> Source: [sk148074](https://support.checkpoint.com/results/sk/sk148074) # sk148074 - Known Limitations for Scalable Platforms R80.20SP - R81.20 (Maestro Appliances and Chassis) | Property | Value | |----------|-------| | Solution ID | sk148074 | | Date Created | 2019-02-26 | | Last Modified | 2026-03-10 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | | Platform | 15000, 5000, 7000, 28000, 41000 (EOL), 44000, 64000, 16000, 26000, 6000 | ## Solution This article lists all Known Limitations for these versions: * **[R80.20SP](https://support.checkpoint.com/results/sk/sk140392)** * **[R80.30SP](https://support.checkpoint.com/results/sk/sk162552)** * **[R81](https://support.checkpoint.com/results/sk/sk169954)** * **[R81.10](https://support.checkpoint.com/results/sk/sk170416)** * **[R81.20](https://support.checkpoint.com/results/sk/sk173903)** **For version [R82](https://support.checkpoint.com/results/sk/sk181127), refer to [sk181128 - R82 Known Limitations](https://support.checkpoint.com/results/sk/sk181128) (section: "Quantum Maestro and Scalable Chassis").** ![](https://sc1.checkpoint.com/uc/images/Information_icon1.gif)This is a live document that may be updated without special notice. **Important Notes:** * If not stated otherwise, all limitations apply to both Security Gateway and VSX Gateway. * All limitations listed as part of R81 and higher ([sk166717](https://support.checkpoint.com/results/sk/sk166717)) are relevant unless stated as resolved. * All limitations listed in R80.20 ([sk122486](https://support.checkpoint.com/results/sk/sk122486)) and R80.30 3.10 ([sk152652](https://support.checkpoint.com/results/sk/sk152652)) are relevant unless stated as resolved. * To see if a limitation has been resolved, enter its ID in the filtering field located at the top of the table. |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Non-Supported Features** -------------------------- * General * General * Gaia OS * Hardware * Licensing * Cluster * Installation / Upgrade * Upgrade * Infrastructure * VSX * Networking * Networking * IPv6 * Software Blades * Firewall * VPN * Identity Awareness * Data Loss Prevention (DLP) * Monitoring / SmartView Monitor * QoS * SmartProvisioning










| | **Known Limitations** --------------------- * General * General * Gaia OS * Hardware * Management and Policy * Dual Site Deployment * VoIP * Installation / Upgrade / Licensing * Installation * Licensing * Infrastructure * Security Gateway * VSX * SecureXL * CoreXL * Cluster * Hyper-Threading * Networking * Networking * Dynamic Routing * IPv6 * Software Blades * Firewall * VPN * Threat Prevention (Anti-Virus, Anti-Bot, Threat Emulation, Threat Extraction) * IPS * DLP * Identity Awareness * Logs * Application Control * Mobile Access * Monitoring * SNMP |


Enter the string to filter the below table: {#NSF_General}{#NSF_GaiaOS}{#NSF_Hardware}{#NSF_Licensing}{#NSF_Cluster}{#NSF_Upgrade}{#NSF_VSX}{#NSF_Networking}{#NSF_IPv6}{#NSF_Firewall}{#NSF_VPN}{#NSF_IA}{#NSF_DLP}{#NSF_SVM}{#NSF_QoS}{#NSF_SmartProvisioning}{#KL_General}{#KL_GaiaOS}{#KL_Hardware}{#KL_Mgmt_Policy}{#KL_DSD}{#KL_VoIP}{#KL_Installation}{#KL_Licensing}{#KL_SG}{#KL_VSX}{#KL_SecureXL}{#KL_CoreXL}{#KL_ICluster}{#KL_Hyperthreading}{#KL_Networking}{#KL_Dynamic_Routing}{#KL_IPv6}{#KL_SBFW}{#KL_SBVPN}{#KL_TP}{#KL_IPS}{#KL_DLP}{#KL_SBIA}{#KL_SBLogs}{#KL_SBAC}{#KL_SBMA}{#KL_SNMP} |-----------------------------------------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Product | Description | Found in | Resolved In | | ### Non-Supported Features - General {#NSF_General_Features} ||||| | General ||||| | PMTR-67440 | All | Traffic stops passing through a bridge interface after a failover in Dual Site / Dual Chassis environments. | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | * [R81.10 JHF Take 82](https://support.checkpoint.com/results/sk/sk173363) * [R81 JHF Take 79](https://support.checkpoint.com/results/sk/sk170114) | | MBS-8327, PRHF-18375 | All | Scalable Platforms do not support the Management Data Separation feature ([sk138672](https://support.checkpoint.com/results/sk/sk138672)). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-14453 | All | R80.30SP and R81 for Scalable Platforms do not support the "Same VMAC" feature (support is available in R80.20SP, R81.10, and higher; see [sk165674)](https://support.checkpoint.com/results/sk/sk165674). | [R80.30SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | MBS-3246 | All | Scalable Platforms do not support: * DHCP Client configuration * DHCP Server configuration * Dynamically Assigned IP (DAIP) configuration * **Note**: DAIP is supported starting in R81 JHF Take 34 (see MBS-15743 below). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-15743 | All | Scalable Platforms do not support the Dynamically Assigned IP (DAIP) configuration. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-15740 | All | Scalable Platforms do not support DHCP for Office Mode. | [R80.20SP](https://support.checkpoint.com/results/sk/sk155832) | [R81 GA](https://support.checkpoint.com/results/sk/sk169954) | | MBS-2379 | All | The SMO Image Cloning feature only supports Security Group Members that run the same major version. When you add a new Security Group Member to the R80.20SP Security Group (with the "`add smo security-group`" command), it must have the same version as SMO. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-1586 | All | Scalable Platforms do not support the '`asg_syslog`' command. Use the Gaia Clish '`set syslog ...`' command instead. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-1360 | All | To install a license with the '`cplic put`' command, before you run the Gaia First Time Configuration Wizard, you must run the '`cplic put`' command in the Expert mode. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8326 | All | Scalable Platforms do not support installation of software packages with the Central Deployment Tool ([sk111158](https://support.checkpoint.com/results/sk/sk111158)). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4866, MBS-11960, 01517974 | All | Scalable Platforms do not support ISP Redundancy. | [R76SP.10](https://support.checkpoint.com/results/sk/sk102788) | [R80.20SP JHF Take 305](https://support.checkpoint.com/results/sk/sk155832) | | PMTR-68991 | All | Scalable Platforms do not support ISP Redundancy if Dynamic Routing is configured (because the ISP Redundancy feature must create a static default route that overrides the default route created by dynamic routing) | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | SPC-1682 | All | Scalable Platforms do not support using Hide NAT: * with external distribution in an inbound interface * with internal distribution in an outbound interface. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | PMTR-83632, PMTR-86822 | All | The Management API call "`get-interfaces`" (available in API v1.7.1 and higher) does not support a Security Gateway object that represents a Security Group on Maestro or Scalable Chassis. The API command returns internal interfaces that must not be part of the Security Gateway object. As a result, policy installation fails, or traffic does not pass between the SMO and other Security Group Members. To get interfaces: Open the Security Gateway object in SmartConsole \> go to "Network Management" \> click "Get Interfaces" \> click "Get Interfaces With Topology" or Get Interfaces Without Topology" \> click "Accept" \> click "OK" \> install Access Control Policy. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00595914 | All | Scalable Platforms do not support Security Servers (FTP/HTTP with Resource). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00824847 | All | Scalable Platforms do not support OPSEC SDK. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01800842 | All | Scalable Platforms do not support Hide NAT for traffic initiated from the Management interface of a Security Group. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | SPC-929 | All | Scalable Platforms do not support Dynamic NAT. **Note** : Dynamic NAT was deprecated in R80.40. GNAT replaced Dynamic NAT in R81.20 (see [sk165153](https://support.checkpoint.com/results/sk/sk165153)). Refer to GNAT limitation MBS-10099. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | 00772706 | Chassis | R76SP versions on Scalable Chassis 40000 / 60000 do not have a WebUI to configure and monitor the system. HTTP access to the system is blocked. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | | PMTR-84368 | Maestro | It is not supported to configure Auto Scaling Settings if a Maestro Security Group contains different appliance models. | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | - | | PMTR-71298 | Maestro | You must disable the SMO Image Cloning in the Security Group before you assign an appliance of a model that is different from models of other appliances already assigned in this Security Group. Run this command in Gaia gClish: `set smo image auto-clone off` | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | PRJ-32479 | Maestro | Maestro Security Group does not support Bridge Mode configuration. | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | [R81.10 JHF Take 14](https://support.checkpoint.com/results/sk/sk175186) | | 02003875 | Maestro | LACP for Management bond (MAGG) is not supported on Maestro. | R80.20SP JHF Take 326 | R81.10 MHO | | PMTR-97008 | Maestro | If Management bond (MAGG) mode is configured to LACP on a Security Group (for example, magg1 with slave interfaces of eth1-Mgmt1 and eth2-Mgmt1), then it is not supported to use the MAGG's slaves on an additional Security Group. | - | - | | PMTR-93476 | All | MAGG bond mode is available only through the gClish of the Security Group. | - | - | | MBS-5038 | Maestro | You can only connect two Maestro Security Orchestrators of the same model for redundancy on the same site. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [](https://support.checkpoint.com/results/sk/sk173363)- | | MBS-5033 | Maestro | You can assign only appliances of the same model to the same Security Group. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) See [sk162373](https://support.checkpoint.com/results/sk/sk162373) | | MBS-5035 | Maestro | Maestro Hyperscale Orchestrator does not support: * Scalable Chassis 40000 / 60000 * Small Business and Branch Offices appliances 3000, 2000, and lower models. * Quantum Spark appliances. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5581 | Maestro | In R80.30 SmartConsole, when configuring a Maestro Security Gateway object, you must select the "R80.20SP" version. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6600 | Maestro | The R80.20SP default image does not support the SMO Image Cloning feature. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk140392) * [R80.30SP and higher](https://support.checkpoint.com/results/sk/sk162552) | | MBS-9078 | Maestro | Output of the "`asg_if`" command on Maestro Security Group Members does not show the correct interface speed configured on the Maestro Orchestrator. This is only a cosmetic issue. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R80.20SP JHF Take 310](https://support.checkpoint.com/results/sk/sk155832) * [R80.30SP JHF Take 75](https://support.checkpoint.com/results/sk/sk165312) | | Gaia OS ||||| | MBS-10123 | All | Scalable Platforms do not support the flag "`-vv`" in the "`asg perf`" command. | [R81](https://support.checkpoint.com/results/sk/sk169954) | * [R81.10](https://support.checkpoint.com/results/sk/sk173363) * [R81 JHF Take 42](https://support.checkpoint.com/results/sk/sk170114) | | MBS-13308 | All | Scalable Platforms do not support the "`set iphelper`" (IP Broadcast Helper) commands in Gaia gClish. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-2836 | All | Scalable Platforms do not support the '`asg profile`' command. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-17426 | All | Scalable Platforms do not support the "`asg_session_control`" command. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-3625 | All | Scalable Platforms do not support the '`save configuration`' command in Gaia gClish. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-3579 | All | Scalable Platforms do not support the Pingable Hosts State event type in the "`asg alert`". | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-2372 | All | It is not supported to manually update or install the CPUSE Agent from [sk92449](https://support.checkpoint.com/results/sk/sk92449) on Quantum Maestro Orchestrators, Maestro Security Groups, and Scalable Chassis. Scalable Platforms require a dedicated Deployment Agent package that is available in the relevant Home Page SK articles. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R82](https://support.checkpoint.com/results/sk/sk181127) (see [sk92449](https://support.checkpoint.com/results/sk/sk92449)) | | MBS-13635 | All | Scalable Platforms do not support the pound (#) character in the Gaia Message of the Day (MOTD) and Banner messages. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5488 | All | Scalable Platforms do not support the Gaia Clish / Gaia gClish command '`snapshot_recover`'. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk140392) | | MBS-13339 | All | Scalable Platforms do not support the "`asg_dst_route`" command. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | PMTR-90120 | All | Gaia API does not support Security Groups on Scalable Platforms. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | PMTR-81746 | All | Scalable Platforms do not support Gaia Portal on a Security Group when Management Data Plane Separation (MDPS) is enabled (see [sk138672](https://support.checkpoint.com/results/sk/sk138672)). | | - | | MBS-5309 | Maestro | The Gaia Portal on Maestro Hyperscale Orchestrator supports these web browsers: * Google Chrome 71.0 and later * Microsoft Edge 40.15063 and later * Microsoft Internet Explorer 11.0.50 and later * Firefox 64.0 and later | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | PMTR-90800 | Maestro | It is not supported to use the "`set web ssl-port`" command to change the SSL port for Orchestrator's Gaia Portal from the default port 443 (for example: "`set web ssl-port 4434`"). Changing it causes communication issues between Security Group Members. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Hardware ||||| | MBS-1244 | All | The Check Point Performance Sizing Utility '`cpsizeme`' (see [sk88160](https://support.checkpoint.com/results/sk/sk88160)) is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4754 | All | Scalable Platforms do not support Central Management of Gaia Device Settings: 1. In SmartConsole, in the left navigation panel, click on "Gateways \& Servers". 2. Right-click the Security Gateway object of your Security Group. 3. The "Scripts" menu and "Actions" menu are not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-3010 | Chassis | Scalable Chassis 40000 / 60000 do not support the 4 x SSMs (Dual-Dual Star) deployment. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 242](https://support.checkpoint.com/results/sk/sk155832) (supported only in R80.20SP) | | MBS-3992 | Chassis | Scalable Chassis 40000 / 60000 do not support SSM60. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 02447213 | Chassis | Scalable Chassis 44000 / 64000 do not support DC Power Entry Modules (PEM). | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02457673 | Chassis | On SSM440, interfaces eth\-Mgmt1 and eth\-Mgmt2 will not be used and should not be configured. The management interfaces are eth\-Mgmt4 and eth\-Mgmt3. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02439135 | Chassis | On SSM440, the auto-negotiation for Forward Error Correction (FEC) on 100Gb ports is not supported. FEC is enabled by default. The user can disable it manually in accordance with the settings on the peer side. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02160144 | Chassis | Scalable Chassis 40000 / 60000 N+N (new model) and N+1 (old model) are not supported together in a cluster (Dual Chassis setup). | [R76SP.40](https://support.checkpoint.com/results/sk/sk110515) | - | | 01007477 | Chassis | On Scalable Chassis 40000 / 60000, all SGMs in an environment must have the same number of CPU cores. Hybrid Systems (61000 Chassis with SGMs that have a different number of CPU cores) are not supported. | R75.40VS | - | | MBS-17809 | Maestro | Maestro Orchestrators do not support the Hardware Diagnostic tool that you run from the Gaia OS Boot Menu. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5227 | Maestro | It is not supported to install both of the following expansion cards in the same Security Appliance connected to a Maestro Hyperscale Orchestrator: * 10 GbE and 40 GbE * 10 GbE and 100 GbE | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6466, PMTR-93611 | Maestro | On Maestro Security Group Appliances installed with **R80.20SP** : * All Security Group Appliances in the same Maestro Security Group must have the same cards installed (the type and number). * All Security Group Appliances must have one of these NICs: 1 x Quad-Port NIC, 1 x Dual-Port NIC, or 2 x Dual-Port NICs. You must remove all other Expansion Cards from all Security Appliances, even if these Expansion Cards are not used. On Maestro Security Group Appliances installed with **R80.30SP and higher** : * On a Maestro Security Group with appliances of the same model: all Security Group Appliances must have the same cards installed (the type and number) and connected to a Maestro Hyperscale Orchestrator using ports on the same cards. * On a Maestro Security Group with different appliance models (supported starting R81.10): all Security Group Appliances must have cards with the same speed and number of ports installed in similar slots and connected to a Maestro Hyperscale Orchestrator using ports on cards in the same slots. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Licensing ||||| | MBS-7929 | Maestro | Maestro Security Groups do not support Central License. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Cluster ||||| | MBS-12225 | All | Scalable Platforms do not support the Multi-Version Cluster (MVC). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-12227 | All | Scalable Platforms do not support the Active-Active cluster mode. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | ### Non-Supported Features - Installation / Upgrade {#NSF_Installation} ||||| | Upgrade ||||| | PMTR-88029, PMTR-88191 | All | (1) When the Management Server that manages a Maestro Security Group, connects to the Maestro Orchestrator through an LACP (802.3ad) bond interface, during the Security Group upgrade from R81 to R81.10 / R81.20, the output of the "`sp_upgrade`" script shows that the procedure "*Fetching the policy from the Management Server and installing it*" fails on the upgraded R81.10 / R81.20 Security Group Members. Workaround: See [sk178045](https://support.checkpoint.com/results/sk/sk178045). (2) The Zero Downtime (Multi-Version Cluster) method does not support these operations if a Security Group has Bond interfaces in the 802.3ad (LACP) mode on Uplink ports: * Upgrade of a Security Group from R81 / R81.10 to R81.20 * Downgrade of a Security Group from R81.20 to R81 / R81.10 | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-14315 | All | Scalable Platforms do not support the upgrade from R80.20SP or R80.30SP to [](https://support.checkpoint.com/results/sk/sk169954)R81. Only a Clean Install of the R81 version is supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392), [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | ### Non-Supported Features - Infrastructure {#NSF_Infrastructure} ||||| | VSX ||||| | MBS-3522, PMTR-63597 | All | Scalable Platforms in VSX mode do not support the ICMP / CCP probing on cluster interfaces (setting the value of the kernel parameter `fwha_enable_if_probing` to 1). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | 01413513 | All | Scalable Platforms in VSX mode do not support Virtual Routers. | [R76SP.10](https://support.checkpoint.com/results/sk/sk102788) | - | | 01096568 | All | Scalable Platforms in VSX mode do not support the management through data ports. The supported Management interfaces are: * eth1-Mgmt1, eth1-Mgmt2, eth1-Mgmt3, eth1-Mgmt4 * eth2-Mgmt1, eth2-Mgmt2, eth2-Mgmt3, eth2-Mgmt4 | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | ### Non-Supported Features - Networking {#NSF_Networking_Features} ||||| | Networking ||||| | MBS-14222 | All | Scalable Platforms do not support Dynamic Routing protocols over GRE tunnels. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-14223 | All | Scalable Platforms do not support BGP over VXLAN tunnels. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12823 | All | Scalable Platforms do not support the "6in4 tunnel" interface. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-14200 | All | Scalable Platforms do not support RIPng (IPv6). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01176232 | All | Virtual System in the Bridge Mode with configured VLAN interfaces does not support traffic that is not based on the IP protocol. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-4024 | Chassis | Scalable Chassis 40000 / 60000 do not support the Bidirectional Forwarding Detection (BFD). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | IPv4/IPv6 support from [R80.20SP Take 258](https://support.checkpoint.com/results/sk/sk155832) | | 01262356 | Chassis | Scalable Chassis 40000 / 60000 do not support PIM Sparse Mode when the Security Group is configured as a Rendezvous Point (RP). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R81.10 JHF Take 61](https://support.checkpoint.com/results/sk/sk169954) | | MBS-5482 | Maestro | Maestro Security Groups do not support an IPv6 address on eth\-Mgmt\ interfaces. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5293 | Maestro | Maestro Hyperscale Orchestrator's dedicated Sync interface cannot be part of a bond interface. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF 210](https://support.checkpoint.com/results/sk/sk155832) | | MBS-7022 | Maestro | The maximum supported number of VLAN interfaces on each Uplink port on a Maestro Orchestrator is 42. Refer to [sk170294](https://support.checkpoint.com/results/sk/sk170294). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 304](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5104 | Maestro | You can only connect one DAC / Fiber cable between a Quad-Port Card on a Security Appliance and each Maestro Hyperscale Orchestrator. Connecting two cables between a Quad-Port Card on a Security Appliance and each Maestro Hyperscale Orchestrator is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | - | Maestro | On Maestro Security Groups, Bidirectional Forwarding Detection (BFD) is supported only for dynamic routing protocols, such as BGP and OSPF. BFD is not supported for monitoring static routes. This limitation also applies to all Load Sharing Cluster configurations. | | _ | | IPv6 ||||| | MBS-18136 | All | Security Group may drop IPv6 traffic as "Out of State" if the Server-to-Client traffic arrives at a different Security Group Member than the Client-to-Server traffic (asymmetric connection). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 02621541 | All | Scalable Platforms do not support IPv6 VPN. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-11398 | Chassis | Scalable Chassis 40000 / 60000 do not support the correction for IPv6 local connections initiated from the Standby chassis. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | ### Non-Supported Features - Software Blades {#NSF_Software_Blades_Features} ||||| | Firewall ||||| | 02641733 | All | Scalable Platforms do not support the '`fw sam`' command ([sk112061](https://support.checkpoint.com/results/sk/sk112061)). Workaround: Use the '`fwaccel dos`' command. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | SPC-986 | All | Scalable Platforms do not support Carrier Security (LTE) in VSX mode. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-14173 | All | Scalable Platforms do not support ConnectControl. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 01340588 | All | Scalable Platforms do not support the Endpoint Security "Corporate Enforcement" feature. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | VPN ||||| | 01685300 | All | Scalable Platforms do not support SSL VPN for deployments that use NAT on Office Mode network. | [R76SP.20](https://support.checkpoint.com/results/sk/sk105938) | - | | 01445638 | All | Scalable Platforms do not support the Traditional mode VPN. | [R76SP.10](https://support.checkpoint.com/results/sk/sk102788) | - | | 00737055 | All | Scalable Platforms do not support Virtual Tunnel Interfaces (VTI). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | 00750851 | All | Scalable Platforms do not support the Route-based probing configuration for VPN Link Selection in High Availability mode. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | Identity Awareness ||||| | MBS-14460 | Maestro | Maestro Security Groups do not support the Identity Awareness Captive Portal if the L4 distribution is enabled. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Data Loss Prevention (DLP) ||||| | 01157859, 01349731 | All | Scalable Platforms do not support DLP Fingerprint. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | Monitoring / SmartView Monitor ||||| | 00593173 | All | Scalable Platforms do not support the "Monitoring" (SmartView Monitor) Software Blade on Security Groups (Maestro and Chassis). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | QoS ||||| | 01248880, MBS-14243, MBS-9362 | All | Scalable Platforms do not support the QoS Software Blade. R81 Jumbo Hotfix Take 51 (and higher) and R81.10 add support for the QoS Software Blade with these limitations: * QoS policy is applied to each Security Group Member. * QoS is not supported on a Security Group in the VSX mode. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | * [R81.10](https://support.checkpoint.com/results/sk/sk173363) * [R81 JHF Take 51](https://support.checkpoint.com/results/sk/sk170114) | | MBS-2641 | Chassis | Scalable Chassis 40000 / 60000 do not support the DiffServ honoring on SSM. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | SmartProvisioning ||||| | 01511158 | All | Scalable Platforms do not support SmartProvisioning management. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | [R82](https://support.checkpoint.com/results/sk/sk181127) | | ### Known Limitations - General {#KL_General_Features} ||||| | General ||||| | PMTR-86785 | Maestro | Starting in the R81.10 version, the major software version on the Orchestrator must be equal to or higher than the major software version on the managed Security Group: |----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------| | | **Orchestrator Version** ||| | **Supported Security Group Version** | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | [R80.20SP](https://support.checkpoint.com/results/sk/sk138233) | | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/red_X.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/red_X.png) | | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/red_X.png) | | [R81](https://support.checkpoint.com/results/sk/sk169954) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | | [R80.20SP](https://support.checkpoint.com/results/sk/sk138233) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | ![](https://sc1.checkpoint.com/sc/images/sk_images/green_V.png) | **Note** - To see which Management Server can manage your Security Group, see [sk113113](https://support.checkpoint.com/results/sk/sk113113). | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | MBS-12259 | All | Scalable Platforms do not support Carrier Security (LTE). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81 JHF Take 42](https://support.checkpoint.com/results/sk/sk170114) | | MBS-12327 | All | Scalable Platforms do not support "Generic Data Center" objects (described in [sk167210](https://support.checkpoint.com/results/sk/sk167210)). **Note** : Starting from [R81.10 Jumbo Hotfix Take 158](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/Take_158.htm), you can use Generic Data Centers and Dynamic Objects with a Maestro cluster, not just for a separate Security Gateway. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-11195 | All | Scalable Platforms do not support Accelerated Policy Install. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-10252 | All | Scalable Platforms do not support Zero Touch management. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12257 | All | Scalable Platforms do not support the detection of IP address conflict in Gaia OS. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12307 | All | Scalable Platforms do not support Management-as-a-Service (MaaS). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) (see [sk181495](https://support.checkpoint.com/results/sk/sk181495)) | | MBS-3363 | All | Scalable Platforms do not support the '`asg_selective_template_exclude`' command. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-12749 | All | If you enabled and configured the ISP Redundancy on a Security Group, then to force an ISP Link State, you must run the `g_fw isp_link` command in the Expert mode. If you run the `fw isp_link` command on a specific Security Group Member, the command only changes the state of the ISP link on that Security Group Member. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-13348 | All | Scalable Platforms support ISP Redundancy only on data interfaces. Management interfaces and other internal control interfaces (for example, CIN) are not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6188 | All | * Active-Backup bond is supported only when a Primary subordinate interface is configured (for example: `set bonding group 1 primary eth1-05`). * Active-Backup bond supports a maximum of 2 subordinate interfaces. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9128 | All | Scalable Platforms do not support the Unique IP address per Chassis (UIPC) feature for IPv6 addresses. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | SPC-1104 | All | Scalable Platforms do not support connections that arrive through the data interface and are sent out through the management interface. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | For R81.10 and higher, see [sk179005](https://support.checkpoint.com/results/sk/sk179005). | | SPC-1111 | All | Scalable Platforms do not support connections that arrive through the management interface and sent out through the data interfaces. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | For R81.10 and higher, see [sk179005](https://support.checkpoint.com/results/sk/sk179005) | | 02476852 | All | Before importing a Gaia snapshot on a Security Group Member, you must check if there is enough free disk space. If necessary, you must delete old snapshots and other unneeded files to free up disk space. Security Group Members that do not have enough disk space will not create the Gaia snapshot in their database, and there will be no error message to indicate this. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | MBS-3114 | Chassis | You can restore snapshots only on the same Chassis type and SGM model on which it was collected. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6190, MBS-9202 | Chassis | Scalable Chassis 40000 / 60000 do not support the Multiple Security Groups feature. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 240](https://support.checkpoint.com/results/sk/sk155832) (supported only in R80.20SP) | | 00738754 | Chassis | If SGMs lose connectivity to the CMM, the '`asg stat`' command displays the most recent status of the system. For example, a chassis module that was "UP" before the CMM lost connectivity, continues to have the status "UP". The state of the CMM is changed to "DOWN". | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | PMTR-106002 | Maestro | In a Maestro environment, where Security Appliances are connected to two Maestro Orchestrators, rebooting one of these Orchestrators (or running the '`orchd restart`' command on one of these Orchestrators) causes a 10-second disruption in the sync traffic between Security Group Members. If a Security Group is configured in the VSX mode, this may affect the data traffic. | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | MBS-14365 | Maestro | Maestro Security Groups do not support Dynamic Anti-Spoofing. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | PMTR-71380 | Maestro | On an Orchestrator that runs the R81.10 version, you can assign appliances of different supported models (see [sk162373](https://support.checkpoint.com/results/sk/sk162373)) to the same Security Group only if these appliances run the R81.10 version. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) / [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) / [R81](https://support.checkpoint.com/results/sk/sk169954) / [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | MBS-6968 | Maestro | When you configure an R80.30SP Security Gateway object in R80.x SmartConsole, in the "Version" field you must select "R80.30". | [R80.30.SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30 JHF Take 163](https://support.checkpoint.com/results/sk/sk153152) | | MBS-9698 | Maestro | The '`installer uninstall`' command in Gaia gClish on Security Group members might not show an installed Hotfix / Jumbo Hotfix Accumulator package. To resolve: run these commands in Gaia gClish: 1. `show installer packages` 2. `installer uninstall ` | [R80.30.SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-6140 | Maestro | Each Security Group must have a unique hostname. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-14805 | Maestro | CPView is not supported on R80.20SP for Maestro Orchestrator. CPView is only supported on Maestro Orchestrators that run R81.10. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10](https://support.checkpoint.com/results/sk/sk169954) | | MBS-14811 | Maestro | Maestro Orchestrators and Security Group CIN interfaces are configured in the subnet of 198.51.10\.0. You cannot use this subnet for data and management interfaces. This applies to Maestro Gateways and Orchestrators on**all** Maestro versions. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7289 | Maestro | "`Added FTW configuration on MHOs:`" is displayed in the Orchestrator Gaia Portal in the Security Group Summary window, even when the First Time Wizard settings are not configured. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5754 | Maestro | It is not possible to access the new Security Group after its Management IP address was configured in the subnet 192.168.1.0/24. To resolve: Refer to [sk164372](https://support.checkpoint.com/results/sk/sk164372). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | | MBS-9830 | Maestro | Installing a Hotfix / Jumbo Hotfix Accumulator on all Security Group members at the same time (and not gradually) overrides the configuration of traffic distribution to default: general and L4 Distribution is enabled. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHFA](https://support.checkpoint.com/results/sk/sk155832) [Take 266](https://support.checkpoint.com/results/sk/sk155832) | | Gaia OS (Global Shell / Commands) ||||| | PRJ-28252, PRJ-28273, PMTR-70624 | All | Scalable Platforms support only the local Gaia snapshot. Scalable Platforms do not support: * Export of Gaia snapshots to a remote server when collecting a snapshot * Import of Gaia snapshots from a remote server when restoring a snapshot | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | PMTR-70630, PMTR-70624 | All | Scalable Platforms do not support the export and import of Gaia snapshots in Gaia Portal. You must use the applicable Gaia gClish commands. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-10755 | All | Scalable Platforms do not support Gaia Scheduled Snapshots. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | PRJ-20639, PMTR-63145 | All | R81 requires a hotfix to support Gaia Backup (Gaia Snapshots do not require a hotfix). Contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | MBS-10753 | All | Scalable Platforms do not support the configuration of the Link Layer Discovery Protocol (LLDP) in Gaia Portal or Gaia Clish. | [R81](https://support.checkpoint.com/results/sk/sk169954) | Supported in R81.10 and R81.20 **for Chassis Only** | | MBS-10832 | All | Scalable Platforms do not support Gaia REST API for Security Group configurations. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12114 | All | Scalable Platforms do not support restoring of a Gaia Backup from an FTP server. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-4080 | All | Scalable Platforms do not support Bond interface in the Round Robin mode. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-964 | All | Scalable Platforms do not support NTP Server configuration on Security Groups. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-14992 | All | To prevent the Gaia configuration mismatch between Security Group Members, it is not supported to change the user's password on a Security Group in these ways: * In Gaia Portal \> User Management \> Change My Password * In Gaia gClish with the command "`set selfpasswd`" To change the user's password on a Security Group, run one of these commands in Gaia gClish: * `set user password` * `set user password-hash ` | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 00738300 | All | The '`asg`' commands are an extension of native Gaia gClish commands. The '`asg`' commands have different syntax and there is no auto-completion. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00642401 | All | A CLI command that uses a range for the parameter can only operate if all the relevant Security Group Members are defined in the Security Group. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00621838 | All | Running the '`show hostname`' command in Gaia Clish returns the hostname shared by all the Security Group Members and the suffix "`%m`". See [sk182292](https://support.checkpoint.com/results/sk/sk182292). | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00633262 | All | The arguments of the global commands are processed before the local (native) arguments, and this can cause the local arguments to be ignored. For example, the '`g_ls -l /tmp/`' command is processed as '`ls /tmp/`' on the local Security Group Member instead of as '`ls -l /tmp/`' on all Security Group Members. Relocating the local arguments within the command (where applicable) can resolve the problem. For example, run the '`g_ls /tmp/ -l`' command instead of the '`g_ls -l /tmp/`' command. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01061553 | All | When exporting or importing a snapshot, you must export from or import to the */var/log/* directory. * To export a snapshot, run: `set snapshot export path /var/log/` * To import a snapshot, run: `set snapshot import path /var/log/ name ` | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01089206 | All | Running the '`asg_hard_shutdown`' command on a Security Group Member two times, one after the other, causes a reboot and not a shutdown. It takes one minute for the Security Group Member to shut down after running the '`asg_hard_shutdown`' command. During this interval, do not run the '`asg_hard_shutdown`' command again. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01237799 | All | When you run multiple Gaia gClish '`set ...`' commands, one after another, some of these commands can stop running. When this happens, the message "`Processing Transaction`" shows in the output. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-6514 | Chassis | Scalable Chassis 40000 / 60000 do not support the configuration of the Minimum Number of Slaves in a Bond interface. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | PMTR-85023 | Maestro | When you create a new Security Group on a Maestro Orchestrator, it is not possible to configure the Gaia GRUB Password in the Security Group wizard on the Maestro Orchestrator. You can configure the Gaia GRUB Password only after you complete the Gaia First Time Configuration Wizard on the Security Group. See the[R81.20 Gaia Administration Guide](https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topics-GAG/Gaia-Overview.htm) \> Chapter "System Management" \> Section "System Passwords". | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | - | | PMTR-98172 | Maestro | It is not supported to disable the Gaia Portal daemon (*httpd2* ) on the Orchestrator: 1. Do not run the Gaia Clish command "`set web daemon-enable off`". 2. Do not disable the *httpd2*service in any other way. Communication between the Orchestrator and the Security Group Members relies on the *httpd2* service. To disable the Gaia Portal without disabling the Gaia API server, follow the instructions in [sk166692](https://support.checkpoint.com/results/sk/sk166692). | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | PMTR-71458 | Maestro | Collecting Gaia Backup and restoring Gaia Backup in Global Clish (gclish) is not supported on a Security Group that contains appliances of different models. To collect Gaia Backup and restore Gaia Backup, you must use Gaia Clish (clish) on each appliance in the Security Group. | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | MBS-7145 | Maestro | Maestro Security Groups do not support the Dynamic CLI as described in [sk144112](https://support.checkpoint.com/results/sk/sk144112). | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-12642 | Maestro | Gaia scheduled backup fails to run. The /var/log/messages file contains the error "`scheduled_backup: SGM isn't SMO, skipping scheduled backup`". | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30SP JHF Take 56](https://support.checkpoint.com/results/sk/sk165312) | | MBS-9357 | Maestro | Scalable Platforms do not support these CPUSE commands in Gaia Clish or Gaia gClish: * `installer uninstall VALUE completely` * `installer uninstall VALUE last-take` Note: The command '`installer uninstall `' removes only the specified Hotfix / Jumbo Hotfix Accumulator package. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | | PMTR-111391, MBS-7069 | Maestro | Remote authentication for the Expert mode using RADIUS / TACACS+ servers with the Gaia gClish command "`set expert-authentication-method {shared-password | user-password}`" is not supported. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-17162 | Maestro | On a Maestro Security Group, the Security Gateway does not show the correct speed for data and management interfaces when using monitoring commands or SNMP queries on the Gateway. To view the correct interface speed, run commands on the Orchestrator, such as the `orch_stat -p` command or relevant Clish commands. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5478 | Maestro | The '`asg_drop_monitor`' command does not support the "`-ssm -t `" parameter. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-11339 | Maestro | In R80.20SP and R81.10, the Maestro Orchestrator Clish command "`set maestro port X/Y/Z admin-state `" does not survive reboot. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5177 | Maestro | Maestro Security Groups do not support the following Gaia Clish commands: * `set chassis id VALUE alert_threshold cpus_temperature_threshold_low VALUE` * `set chassis id VALUE alert_threshold fans_threshold_high VALUE` * `set chassis id VALUE alert_threshold fans_threshold_low VALUE` * `set chassis id VALUE alert_threshold power_consumption_threshold_perc_high VALUE` * `set chassis id VALUE alert_threshold power_consumption_threshold_perc_low VALUE` * `set chassis id VALUE modules_amount cmm VALUE` * `set chassis id VALUE modules_amount fans VALUE` * `set chassis id VALUE modules_amount power_units VALUE` * `show chassis high-availability factors sensor cmm` * `show chassis high-availability factors sensor fans` * `show chassis high-availability factors sensor power_supplies` * `show chassis id VALUE alert_threshold cpus_temperature_threshold_high` * `show chassis id VALUE alert_threshold cpus_temperature_threshold_low` * `show chassis id VALUE alert_threshold fans_threshold_high` * `show chassis id VALUE alert_threshold fans_threshold_low` * `show chassis id VALUE alert_threshold power_consumption_threshold_perc_high` * `show chassis id VALUE alert_threshold power_consumption_threshold_perc_low` * `show chassis id VALUE modules_amount cmm` * `show chassis id VALUE modules_amount fans` * `show chassis id VALUE modules_amount power_units` | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7009 | Maestro | When creating Gaia OS users on Maestro Orchestrator, you must configure these users with UID 0. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9523 | Maestro | It is not supported to create a Gaia snapshot on one Maestro Security Appliance and revert that Gaia snapshot on a Maestro Security Appliance in the same Security Group (for example, with the command '`snapshot_recover`'). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 273](https://support.checkpoint.com/results/sk/sk155832) | | Hardware ||||| | 00624269 | All | Scalable Platforms do not use the Ethernet ports on the Security Group Members. Each Security Group Member has two Ethernet ports that are not used by the system and must not be configured. The output of the '`ifconfig`' command shows these ports as "eth1" and "eth2". | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | SPC-214 | Chassis | On SSM440, when working with 1G copper transceiver in ethX-Mgmt4, after SSM reboot, the interface will show the link as up, but traffic will not pass. Refer to [sk126612](https://support.checkpoint.com/results/sk/sk126612). | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02434343 | Chassis | On SSM440, the error "`Dot3Ah: Failed getting variable from bm`" may appear when running the '`system reload`' command. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02169635 | Chassis | On SSM440, the MTU is limited to a maximum of 9000 bytes. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 02496928 | Chassis | Verification is needed after changing QSFP mode on SSMs: "`show smo verifiers print name `". If verification fails, change the QSFP mode on SSMs again: "`set ssm id qsfp-ports-mode `" | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | MBS-3870 | Chassis | Scalable Chassis 40000 / 60000 support a maximum of two SSMs in a Chassis (SSM1 and SSM2). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 02439227 | Chassis | Scalable Chassis 44000 support PXE installation on Slot 6 (SGM 2_06 / SGM 1_06) by changing the kdevice to eth3. