specified in SmartConsole -\> Manage \& Settings -\> Permissions \& Administrators -\> Administrators -\> Idle Timeout. |
| SmartEndpoint ||
| 02058477, 02058497 | SmartEndpoint GUI error on UserCheck message property. Refer to [sk112157](http://supportcontent.checkpoint.com/solutions?id=sk112157). |
| 02062057, 02064416 | "Challenge Format" column text, shown in a table within the "Installation" dialog of SmartEndpoint is wrong. Refer to [sk112158](http://supportcontent.checkpoint.com/solutions?id=sk112158). |
| IPS ||
| 01612788 | When configuring a Threat Prevention rule to save packet captures, the packets are saved only for Anti-Virus and Anti-Bot. Packet capture is not activated on IPS. Use the IPS Protections window to configure packet capture for individual IPS protections. |
| 01964022 | "*Internal error occurred*" message if you assign/reassign a Global Configuration at the same time that an IPS update is running on a local Domain. Workaround: First run the IPS update on the local Domain, then assign/reassign the Global Configuration. |
| - | Some IPS protocols from early releases are discontinued. If these are mistakenly included in the Firewall Rule Base, policy installation will fail. For the list of Deprecated protocols and services that are no longer used by the IPS blade, refer to [sk103766](http://supportcontent.checkpoint.com/solutions?id=sk103766) |
| - | Snort protections are not supported in R80. |
| Threat Prevention ||
| 01852063 | A Forensics Tracking option is shown in Threat Prevention rules. This feature will be supported with R80.x gateways. |
| 01991099 | Install policy will fail if the name of the profile contains a forward slash (/). Remove the invalid character. |
| Application Control / URL Filtering ||
| - | Application Control offline updates are supported from command line only. |
| 01835979, 01830427 | When the "Categorize HTTPS Sites" option is enabled, accessing HTTP URLs can cause an "Internal System Error" logs in SmartLog and failure to open the web page. |
| 01820710, 01919422 | After upgrading to R80, services defined in the Application Control rulebase are overridden with the Application's recommended services. Refer to [sk109711](http://supportcontent.checkpoint.com/solutions?id=sk109711). |
| 01809131, 01824869 | Security Gateway might sometimes crash when the user tries to send a failure log of an Application Control event. |
| 02011440, 02014104 | Application Control updates fail for SMB appliances 1100 / 1200R / 1400 that are Centrally Managed by R80 Security Management Server. Refer to [sk111073](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111073). |
| SmartEvent ||
| 01940335 | In R80, you can only define SmartEvent at the global level and then configure it to read logs from one domain or a number of domains. SmartEvent cannot be defined in a specified domain. |
| 01969895 | When connecting R80 SmartEvent to an R77.30 Security Management Server, only local administrators (that are configured from *cpconfig* ) are supported. * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 02101182, 02107751 | SmartEvent R80 crashes with core dump while attempting to connect to R77.30 Multi-Domain Management. Refer to [sk112238](http://supportcontent.checkpoint.com/solutions?id=sk112238). |
| 02310643, 02310889, 02333477 | "`No Permissions Events or Reports permissions are required to view this page`" error when authenticating with Check Point certificate to R80 Legacy SmartEvent GUI. Refer to [sk113034](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113034). |
| 02332081, 02333401 | Authentication into R80 Legacy SmartEvent GUI from R80 SmartConsole fails when using Check Point certificates. Refer to [sk113036](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113036). |
| 01995448 | On a R80 dedicated SmartEvent server which assigned to MDS, when you enable or disable a blade, the license information is not immediately updated. An automatic updates takes place at midnight. To update immediately: 1. On server's command line, run: *$CPDIR/bin/esc_db_complete_linux_50 activation_data entitlement_data.* 2. If you manually change a license or contract, the changes take effect immediately. |
| 02331551 | Not possible to generate separate report for each Domain Management Server in R80 SmartEvent. Refer to [sk113494](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113494). |
| 02369957, 02372519 | * Not possible to set a value greater than 250 in the "Number of values (up to)" field of a SmartEvent report * Not possible to set a value greater than 2000 in the "Maximum number of logs" field of a SmartEvent report Refer to [sk114193](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114193). |
