> Source: [sk126952](https://support.checkpoint.com/results/sk/sk126952) # sk126952 - R80.10 CloudGuard Gateway for NSX Known Limitations | Property | Value | |----------|-------| | Solution ID | sk126952 | | Date Created | 2018-05-15 | | Last Modified | 2018-12-25 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81.20, R82 | | OS | Gaia | | Platform | VMWare ESX | ## Solution This article lists all Known Limitations for **R80.10 CloudGuard Gateway for NSX managed by R80.10 Management Server**. [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk118538) to see the list of Known Limitations. ![](https://sc1.checkpoint.com/uc/images/Information_icon1.gif)This is a live document that may be updated without special notice. We recommend registering for our weekly updates in order to stay up to date. To register go to [UserCenter](https://usercenter.checkpoint.com/) \> **ASSETS** / **INFO** \> **My Subscriptions**. **Important notes:** * All [R80.10 Security Gateway / Software Blades](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104860) limitations apply also to R80.10 CloudGuard Gateway for NSX managed by R80.10 Management Server **(hereafter referred to as "R80.10 CloudGuard for NSX.")** * All [R80.10 Security Management Server / Multi-Domain Security Management Server / Software Blades](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110519) limitations apply also to R80.10 CloudGuard for NSX. * To get a fix for an issue listed below [contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) with the issue ID. * To see if an issue has been fixed in other releases, search for the issue ID in Support Center. * For more information on R80.10 CloudGuard for NSX, refer to: * [sk114518 - vSEC Gateway for NSX/CloudGuard for NSX managed by vSEC Controller/CloudGuard Controller (Home Page](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114518)) * You can also visit our [Check Point discussion forum](https://forums.checkpoint.com/forums/index.jspa) to ask questions and get answers from technical peers and Support experts. **Table of Contents** * General Limitations * R80.10 CloudGuard for NSX Limitations * General Limitations * Unsupported Blades and Features * Network Limitations * ESX Configuration Limitations for Service VM * Cluster Limitations * HTTPS Limitations * R80.10 CloudGuard Controller Limitations {#General Limitations}{#vSEC Gateway Limitations}{#vSEC Gateway Limitations - General Limitations}{#vSEC Gateway Limitations - Unsupported Blades and Features}{#vSEC Gateway Limitations - Network Limitations}{#vSEC Gateway Limitations - ESX Configuration Limitations for Service VM}{#vSEC Gateway Limitations - Cluster Limitations}{#vSEC Gateway Limitations - HTTPS Limitations}{#vSEC Controller Limitations} |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---| | ID | Symptoms | | General Limitations || | - | [API Server](https://sc1.checkpoint.com/documents/R80.10/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R80.10/SmartConsole_OLH/EN/ouuDsTDy1XIa4DVZczYApg2&anchor=o124586) must be enabled (it is by default) on R80.10 Management Server, so that the NSX Service Registration Hotfix will function properly. Note: To check the current state, run the "`api status`" command. | | - | VMware recommends that you use *VMware NSX 6.1.2 or higher*. This release resolves some earlier VMware NSX issues. | | - | CloudGuard objects (Data Center Servers and Data Center Objects) are *not* supported in: * NAT policy (CloudGuard objects are based on Identity Awareness Access Roles, which are *not* supported in NAT rules) | | - | To enable registration of R80.10 CloudGuard for NSX from a domain, the domain's name should be less than 215 characters. | | 01618218 | R80.10 CloudGuard for NSX can be managed *only* by Security Management Server / Multi-Domain Security Management Server running on Gaia OS. | | 01362253; 01377502 | IP Anti-Spoofing is *not* supported in this release. This includes: * The IP Anti-Spoofing feature configured in SmartDashboard. * The IP Anti-Spoofing feature that was supported in previous CloudGuard Gateway for NSX versions. | | 01616523 | There are no logs for the creation of an object in R80.10 CloudGuard for NSX when it is created on Multi-Domain Security Management Server. | | 01361358 | Before you rename or delete a Domain Management Server, you must delete all services used by R80.10 CloudGuard for NSX on the Domain Management Server. | | R80.10 CloudGuard for NSX Limitations ||| | General Limitations ||| | 00940862 | * Upgrading from earlier Security Gateway VE versions to R80.10 CloudGuard for NSX is *not* supported. * Installing Maintrain releases on top of R80.10 CloudGuard for NSX is *not* supported. | | 00566886 | CPU consumption for the CloudGuard Gateway might show inaccurate results. To resolve this issue, reserve CPU resources on the ESX: 1. In the vSphere client, right-click on the CloudGuard Gateway machine. 2. Select '`Edit Settings`'. 