> Source: [sk111964](https://support.checkpoint.com/results/sk/sk111964) # sk111964 - R80 vSEC Controller v1 Known Limitations | Property | Value | |----------|-------| | Solution ID | sk111964 | | Date Created | 2016-06-14 | | Last Modified | 2018-10-21 | | Technical Level | General | | Products | Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | | OS | Gaia | ## Solution This article lists all of the **R80 vSEC Controller v1** specific known limitations. [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111964) to see the list of Known Limitations. ![](https://sc1.checkpoint.com/uc/images/Information_icon1.gif)This is a live document that may be updated without special notice. We recommend registering to our weekly updates in order to stay up to date. To register go to [UserCenter](https://usercenter.checkpoint.com/) \> ASSETS / INFO \> My Subscriptions. **Important notes:** * All [R80 Security Management Server / Multi-Domain Security Management Server / Software Blades](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=108624) limitations apply also to **R80 vSEC Controller v1** . * To get a fix for an issue listed below [contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) with the issue ID. * To see if an issue has been fixed in other releases, search for the issue ID in Support Center. * For more information on R80 vSEC Controller, refer to: * [R80 vSEC Controller v1 Release Notes](http://downloads.checkpoint.com/dc/download.htm?ID=50378) * [R80 vSEC Controller v1 Home Page](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111963) You can also visit our [vSEC forum](https://forums.checkpoint.com/forums/forum.jspa?forumID=69) or any other [Check Point discussion forum](https://forums.checkpoint.com/forums/index.jspa) to ask questions and get answers from technical peers and Support experts. **Table of Contents** * General * vSEC Controller * vSEC Controller Hotfix * vSEC Controller Enforcer Hotfix * Threat Prevention * VMware NSX * VMware vCenter * Cisco APIC {#General}{#vSEC Controller}{#vSEC Controller Hotfix}{#vSEC Controller Enforcer}{#Threat Prevention}{#VMware NSX}{#VMware vCenter}{#Cisco APIC} |----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Symptoms | | General || | - | vSEC objects (Data Center Servers and Data Center Objects) are not supported in: * NAT policy (vSEC objects are based on Identity Awareness Access Roles, which are not supported in NAT rules) | | 01970321 | vSEC objects (Data Center Servers and Data Center Objects) are not supported in: * Network Group objects * Global Domain | | 01683557 | Changes in the IP address of a Data Center object will be enforced after approximately 30 seconds. | | vSEC Controller || | 02201301 | Data Center objects may not be enforced on vSEC Gateway, if Data Center objects are used in both Access policy and Threat Prevention policy, and only one of these policies is installed. Refer to [sk112616](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112616). | | 02413946 | "`Failed to update Data Center server objects on gateway `" log in SmartLog on R80 vSEC Controller. Refer to [sk114956](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114956). | | vSEC Controller Hotfix || | - | Before uninstalling the vSEC Controller Hotfix from R80 Security Management Server / Multi-Domain Security Management Server with installed vSEC Service Registration Hotfix, you must first uninstall the vSEC Service Registration Hotfix. | | - | Before uninstalling the vSEC Controller Hotfix from R80 Security Management Server / Multi-Domain Security Management Server, you must manually remove all the vSEC objects (Data Center Servers and Data Center Objects) in SmartConsole. Otherwise, these vSEC objects might remain in the management database; however, they will not be enforced. | | - | Reinstalling of vSEC Controller Hotfix is *not* supported from [CPUSE](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449). Follow these steps to reinstall this hotfix: 1. Uninstall the vSEC Controller Hotfix 2. Reboot the vSEC Controller 3. Install the vSEC Controller Hotfix again 4. Reboot the vSEC Controller | | - | Changes in an existing connection properties of Data Center might lead to a different view of the Data Center objects available to the vSEC Controller. Imported Data Center Objects may be deleted, if they do not exist in the new view after connection property changes. *Example*: Change a user to one that has less Data Center Server privileges. | | 01372023 | vSEC Controller Hotfix is supported only on *Gaia OS*. | | 01372023 | vSEC Service Registration Hotfix is supported only on *Gaia OS*. | | vSEC Controller Enforcer Hotfix || | - | No verification is performed that the required vSEC Controller Enforcer Hotfix is installed on Security Gateway and that the Identity Awareness API is enabled on Security Gateway. As a result, installation of a policy that contains Data Center objects would fail, if the Identity Awareness Software Blade is disabled in the Security Gateway object. | | 01968060 | If either Identity Awareness API is not installed on the