| 02409205 | Wrong object name is displayed in R80 SmartEvent Domain-based report when different Domain Management Servers contain objects with identical IP address. Refer to [sk115861](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115861). |
| SmartUpdate ||
| 01885225 | Gateway packages do not show for Domain gateways, when you open SmartUpdate from the SmartConsole Multi-Domain view. You must connect to SmartConsole for each Domain to see the packages for its gateways. |
| 01885337 | You cannot detach a Domain license from the SmartConsole Multi-Domain view. Instead, connect to each Domain with SmartConsole and detach the license there. |
| SmartView Monitor ||
| 00545271 | Block Intruder (SAM) is not supported. |
| SmartLog ||
| - | If you upgrade a management server or log server running SmartLog, SmartLog indexing files will be lost. To keep the logs, do one of these: * After the upgrade, copy the log files from the old server to the new server and re-index (refer to the [R80 Logging and Monitoring Administration Guide](http://supportcontent.checkpoint.com/documentation_download?ID=46535)) * Use the new Open a Log File feature in the SmartConsole Logs and Monitor view |
| - | Users connected with SmartConsole to specific Domain, will not be able to see Global objects assigned to this Domain in SmartLog logs results, and cannot search by Global objects (but can search by IP address). |
| - | SmartLog Indexing mode is not enabled by default after upgrade or new installation, on Smart-1 205, Smart-1 210, or Open Servers with less than 4 cores. |
| - | A mix of SmartLog Indexing Mode and Non-Indexing mode on Domain Management Servers or Domain Log Servers is not supported. |
| - | To change SmartLog mode from Indexing to Non-Indexing on a Domain Management Server or Domain Log Server, edit the Domain Server object on the Domain level. There is no option to change the entire Multi-Domain Server or Multi-Domain Log Server to Non-Indexing mode. |
| - | The Open Log File Form in the SmartConsole of a Multi-Domain Server will not show log files of Domain Management Servers or Domain Log Servers. You must open SmartConsole to the domain, to open log files. |
| - | If you change a High Availability server to Non-Index mode, you must force a failover to the standby server and then run *evstop;evstart* from the Expert mode. If you change a dedicated Log server to Non-index mode, you must run *evstop;evstart* from the Expert mode. |
| - | You cannot see log files of different servers in Non-Index mode. You must open SmartConsole directly to the Security Management or Log server with the required log file. |
| - | If you connect a SmartEvent R80 server to an R77.x or lower management server, you must enable SmartLog to avoid CPSEMD crashes. |
| - | In SmartLog Non-Index mode: free text search is applied only on specific fields like source, destination, service, etc.. , there is no Top results pane, and the Threat Prevention Rulebases and Profiles logs tab do not show log results. |
| Logging ||
| 02022295 | Log export is supported on visible logs only. |
| 02022292 | Save As to a log file is not supported |
| 02022294 | Fetch local files from a remote machine is available from command line only. |
| 01873374 | A "SmartView in not available" message shows after opening a new tab in the Logs \& Monitor view. You may have changed the Gaia port number using the clish command "*set web ssl-port* ". 1. After setting the Gaia port, open the Security Management object -\> General Properties and click "Get". 2. Save and publish to update the object with the new port number. |
| 01914623 | SmartView graphics do not display properly in Internet Explorer. Accessing SmartEvent server from the web (SmartView) is supported only from Google Chrome and Mozilla Firefox. |
| 01847602 | Log Server can work in non-index mode to save disk storage, but if you deactivate the "Enable Log Indexing" option in the Log Server object, the following limitations will apply: * All Log Servers in the environment must be in non-index mode. * There is no unified view for all Log Servers. You must query each Log Server separately. * In each Log Server you must open the specific log file to run a search. (Refer to the [R80 Logging and Monitoring Administration Guide](https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm).) * You cannot enable SmartEvent or Correlation Unit. |