3. On the '`Resources`' tab, move the '`Reservation`' slider to allocate a guaranteed CPU share (in MHz). | | 01433123 | If R80.10 CloudGuard for NSX is not working / is down, Virtual Machines on the ESX server cannot be powered on. | | 01462030 | Due to performance issues, interfaces affinity can *not* be set to CPU0. | | 01566831, 01362585 | The Compatibility Check in the First Time Configuration Wizard fails. Select "*Ignore errors and continue* " and press "*Next* " to do the tests manually. Make sure that: * Your cloud quota is valid * Your Proxy Server and DNS server are configured * You have access to both to the Check Point Private Cloud and to the Check Point Download Center | | 02401768 | It is *not* supported to change the hostname of the R80.10 CloudGuard for NSX when using Auto Provisioning. If needed, change the name of the CloudGuard for NSX object in the SmartDashboard ***before*** changing the hostname of the R80.10 CloudGuard Gateway for NSX. | | Unsupported Blades and Features ||| | 00525807 | These features are *not* supported: * E-mail Security * HTTP/FTP/SMTP with Resource * User/Client/Session Authentication * Anti-Virus in the proactive mode * Anti-Virus for FTP * Anti-Virus by file direction | | 01419351 | UserCheck is *not* supported and has to be disabled: 1. In SmartDashboard, double-click on the R80.10 CloudGuard for NSX object. 2. In the '`UserCheck`' pane, clear the box '`Enable UserCheck for active blades`' and click on OK. 3. Install policy on the R80.10 CloudGuard for NSX object. | | 00631143 | Mobile Access blade and SSL Network Extender are *not* supported. | | 00784665 | Identity Awareness blade does *not* support: * Captive Portal * Identity Gateway (CloudGuard*Identity Sharing hotfix* from [sk114594](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114594) is required) | | 00785612 | Application Control blade does *not* support: * UserCheck action * Default object "`Internet`" cannot be used in the rulebase. | | 00786175 | URL Filtering blade does *not* support: * UserCheck action | | 00785488 | Data Loss Prevention (DLP) blade is *not* supported. | | 00527310 | IPS protection '`Initial Sequence Number (ISN) Spoofing`' is *not* supported. | | 01374211 | Threat Emulation blade does *not* support: * Local Emulation. | | 02158078 | Threat Extraction blade *not* support Local Emulation. | | 00526867 | R80.10 CloudGuard for NSX in Bridge mode is *not* supported. | | 00525721 | R80.10 CloudGuard for NSX in Hypervisor Mode cannot operate as a Layer 3 network device (router). Layer 3 features, such as NAT and VPN, are *not* supported. | | 00525819 | ClusterXL is *not* supported (both High Availability mode and Load Sharing mode). | | 00525822 | QoS is *not* supported. | | 00568687 | VoIP is *not* supported. | | 00527267 | SecureXL Heavy Load Quality of Service feature (HLQoS) is *not* supported. | | 01423615 | 'Account' log is *not* supported when SecureXL is enabled. The log might show an incorrect count of the bytes and/or packets. | | 01423166 | SecureXL monitoring via `/proc/ppk/` is *not* supported. | | 01423166 | The following SecureXL SIM commands are *not* supported: ` ` * sim affinity * sim affinityload * sim drv * sim hlqos * sim installin * sim installout * sim uninstallin | | 02362689 | Anti-Spam is *not* supported. Activating it may impact the SMTP traffic. | | Network Limitations ||| | 01567832 | You must *not* remove or add NICs to a R80.10 CloudGuard Gateway for NSX. | | 01513267 | You can *not* change, add, remove or change NICs. All NICs are *predefined* in this release. | | 00557690 | Dynamic Routing is *not* supported. | | 01611020 | Jumbo Frames are *not* supported. | | 00525805 | User cannot configure a VLAN using the VM Guest operating system in an ESX environment. Configure the VLAN using a vSwitch. | | 01040659 | Overlapping IP addresses are *not* supported - R80.10 CloudGuard Gateway for NSX cannot distinguish between different Virtual Machines that use the same IP addresses. | | ESX Configuration Limitations for Service VM ||| | - | VMware Tools are *not* supported. | | - | vSphere vMotion is *not* supported. Refer to [sk112245](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112245). | | - | vSphere Distributed Resource Scheduler (DRS) is *not* supported. | | - | vSphere Distributed Power Management (DPM) is *not* supported. | | - | vSphere Network I/O Control (NIOC) is *not* supported. | | - | vSphere Replication is *not* supported. | | 00863806 | vSphere VMDirectPath I/O is *not* supported. | | 00863806 | Intel Virtualization Technology for Directed I/O (VT-D I/O) is *not* supported. | | 00863806 | Single Root I/O Virtualization (SR-IOV I/O) is *not* supported. | | 00525821 | User cannot use VMware Fault Tolerance on any Virtual Machines, including the Virtual Machine of R80.10 CloudGuard Gateway for NSX. | | 00640862 | VMsafe products (vNetwork Appliance products) are *not* supported with R80.10 CloudGuard Gateway for NSX in Hypervisor Mode. | | 02329844 | It is *not* supported to create or remove a snapshot of the Service Virtual Machine running CloudGuard Gateway for NSX in Hypervisor Mode while it is powered on (to prevent latency on all the traffic passing through this gateway). | | Cluster Limitations ||| | HTTPS Limitations ||| | - | SSL / TLS connections are dropped following vMotion, and must be reopened in order to maintain security. | | CloudGuard Controller Limitations ||| | Refer to [R80.10 Known Limitations](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110519#vSEC Controller) || --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content