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 00894653 | Chassis | Transceivers for the Scalable Chassis 40000 / 60000 are not interchangeable with transceivers from other Check Point appliances. Only transceivers provided with the Scalable Chassis 40000 / 60000 are certified for this system. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-5205 | Maesto | Maestro Orchestrator does not support Hardware Health Monitoring. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | MBS-6583 | Maestro | After the Gaia OS installation completes on Maestro Security Appliances 5600, you must manually reboot them. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Management and Policy ||||| | MBS-3001 | All | To fetch logs from Security Group Members, you must use SmartConsole. Running the '`fw fetchlog`' command on the Management Server is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8515 | All | Scalable Platforms do not support NAT64 and NAT46 objects. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | Resolved in R81.10 for Security Gateway only. See [sk91905](https://support.checkpoint.com/results/sk/sk91905) | | PMTR-22530 | Chassis | Management API on an R80.10 Management Server does not support Scalable Chassis 40000 / 60000 that run R80.20SP. | [R80.10](https://support.checkpoint.com/results/sk/sk111841) | [R80.10 JHF Take 214](https://support.checkpoint.com/results/sk/sk116380) | | Dual Site Deployment ||||| | MBS-7771 | All | In Dual Site / Dual Chassis deployment, the external synchronization network between the two Maestro Sites / two Chassis must not contain Layer 3 routers (because they drop the Check Point Cluster Control Protocol packets). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7769 | All | In Dual Site / Dual Chassis deployment, the external synchronization network between the two Maestro Sites / two Chassis must guarantee a latency of no more than 100ms and a packet loss of no more than 5%. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6991 | Maestro | After Dual Site is configured, it is not supported to change the Site ID on the Orchestrators. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7606 | Maestro | In Dual Site deployment, a Security Group that contains Security Appliances from two sites must include at least one Security Appliance at each site. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7028 | Maestro | In Dual Site Deployment, the following requirements apply to ports (and cables) on the Orchestrators that synchronize with each other on both sites: (1) The same port type (mgmt / uplink / downlink / external sync / internal sync) must be configured for the same ports. Example 1: If Port 5 on Orchestrator 1_1 is configured as uplink, then Port 5 on Orchestrator 2_1 must also be configured as uplink. Example 2: If Port 20 on Orchestrator 1_2 is configured as downlink, then Port 20 on Orchestrator 2_2 must also be configured as downlink. (2) The split cables and ports, to which they are connected, must be identical. Example 1: If a 4x10 DAC is connected to Port 5 on Orchestrator 1_1, then an identical 4x10 DAC must also be connected to Port 5 on Orchestrator 2_1. Example 2: If a 4x10 DAC is connected to Port 20 on Orchestrator 1_2, then an identical 4x10 DAC must also be connected to Port 20 on Orchestrator 2_2. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6947 | Maestro | In Dual Site deployment, no warning is displayed when changing the "type" of the QSFP port in Gaia Clish on Maestro Hyperscale Orchestrators on the local site, while the Maestro Hyperscale Orchestrators on the remote site are down. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7744 | Maestro | In Dual Site deployment, the external synchronization connection between the Orchestrators on different sites must be a direct Layer 2 link. Notes: * L2 switches are supported beginning in [Jumbo HFA 178,](https://support.checkpoint.com/results/sk/sk155832) but Q-in-Q is required on the switch side. * In R81.10 and higher versions, Q-in-Q is not required because you can disable the site sync encapsulation. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7773 | Maestro | A single-site Security Group supports a maximum of 14 appliances. A dual-site Security Group supports a maximum of 28 (14 per site) appliances. * In R81 and higher versions, the maximum number of SGMs for each site is 14 for single-site and dual-site deployments. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | VoIP ||||| | ### Known Limitations - Installation {#KL_Installation_Features} ||||| | Installation / Upgrade ||||| | 01488400 | All | Scalable Platforms do not support the running of the '`asg`' or other global commands before the setup wizard completes. | [R76SP.10](https://support.checkpoint.com/results/sk/sk102788) | - | | PMTR-71148 | Chassis | In a rare scenario, after upgrading the Scalable Chassis 40000 / 60000 to R81.10, the output of the "`asg diag print 20`" command shows that the test "`Configuration File`" fails with "`Database inconsistent`". To resolve: Reboot the problematic SGM with the "r`eboot -b `" command. | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | - | | Licensing ||||| | MBS-6099 | Maestro | A Maestro Security Appliance that was removed from a Security Group and then added back to the same Security Group might not pull the license from the existing members of the Security Group. As a result, this Security Appliance remains in the DOWN state. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | ### Known Limitations - Infrastructure {#KL_Infrastructure_Features} ||||| | Security Gateway ||||| | MBS-4895 | All | Scalable Platforms do not support the '`fw sam_policy`' ('`fw samp`') commands. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | VSX ||||| | MBS-12240 | All | Scalable Platforms in VSX mode do not support the Threat Emulation and Identity Awareness Software Blades on a VSX Virtual System that is configured in the Bridge mode. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | PMTR-64090 | All | A newly added Security Group Member remains in the DOWN state, if there was a Virtual System with the '`InitialPolicy`' in the Security Group before you added that Security Group Member. (The output of the '`cphaprob list`' command on the new Security Group Member shows that the Critical Device `pull_config` reports its state as `problem`.) To avoid this issue: 1. Examine the VSX state and policies on all Virtual Systems in the Security Group (with the `vsx stat` command) 2. If there is a Virtual System with the '`InitialPolicy`', install the applicable Access Control policy on that Virtual System | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-12664, PRJ-20567 | All | To configure VSX Virtual Switches to forward IPv4 multicast traffic or any IPv6 traffic, it is necessary to disable the correction of local connections: 1. Connect to the command line on the applicable Security Group 2. Log in to Expert mode 3. Run this command to disable the correction of local IPv4 connections in the current session: `g_fw ctl set int fwha_local_chassis_state_correction 0` 4. Run this command to disable the correction of local IPv6 connections in the current session: `g_fw6 ctl set int fwha_local_chassis_state_correction 0` 5. Run this command to disable the correction of all local connections permanently: `g_update_conf_file fwkern.conf fwha_local_chassis_state_correction=0` | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81 JHF Take 13](https://support.checkpoint.com/results/sk/sk170114) | | MBS-12574 | All | In rare scenarios, after you change the number of CoreXL Firewall instances in a Virtual System object in SmartConsole and click OK: 1. In SmartConsole, the VSX Operation Progress window shows "`Operation ended with errors`". 2. On the Security Group, the output of the "`asg stat -v`" command shows that the state of the SMO Security Group Member changed to "`DOWN`". To resolve: 1. Reboot the affected Security Group Member (`reboot -b `) 2. In SmartConsole, change the number of CoreXL Firewall instances in the Virtual System object and click OK. 3. Install policy on the Virtual System object. | [R81](https://support.checkpoint.com/results/sk/sk169954) | * [R81.20](https://support.checkpoint.com/results/sk/sk177624) * [R81.10 JHF Take 61](https://support.checkpoint.com/results/sk/sk175186) * [R81 JHF Take 69](https://support.checkpoint.com/results/sk/sk170114) * [R80.30SP JHF Take 108](https://support.checkpoint.com/results/sk/sk165312) | | MBS-9806 | Maestro | Maestro Security Groups do not support VSX Virtual Switches. Important Note: If you created Virtual Switches in R80.30SP with the R80.30SP Jumbo Hotfix Accumulator Take 56 or Take 49, you must install a special hotfix before you install the R80.30SP Jumbo Hotfix Accumulator Take 73 or higher. See [sk171917](https://support.checkpoint.com/results/sk/sk171917). | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30SP JHF Take 73](https://support.checkpoint.com/results/sk/sk165312) | | MBS-6306 | All | Scalable Platforms in VSX mode do not support Log Server Distribution (the "`asg_log_servers`" command). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) (R81.10: new LS Server Clustering feature) | | MBS-15684 | All | Scalable Platforms in VSX mode do not support NAT64. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10 JHF Take 30](https://support.checkpoint.com/results/sk/sk175186) | | MBS-16945 | All | Scalable Platforms in VSX mode do not support NAT46. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5636 | All | A reset of SIC between the Security Group in VSX mode and the Management Server might cause the non-SMO Security Group Members to change their state to DOWN. To recover: Reboot the non-SMO Security Group Mmbers. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | MBS-3209 | All | Scalable Platforms in VSX mode do not support Multi Bridge (support for multiple bridge interfaces on a Virtual System in Bridge Mode). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | MBS-4228 | All | After re-configuring a VSX Gateway with the '`vsx_util reconfigure`' command, you must manually install policy on each Virtual System in SmartConsole. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6775 | All | While the SMO Image Cloning feature is enabled, a Security Group Member may reboot more than one time. To resolve: Disable the SMO Image Cloning feature in the Security Group. Run this command in Gaia gClish: `set smo image auto-clone off` | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 02024482 | All | After running the '`vsx_util reconfigure`' command on the Management Server, the VLAN interface on a Security Group in VSX mode might come up without an IP address if the VLAN's MTU was set to a value larger than 1500. Refer to [sk111513](https://support.checkpoint.com/results/sk/sk111513). | [R76SP.40](https://support.checkpoint.com/results/sk/sk110515) | - | | 01821671 | All | In VSX HA mode, VLAN trunk ports cannot be monitored from the context of Virtual Systems (only from the context of the VSX Gateway itself - VS0). | [R76SP.30](https://support.checkpoint.com/results/sk/sk108195) | - | | 01812597 | All | No local configuration should be performed on a Security Group or on a Security Group Members while the '`vsx_util reconfigure`' command is running on the Management Server. It is necessary to wait until all Security Group Members and Virtual Systems are up and running (otherwise, the local configuration will not be applied). | [R76SP.30](https://support.checkpoint.com/results/sk/sk108195) | - | | 01620389 | All | You cannot configure Bond interfaces on chassis Management ports after you create the VSX object in SmartDashboard. | [R76SP.20](https://support.checkpoint.com/results/sk/sk105938) | - | | 01097957 | All | If you lower the Connections Table limit of a Virtual System, and one of the SGMs has more or the same number of connections than the limit, the new value is rejected for that SGM. The new Connections Table limit may be accepted by other SGMs. Notes: * To see the current number of entries in the Connections Table, run this command in the Expert mode: `fw tab -t connections -s` * To configure the Connections Table limit of a Virtual System: In SmartDashboard, open the Virtual System object - go to the "Capacity Optimization" pane - set the value in the "Limit the maximum concurrent connections" field - click on OK - install the policy. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00922958 | All | The Alerts configuration wizard does not allow setting of performance thresholds per Virtual System.You can manually configure thresholds for Virtual Systems using the '`dbset`' command from the Expert mode: `g_all dbset chassis:vs:0:alert_threshold: ` Where `` is the percentage of the default threshold per Security Group Member. Example: `[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:packet_rate_threshold_high 30` In this example, an alert is triggered when any Virtual System packet rate is higher than 30% x 1.8MB (1.8MB is the default packet rate threshold per SGM). Note: One ratio applies to all Virtual Systems. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01341918 | All | You cannot enable IPv6 before you create and configure a new VSX Gateway. You must first create the new VSX Gateway and then enable and configure IPv6 using Gaia gClish. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01527874 | Chassis | Virtual Switches without physical interfaces are not supported for Chassis VSLS. | [R76SP.10_VSLS](https://support.checkpoint.com/results/sk/sk105703) | - | | 01284809 | Chassis | To use the Sync Lost mechanism, you must keep the Management interfaces for both chassis connected. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 01087321 | Chassis | VSX Gateway creation in SmartConsole and the '`vsx_util reconfigure`' command are supported when only the left-most SGM is in the Security Group. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-10271 | Maestro | The '`drop_monitor`' command fails with "`Error! Failed to get current VS `" on a Security Group in VSX mode. Solution is planned for future Takes of the R80.30 Jumbo Hotfix Accumulator ([sk165312](https://support.checkpoint.com/results/sk/sk165312)). | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-8837 | Maestro | In the context of a Virtual System in Bridge Mode: * The output of the '`asg diag verify "ARP Consistency"`' command shows "`Failed`" in the "`Result`" column. * The output of the '`asg_arp`' command shows "`No matches found`". | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-5288 | Maestro | Scalable Platforms do not support VSX Virtual System Load Sharing (VSLS). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | Maestro: [R80.20SP JHF Take 163](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5214 | Maestro | Scalable Platforms do not support VSX Virtual Switches. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 178](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5457 | Maestro | If after creating a new Virtual System object, policy installation on a Security Group object fails with "`Error code: 0-2000240`", wait 2-3 minutes and install the policy again. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | MBS-6572 | Maestro | A change in the number of CoreXL Firewall instances (in a VSX Virtual System object in SmartConsole) in Dual Chassis VSLS setup requires a downtime, because the Virtual System must be restarted. During this restart, traffic cannot pass through the Virtual System. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6176 | Maestro | To create a VSX Gateway object in SmartConsole for a Maestro Security Group: 1. Assign at least two interfaces to the Security Group. 2. Install the R80.20SP Jumbo Hotfix Accumulator ([sk155832](https://support.checkpoint.com/results/sk/sk155832)) on all Security Appliances in the Security Group. 3. In SmartConsole, create a VSX Gateway object. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7888 | Maestro | Interface Active Check is not supported in VSX mode. | [R76SP.30](https://support.checkpoint.com/results/sk/sk108195) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | SecureXL ||||| | - | Maestro | SecureXL User Space Mode (UPPAK) is supported only starting from a specific Jumbo Hotfix Accumulator Take. For details, see [sk179432](https://support.checkpoint.com/results/sk/sk179432). Note - Scalable Chassis 40000 / 60000 do not support the SecureXL UPPAK mode. | R81.10, R81.20 | See [sk179432](https://support.checkpoint.com/results/sk/sk179432) | | MBS-11846 | All | To support the configuration of DoS Rate Limiting rules in Gaia gClish with the command "`fwaccel dos rate add`" command, or in the Expert mode with the SecureXL command "`g_fwaccel dos rate add`", you must install a required hotfix on the Security Group. Contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81 JHF Take 42](https://support.checkpoint.com/results/sk/sk169954) | | MBS-3259 | All | Scalable Platforms do not support Fast Accelerator (see [sk156672](https://support.checkpoint.com/results/sk/sk156672) for more details). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * R81 and higher * [R80.20SP JHF Take 178](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5415 | All | Configuring the IPS protection 'SYN Attack' in SmartConsole is not supported. You must only use the '`fwaccel synatk`' and '`fwaccel6 synatk`' CLI commands. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-6834 | All | Security Group members do not pull the SecureXL configuration from the *$PPKDIR/conf/simkern.conf* file on the SMO SGM. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 121](https://support.checkpoint.com/results/sk/sk155832) | | MBS-8143 | All | These SecureXL commands are not supported: * `g_fw sam_policy batch` * `g_fw6 sam_policy batch` | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) * [R80.20SP JHF Take 266](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5610 | Chassis | An Accelerated SYN Defender configuration made with the '`fwaccel synatk`' / '`fwaccel6 synatk`' commands might not be applied on non-SMO members. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | MBS-9650 | Chassis | 1. Output of the '`asg perf -p`' command shows that the "`Throughput`" is 0 in the "`Firewall`" column. 2. Output of the '`asg perf -v`' command shows that the "`Throughput`" value is lower than expected (the F2F traffic is missing). 3. SNMP Query for OID .1.3.6.1.4.1.2620.1.48.20.1.0 (`asgThroughput`) returns a value lower than expected (the F2F traffic is missing). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R81.10](https://support.checkpoint.com/results/sk/sk175186) * [R81 JHF Take 42](https://support.checkpoint.com/results/sk/sk170114) * [R80.30SP JHF Take 82](https://support.checkpoint.com/results/sk/sk165312) * [R80.20SP JHF Take 314](https://support.checkpoint.com/results/sk/sk155832) | | CoreXL ||||| | MBS-10244 | All | Scalable Platforms do not support CoreXL Dynamic Balancing. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk173903) | | MBS-12224 | All | If only one CPU core runs as a CoreXL SND on Security Group Members, these cosmetic issues can occur: * Output of the "`asg_perf`" command is empty. * Output of the "`cores_verifier`" command shows "`Error: unable to obtain value from smodb`". * Output of the "`cores_verifier`" command shows "`Error: BPEth0 doesn't exist in /proc/interrupts`". | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | PMTR-74532 | All | On Scalable Platforms (Maestro and Chassis), to make sure there is connectivity after changing the number of instances in the CoreXL configuration, follow these steps: 1. Reboot all Security Group Members one by one, **except the SMO**. **IMPORTANT: Traffic capacity is greatly reduced after you reboot all Security Group Members except the SMO, because only the SMO handles traffic until it is rebooted.** **Examples**: In a Dual Site deployment with four Security Group Members (two on each Site), where the SMO is "1_1", reboot the Security Group Members in this order: 1. Reboot the Security Group Member 2_2 on Site 2 and wait for it to finish the reboot. 2. Reboot the Security Group Member 2_1 on Site 2 and wait for it to finish the reboot. 3. Reboot the Security Group Member 1_2 on Site 1 and wait for it to finish the reboot. In a Single Site deployment with four Security Group Members, where the SMO is "1_1", reboot the Security Group Members in this order: 1. Reboot the Security Group Member 1_4 and wait for it to finish the reboot. 2. Reboot the Security Group Member 1_3 and wait for it to finish the reboot. 3. Reboot the Security Group Member 1_2 and wait for it to finish the reboot. 2. When a Security Group Member finishes the reboot, it enters the "DOWN" state because of a mismatch in the number of CoreXL Firewall instances with other Security Group Members. All other Security Group Members that were not rebooted yet, including the SMO, are in the "ACTIVE!" state (Active Attention) and handle traffic. 3. When all Security Group Members except the SMO have finished the reboot, you must reboot the SMO Security Group Member. A failover occurs immediately, and one of the other Security Group Members becomes the SMO. All other Security Group Members become "ACTIVE" and start to handle traffic. 4. When the last Security Group Member, which was the SMO, finishes the reboot, all Security Group Members become "ACTIVE" and full capacity is restored. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Cluster ||||| | MBS-6084 | All | To support asymmetric connections, it is necessary to enable the cluster synchronization in the corresponding service's properties (Advanced pane \> in the Cluster and synchronization section, select Synchronize connections if Synchronization is enabled on the cluster \> install policy). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | MBS-5864 | All | It is necessary to install policy after changing the mode of a bond interface (for example, from XOR to 802.3AD), so that the bond interface is monitored by the cluster. For 40000 / 60000 Appliances, applies to Dual Chassis. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) | | MBS-7913 | Maestro | Cluster Control Protocol (CCP) encryption is not supported. | [R80. 30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-7946 | Maestro | The Interface Active Check feature (setting the value of the kernel parameter `fwha_enable_if_probing` to 1) is not supported. | [R80. 30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-13481 | Maestro | Installing R80.30SP JHF Take 82 when using multicast traffic might cause high CPU utilization. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R81.20](https://support.checkpoint.com/results/sk/sk177624) * [R81.10 JHF Take 14](https://support.checkpoint.com/results/sk/sk175186) * [R81 JHF Take 51](https://support.checkpoint.com/results/sk/sk170114) * [R80.30SP JHF Take 82](https://support.checkpoint.com/results/sk/sk165312) * [R80.20SP JHF Take 326](https://support.checkpoint.com/results/sk/sk155832) | | Hyper-Threading ||||| | MBS-3106 | All | In VSX mode, after disabling or enabling the Hyper-Threading feature in the cpconfig menu and rebooting, another reboot is required for the system to apply the Multi-Queue configuration. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | ### Known Limitations - Networking {#KL_Networking_Features} ||||| | Networking ||||| | MBS-11278 | All | Unique IP address per Chassis (UIPC) feature is not supported. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R82](https://support.checkpoint.com/results/sk/sk181127) | | MBS-2199 | All | After a failover of the FTP control connection in Scalable Platforms, it is not possible to open an asymmetric FTP data connection. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4098, PMTR-60868 | All | GRE tunnel is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R82](https://support.checkpoint.com/results/sk/sk181127) | | MBS-1274 | All | Scalable Platforms do not support the reserved connections feature (the '`asg_reserved_conns`' command). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8379 | All | Scalable Platforms do not support Alias IP addresses on its interfaces. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R80.30SP JHF Take 49](https://support.checkpoint.com/results/sk/sk165312) * [R80.20SP JHF Take 279](https://support.checkpoint.com/results/sk/sk155832) | | PMTR-81748 | All | The ICMP outgoing connections from non-SMO Security Group Members through the Security Group's "Mgmt" interface are not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-2049 | All | After installation, a static route to 192.168.1.254 is automatically created due to the preconfigured subnet for the eth1-Mgmt4 interface. If you need to configure another static route for the eth1-Mgmt4 interface: 1. Remove the current static route to 192.168.1.254 2. Add the required static route for the eth1-Mgmt4 interface. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9105 | All | When IPv6 traffic passes through Security Groups, it is not supported to disable the 'Drop out of state TCP packets' setting in SmartConsole \> Global properties \> Stateful Inspection. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9713 | All | "Failed to set MTU 9000 on interface magg0. Maximum value allowed is 9710." error when running the Gaia gClish command "`set interface magg0 mtu `" for a Management Aggregation (MAGG) interface. Workaround: 1. Configure the MTU on any of the data interfaces to a value greater than 1500. 2. Configure the MTU on the MAGG interface to a required value. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9798 | All | Scalable Platforms and Maestro Security Appliances support fragmented packets with Layer 4 distribution only in Gateway mode with CoreXL enabled. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 01052419 | All | Connections may break when you change the System Distribution Mode using either the '`set distribution configuration`' command or the '`set distribution interface`' command. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-3944 | Chassis | Asymmetric traffic between two chassis in Dual Chassis deployment is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5164 | Chassis | The '`asg_tmpl_special_svcs`' command is no longer supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5311 | Chassis | QoS is not supported on the SSM data ports (the '`set ssm data-port qos status on`' command). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-2354 | Chassis | TFTP connections do not survive failover when using SSM440 and the distribution matrix size of 16K. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7014 | Chassis | You must configure the Bond Interface on the Management Ports (MAGG) only from Gaia gClish. Configuring MAGG in Gaia Portal is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | - | Chassis | When using SGM400, 40GB Back Plane (BP) connectivity speed is supported for both SSM160 and SSM440. In order to switch to 40GB, the SSM's downlink ports should be set to 'Auto' Speed. Refer to [sk118435](https://support.checkpoint.com/results/sk/sk118435). | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | [R80.20SP JHF Take 266](https://support.checkpoint.com/results/sk/sk155832) | | MBS-2991, MBS-6601, SPC-994, PMTR-91054 | Chassis | Configuration of RX/TX ringsize is supported only on eth\-Mgmt4 and BPEth\ interfaces (either with the Expert command '`ethtool -g`', or the Gaia Clish command '`set interface ...`'). | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | 00846789 | Chassis | R76SP does not support VLANs on a Management interface. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | PMTR-102638 | Maestro | In an environment where the Security Gateway is connected to the Maestro Orchestrator through two downlinks, disconnecting and connecting a downlink, physically or through the Orchestrator, causes an outage of 10 seconds between them. | [R81.10](https://support.checkpoint.com/results/sk/sk170416) | [R82](https://support.checkpoint.com/results/sk/sk181127) | | PMTR-60874 | Maestro | Scalable Platforms do not support VxLAN interfaces. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-3859 | Maestro | If you installed a 40 GbE card or a 100 GbE card on a Check Point appliance you wish to connect to the Maestro Security Orchestrator, and you did not receive this card as part of the Maestro product, make sure this card meets the minimal requirements: 1. Connect to the command line of the Check Point appliance. 2. Log in to the Expert mode. 3. Run this single long command: `for NIC in $(ifconfig | grep ethsBP | awk '{print $1}') ; do echo $NIC: ; ethtool -i $NIC | grep firmware ; done` 4. The '`firmware-version`' has to be '`12.22.1002`' or higher. Example output: ``` ethsBP4-01: firmware-version: 12.22.1002 ethsBP4-02: firmware-version: 12.22.1002 ``` | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5216 | Maestro | When VLAN traffic needs to traverse the Security Group in Bridge mode, you must configure all relevant VLAN IDs on the Uplink ports assigned to the Security Group in the Gaia Portal on the Maestro Orchestrator. Note: Configure these VLAN IDs in the Gaia Portal on the Maestro Orchestrator. Example Topology: (VLAN Trunk port) ==== (Uplink ports on Maestro Orchestrator that are assigned to a Security Group in Bridge mode). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8480 | Maestro | It is not supported to configure a Bonding Group in LACP mode (8023AD) if at least one slave interface is shared between different Security Groups. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4993 | Maestro | Configuring the state of the Forward Error Correction (FEC) manually is not supported. This feature is in the auto state by default. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5225 | Maestro | Interfaces cannot be shared between Security Groups. Resolved in Jumbo HFA R80.20SP Take 105: Added support for sharing of management interfaces between Security Groups. This applies to management interfaces that are not part of a MAGG interface in 802.3AD (LACP) mode (a Bond Interface on the Management Ports)." | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 105](https://support.checkpoint.com/results/sk/sk155832) (not supported in R81) | | MBS-5339 | Maestro | VLAN interfaces are not supported on Maestro Hyperscale Orchestrator "Management" ports (ethX-MgmtY). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4668 | Maestro | When two Maestro Hyperscale Orchestrators are connected together, and you need to disconnect many cables from one of the Maestro Hyperscale Orchestrators, first disconnect the cable from the dedicated Synchronization port. This prevents the LSP mechanism from disabling all ports on the other Maestro Hyperscale Orchestrator. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-7636 | Maestro | When several Downlink ports on an Orchestrator are connected to the same Security Appliance, these Downlink connections work only in the Active/Backup mode for IPv6 traffic (and not in the Load Sharing mode). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | Dynamic Routing ||||| | MBS-14221 | All | R80.30SP Security Groups do not support IPv6 Dynamic Routing protocols. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30SP JHF Take 82](https://support.checkpoint.com/results/sk/sk165312) | | MBS-3951 | All | When you configure a routemap that includes the 'direct' parameter, it will also advertise the internal communication networks CIN and Sync. On Scalable Platforms and Maestro Security Appliances, you have to filter out manually such internal communication networks. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-3950 | All | If you filter the 'protocol direct' on a routemap and do not specify an interface, then it will also advertise the internal communication CIN and Sync networks. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4172 | All | * PIM SSM mode is not supported on 40000 / 60000 Chassis. * PIM (all modes) is not supported on Maestro Security Groups. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81.10 JHF Take 61](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) | | MBS-14222 | All | Scalable Platforms (Maestro and Chassis) do not support PIM. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 313](https://support.checkpoint.com/results/sk/sk155832) [R81.10 JHF Take 61](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) | | 01862808 | All | Critical Device (pnote) named `routed` was added to prevent traffic outage by allowing the RouteD daemon to synchronize BGP routes. * In BGP DR Manager failback scenarios, the old BGP DR manager will go down for 2 minutes. * When RouteD daemon restarts on BGP DR Manager, BGP DR Manager will go down for 2 minutes. | [R76SP.30](https://support.checkpoint.com/results/sk/sk108195) | - | | 00736037 | All | OSPF is not supported on Management interfaces. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00771254 | All | BGP confederations are not supported. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-14202 | Maestro | R80.30SP Security Groups do not support IPv6 OSPFv3. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R80.30SP JHF Take 97](https://support.checkpoint.com/results/sk/sk165312) | | IPv6 ||||| | 02487403 | Chassis | SSM Layer4 Distribution Mode is supported for IPv4 only. The IPv6 traffic will be distributed based on the Source/Destination IP addresses only. Note: a system can use SSM Layer4 Distribution Mode while IPv4 and IPv6 are inspected by the Security Gateway. Each IP version will use a different mechanism to distribute traffic, as described above. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | ### Known Limitations - Software Blades {#KL_Software_Blades_Features} ||||| | Firewall ||||| | PMTR-58383 | All | Scalable Platforms do not support CGNAT (see [sk165153](https://support.checkpoint.com/results/sk/sk165153)) with the Layer 4 distribution. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-10099, MBS-10790 | All | Scalable Platforms do not support the Global NAT (GNAT) feature (see [sk165153](https://support.checkpoint.com/results/sk/sk165153)). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-10788 | Maestro | Client Authentication is not supported when the Layer 4 distribution mode is enabled. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | VPN ||||| | MBS-11504 | All | Scalable Platforms do not support the configuration of different VPN encryption domains on a Security Gateway that is a member of multiple VPN communities. | [R81](https://support.checkpoint.com/results/sk/sk169954) | * [R81.20 JHF take 43](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) * [R81.10 JHF Take 131](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) * [R81 JHF Take 99](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) | | MBS-12310 | All | Scalable Platforms do not support Large Scale VPN (LSV). | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12312 | All | Scalable Platforms do not support Route Based VPN. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-14272 | All | Machine Certificate Authentication is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | MBS-14262 | All | Multiple ciphers for external Security Gateways in a single VPN community are not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | MBS-14268 | All | SHA512 is not supported in VPN Communities. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | MBS-14408 | All | Simultaneous Login Prevention (SLP) is not supported on all Scalable Platforms versions (R76SP and higher). | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-4097 | All | * Site-to-Site VPN with IPv6 peers is not supported. * Remote Access VPN from IPv6 clients is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-2461 | All | It is not supported to initiate a connection from an SGM if the connection's destination requires encryption. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R81.10](https://support.checkpoint.com/results/sk/sk173363) * [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-5242 | All | VPN traffic on a VSX Virtual System that is connected to a VSX Virtual Switch is supported only when the distribution mode configured for the WRP interface is the same as the distribution mode configured for the physical interface on the VSX Virtual Switch.Example of a VSX topology: (Virtual System) === wrp100 === (Virtual Switch) === (eth1-01) The same distribution mode must be configured for the interface wrp100 as was configured for the interface eth1-01. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-5284 | All | VPN Permanent Tunnels are not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-2472 | All | In the Security Gateway object -\> IPSec VPN, the Link Selection supports only the Always use this IP address selection methods: * Main address * Selected address from topology table * Statically NATed IP | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-8298 | All | In the Security Gateway object, it is not supported to configure VPN on the Management interface (eth\-Mgmt\) assigned to the Security Group. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8319 | All | * It is not supported to configure a Scalable Platform 40000 / 60000 object or a Maestro Security Group object as a VPN Satellite Gateway if other VPN peers communicate through it. * It is not supported to configure Client to Site traffic over the Site-to-Site VPN tunnel with a Scalable Platform 40000 / 60000 or a Maestro Security Group. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-8322 | All | VPN Wire mode is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-8316 | All | IPv6 VPN is not supported. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 02487412 | All | A VPN can be used with SSM Layer4 Distribution Mode, but the VPN traffic will be distributed based on the Source/Destination IP addresses. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-7914 | Maestro | Multiple Entry Points (MEP) configuration using Dead Peer Detection (DPD) is not supported. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R82](https://support.checkpoint.com/results/sk/sk181127) | | MBS-9085 | Maestro | VPN is not supported in VSX mode if VPN traffic needs to pass through a VSX Virtual Switch. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | MBS-8938 | Maestro | Scalable Platforms do not support L2TP traffic passing to Security Groups. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R81 JHF Take 34](https://support.checkpoint.com/results/sk/sk170114) | | Threat Prevention (Anti-Virus, Anti-Bot, Threat Emulation, Threat Extraction) ||||| | MBS-12236 | All | Scalable Platforms do not support SSH Deep Packet Inspection (SSH DPI). | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | MBS-12330 | All | Scalable Platforms do not support inspection of SMBv3 multi-channel with Anti-Virus and SandBlast Threat Emulation Software Blades. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-13295 | All | R80.30SP and R81SP do not support Custom Intelligence Feeds. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | Supported in [R80.20SP](https://support.checkpoint.com/results/sk/sk140392), and in [R81.10](https://support.checkpoint.com/results/sk/sk173363) and higher | | MBS-4094 | All | Scalable Platforms do not support ICAP Server configuration. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-9405 | All | When the Threat Extraction blade is enabled, the original attachment file might not be available for download due to a limitation in a Cluster Load Sharing environment. It is recommended to disable this blade in the corresponding Threat Prevention profile. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | [R80.20SP JHF Take 279](https://support.checkpoint.com/results/sk/sk155832) (not supported in R81) | | MBS-12070 | Maestro | If a Threat Prevention policy is installed on a Security Group, while a Security Group Member reboots, that Security Group Member may remain in the Down state after it boots. To resolve: Manually reboot this Security Group Member. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | - | Maestro | FTP protocol inspection with Anti-Virus and SandBlast Threat Emulation is not supported in R80.30SP. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R81](https://support.checkpoint.com/results/sk/sk169954) | | PMTR-41415 | Maestro | In a ClusterXL Load Sharing mode: 1. Due to the nature of transferring files over multiple connections, the following protocol features might not be inspected properly: * HTTP 206 Partial Content * SMBv3 Multi-Channel * FTP REST command used over multiple connections 2. Protection based on threshold count (between connections) might not work properly: * Static protections * DNS tunnel * Sweep Scan protection * VoIP SIP * MGCP protection may not work over NAT * Protections that contain cross-connection logic | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | MBS-9931 | Maestro | Scalable Platforms do not support the Threat Extraction Software Blade. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | [R81.10](https://support.checkpoint.com/results/sk/sk173363) | | IPS ||||| | PMTR-62718 | Maestro | "Packet Capture was not found" error when clicking the "View Packet Capture" link in the IPS log. | [R81](https://support.checkpoint.com/results/sk/sk169954) | * [R81.10](https://support.checkpoint.com/results/sk/sk173363) * [R81 JHF Take 13](https://support.checkpoint.com/results/sk/sk170114) | | DLP ||||| | MBS-13102, MBS-13243 | All | The Data Loss Prevention Software Blade does not support rules with the Action "Ask". | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Identity Awareness ||||| | MBS-14238 | All | Scalable Platforms do not support SAML for Identity Awareness. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-12593 | All | You must enable the SMO Image Cloning before you add new Security Group Members to a Security Group, if in the Security Gateway object you enabled the Identity Awareness Software Blade and an Identity Source (for example, AD Query or Identity Collector). Run this command in Gaia gClish: `set smo image auto-clone on` Important - If you do not enable the SMO Image Cloning, the new Security Group Member reboots several times before it is completely configured. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | IDA-2339 | All | Scalable Platforms do not support Microsoft Azure AD for Identity Awareness. | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-12840 | All | If you made changes in one of the Identity Session Conciliation files listed below in a Security Group, and you add a new Security Group Member: 1. Manually copy these files to each new Security Group Member with the "`asg_cp2blades`" command. 2. In SmartConsole, install the applicable Access Control policy on the applicable Security Gateway object. List of files: * *$FWDIR/conf/identity_sources_scores.C* * *$FWDIR/conf/pep_conciliation_scores.C* * *$FWDIR/conf/pdp_session_conciliation.C* | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | MBS-10248 | All | To configure Identity Broker, you must follow the guidelines in [sk175587](https://support.checkpoint.com/results/sk/sk175587). | [R81](https://support.checkpoint.com/results/sk/sk169954) | - | | SPC-990 | All | Identity sharing must be configured with ethX-MgmtX and for communicating with the PDP side. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | - | | SPC-1569 | All | Identity Sharing is not supported with "Smart Pull". [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) for assistance with replacing the configuration. | [R76SP.50](https://support.checkpoint.com/results/sk/sk115735) | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | | Logs ||||| | MBS-2581, PMTR-64637 | All | Logs generated by Software Blades on Scalable Platforms, do not show the Group ID and SGM ID. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | * [R81.10](https://support.checkpoint.com/results/sk/sk173363), * [R81 (Take 42)](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm), * [R80.30SP (Take 73)](https://support.checkpoint.com/results/sk/sk165312), * [R80.20SP (Take 302)](https://support.checkpoint.com/results/sk/sk155832) | | Application Control ||||| | MBS-8969 | All | Security Group members do not synchronize the configuration file $FWDIR/appi/update/appi_parameters.C automatically. For more information, see [sk146993](https://support.checkpoint.com/results/sk/sk146993) - notes for Scalable Platforms. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | Mobile Access ||||| | MBS-14368 | All | The Mobile Access Portal Agent is not supported in R80.20SP and R80.30SP. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-16501 | All | Scalable Platforms do not support SAML for Mobile Access. | [R81](https://support.checkpoint.com/results/sk/sk169954) | [R81.20](https://support.checkpoint.com/results/sk/sk177624) | | MBS-8443 | Maestro | It is not supported to configure the IP address of the Security Group as the main URL of the Mobile Access Portal: In SmartConsole \> R80.30SP Security Gateway object \> Mobile Access \> Portal Settings \> Main URL. | [R80.30SP](https://support.checkpoint.com/results/sk/sk162552) | - | | ### Known Limitations - Monitoring {#KL_Monitoring_Features} ||||| | SNMP ||||| | MBS-3601 | All | The '`asg alert`' command does not support sending alerts in SMS. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | 01255170 | Chassis | For monitoring the 60000 / 40000 Scalable Platforms over the SNMP, the only supported OIDs are under `iso.org.dod.internet.private.enterprise.checkpoint.products.asg (OID 1.3.6.1.4.1.2620.1.48)`. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | 00630753 | Chassis | The '`snmpwalk`' or '`snmpget`' commands on OIDs that have prefixes with 1.3.6.1.4.1.2620.1.44.20 (`asgIPv4PerformanceCounters`) or 1.3.6.1.4.1.2620.1.44.21 (`asgIPv6PerformanceCounters`) display values calculated on the Active Chassis only. | [R76SP](https://support.checkpoint.com/results/sk/sk94686) | - | | MBS-13073 | Maestro | SNMP OIDs 1.3.6.1.4.1.2021.10 (CPU load average) are not supported on Maestro Orchestrator. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | | MBS-13867 | Maestro | The '`snmpwalk`' and '`snmpget`' commands executed for the IP address of the Security Group on OIDs that have prefixes other than 1.3.6.1.4.1.2620.1.44 or 1.3.6.1.4.1.2620.1.48 return information only for the current SMO Security Group Member. To get the same information from non-SMO Security Group Members, connect to the command line of each non-SMO Security Group Member and run the '`snmpwalk`' or '`snmpget`' command for the 'localhost'. | [R80.20SP](https://support.checkpoint.com/results/sk/sk140392) | - | {#SP_limitationTable} --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content