| 01945644 | Disabling log indexing on a distributed Log server does not stop the indexing processes. To stop the indexing processes, run: *cpstop;cpstart*. |
| 01986752, 01988662 | Connections from SmartConsole to a Multi-Domain log server are not supported. To view logs stored on the Multi-Domain log server, connect to each Domain log server separately. **Note** : if the "*lockout administrator account after x failed authentication attempts* " option is selected, failed attempts to login to the Multi-Domain log server will also lock the administrator out of the Domain Log server. To resolve, run the "*unlock-administrator*" command on the API command line. * Resolved in [Check Point R80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108623), Take 113. |
| 01964600 | Correlation units can be added to a remote Log server in this way only: 1. In SmartConsole, edit the Correlation unit object and configure it as a Log server. 2. On the SmartEvent server, go to the Correlation unit policy configuration and configure the Correlation unit on the SmartEvent server to read the logs from the remote Log server configured in step 1. |
| - | In a Multi-Domain Management environment, you cannot have a dedicated Log server for a specific Domain/CMA. * Workaround: configure a Multi-Domain Log servers with only one CLM. |
| Mobile Access ||
| 01244809, 01386596, 01353737, 01244809, 01294173 | SSL Network Extender in Application Mode does not support applications that connect to IPV4-mapped IPV6 addresses. Refer to [sk97444](http://supportcontent.checkpoint.com/solutions?id=sk97444). |
| 01659093 | If the "Policy Source" of a Mobile Access gateway is configured to "Unified Access Policy", rules that contain Network Object with IPv6 addresses are not matched by the Mobile Access blade. |
| 01184657, 01356327 | Disabling the Floating Navigation Bar (FNB) via GuiDBedit Tool does not disable the FNB in the Web Application. Refer to [sk109254](http://supportcontent.checkpoint.com/solutions?id=sk109254). |
| 01595256, 01586057 | The Mobile Access Portal does not support Web-Form SSO for Citrix StoreFront Web interface. |
| 01942470, 01930132, 01941216, 01938019, 01952790, 01929775, 01881116, 01945563, 01883785, 01931914 | Removed ECDHE from the CURL cipher proposal list. |
| VPN ||
| 01311326, 01455241, 01357377 | When using a VPN client, activity logs are not generated for ICMP traffic. |
| 01874986 | Convert Traditional VPN to Simplified is not supported. |
| Desktop security ||
| 01940363 | "Desktop Security policy is empty. At least one rule should be configured. Desktop policies will not be installed on Policy Servers." error shows during policy install when removing a Desktop policy (that was imported with a policy package) and adding it back. Refer to [sk110656](http://supportcontent.checkpoint.com/solutions?id=sk110656). |
| QoS ||
| - | Convert QoS from Express to Traditional is not supported. |
| Small and Medium Business Appliances (SMB) ||
| 01921211 | R80 Security Management cannot manage Security Gateway 80 appliance with a firmware version that is equal or lower than R75.20 |
| 01939263 | If there is a "*Commit function failed* " error on policy installation failure on 1100 series appliance, refer to [sk105217](http://supportcontent.checkpoint.com/solutions?id=sk105217). With R80 Management, make sure that "Optimized profile" is selected and that only the server protections are deactivated. |
| 01914944, 01917280 | SIC error status might occur when the gateway object is defined in a "Management first" scenario before it is deployed, but the device's IP address is already accessible. The Security Management tries to create SIC with the gateway's IP address. Instead of the policy ending in a "waiting for first connection" status, an error message states the SIC status must be rectified first. |
| vSEC Controller ||
| 02160116 | Upgrade from vSEC Controller R77.30 with Data Center objects to Security Management Server / Multi-Domain Security Management Server R80 is *not* supported. Refer to [sk109796](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109796). |
| VSX ||
| 02166135, 02166160 | "`vsx_util vsls`" command fails with "Failed to redistribute the virtual systems. Can't save database." error on R80 Management Server. Refer to [sk115029](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115029). |
| 60000 / 40000 appliances ||
| 02506836 | R80 is not able to manage 60000 / 40000 appliances running R76SP.40 and above, when Threat Emulation blade is enabled. |
{#limitationTable}
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content