Security Gateway, or installed, but disabled, then vSEC objects (Data Center Servers and Data Center Objects) are not enforced by the Security Gateway, and are considered as objects without IP address. | | 01965783 | If there are access roles in the policy, which are associated with the same IP address of 'Data Center objects', then the priority of the vSEC Gateway for NSX with installed vSEC Controller Enforcer will be as follows: 1. VPN 2. Identity Agents, Terminal Servers agent 3. RADIUS Accounting, Identity Awareness API, Identity Awareness Captive Portal 4. ADQuery, ADQuery Agent *Example*: If: Access role 'AR1' is associated with IP 'X.X.X.X' Access role 'AR1' was updated from 'Identity Agent' Data center object 'DCO1' is associated with the same IP 'X.X.X.X' Then: Traffic from IP 'X.X.X.X' will be associated only with Access role 'AR1'. | | 02010025 | Data Center objects *and* standard network objects are not supported in the *same* rule *cell*. | | Threat Prevention || | - | vSEC Threat Prevention Tagging is *not* supported. | | VMware NSX || | - | IP Set objects with ranges or CIDR block notations are not supported. IP Set Objects representing one, or more, individual IP address/es are supported. | | VMware vCenter || | 02070398 | When selecting a higher hierarchy VMware object in the policy (using the object picker), such as *VMware vCenter Folder* , *VMware Security Group* , *VMware Resource Pool* , *VMware Cluster*, etc., it could contain the IP addresses of internal interfaces on the Service Gateway, which might result in services drops, inspection problems, difficulties connecting to console over SSH, etc. | | Cisco APIC || | - | The following objects are not supported: * Cisco APIC object - L3 External EPG | | - | vSEC for Cisco ACI controller IP addresses mapping and updates are based on ACI fabric IP learning capabilities, which requires enabling of unicast routing on the Bridge Domain containing the EPG. | | - | Currently, the Cisco ACI fabric does not age out individual endpoint IP addresses mappings as long as one of the IP addresses responds to keep-alive ARP Requests from the fabric. Due to this, these stale IP addresses will also be learned by the vSEC Controller. | | - | Supported fabric size: The total amount of all the following objects must not exceed 100,000: * Tenants * Application Profiles * EPGs * IP addresses | | - | APIC HTTP URLs, which redirect to HTTPS, are not supported. Use either HTTPS URLs directly, or HTTP without redirection. | | - | Mixing both HTTP and HTTPS APIC URLs in the connection properties is not supported. | | - | When multiple APIC URLs are specified, the connectivity test will succeed, as long as one of the URLs will connect. There is no requirement for initial verification for all the URLs. | | - | On failure to connect to all the given APIC URLs, the returned error message is for the first unsuccessful URL. | | - | Changes to privileges of the APIC user that was used to create the Data Center object, are not reflected during an active login session. For example, if a new security domain is added to the user, which allows him to see a new tenant, this will not be visible to the APIC scanner. **Workaround** : Run the *vsec_controller_stop* command on the vSEC Controller to restart the vSEC Controller services and force a new login. | | - | If an imported APIC object is deleted in the APIC, and then re-created with the same name, then this object will remain marked as "O*bject was deleted on Server* " in the GUI, and you will not see updates for this object (IP changes, description changes, etc.). On the other hand, the dynamic enforcement would start working again at the moment the object is re-created. **Workaround** : Re-import the object. | | - | Only the following TLS cipher suites are supported for APIC HTTPS connectivity: * TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA * TLS_DHE_DSS_WITH_AES_128_CBC_SHA * TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 * TLS_DHE_DSS_WITH_AES_256_CBC_SHA * TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA * TLS_DHE_RSA_WITH_AES_128_CBC_SHA * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 * TLS_DHE_RSA_WITH_AES_256_CBC_SHA * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 * TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA * TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA * TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 * TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA * TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 * TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA * TLS_ECDH_RSA_WITH_AES_128_CBC_SHA * TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 * TLS_ECDH_RSA_WITH_AES_256_CBC_SHA * TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 * TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 * TLS_EMPTY_RENEGOTIATION_INFO_SCSV * TLS_RSA_WITH_3DES_EDE_CBC_SHA * TLS_RSA_WITH_AES_128_CBC_SHA * TLS_RSA_WITH_AES_128_CBC_SHA256 * TLS_RSA_WITH_AES_256_CBC_SHA * TLS_RSA_WITH_AES_256_CBC_SHA256 | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content