> Source: [sk155832](https://support.checkpoint.com/results/sk/sk155832) # sk155832 - Jumbo Hotfix Accumulator for R80.20SP | Property | Value | |----------|-------| | Solution ID | sk155832 | | Date Created | 2019-06-12 | | Last Modified | 2024-03-16 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R82.10, R82, R81.20 | | OS | Gaia | | Platform | 15000, 3000, 5000, 28000, 41000 (EOL), 44000, 64000, 16000, 26000, 6000 | ## Solution **Introduction \| Availability \| Important Notes \| Resolved Issues per Take \| Installation Instructions \| Replaced Files \| Revision History and Take Alignment** Introduction {#Introduction} ---------------------------- > R80.20SP Jumbo Hotfix Accumulator is an accumulation of stability and quality fixes resolving multiple issues for products running R80.20SP. > > This Incremental Hotfix and article are updated periodically with new fixes. > > The list of resolved issues below describes each resolved issue and provides the Take number in which the fix was included. A resolved issue is included in the Incremental Hotfix starting from the Take number listed in this table (inclusive). The date on which this take was made available is listed near the Take's number. > > **Important: Upgrade of the CPUSE Agent is not supported on R80.20SP version for chassis and Maestro products.** Availability {#Availability} ---------------------------- ### **Recommended Take:** > |------------------------------------|--------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | **Product** | **Take** | **Date** | **CPUSE Offline Package** | > | **Orchestrator MHO-140 / MHO-170** | Take_336 | 23 Jan 2023 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=126651) (TGZ) | > | **Orchestrator MHO-175** | Take_9**\*** | 05 Dec 2021 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=114249) (TGZ) | > | **Maestro Security Group** | Take_336 | 23 Jan 2023 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=126652) (TGZ) | > | **Chassis Security Group** | Take_336 | 23 Jan 2023 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=126652) (TGZ) | > >
> > **\*** Take_9 is based on Take_310 of MHO-140/MHO-170, with the same content. Take_6 is a special take for MHO-175 only. It must be installed on MHO-175 GA and cannot be used with MHO-140, MHO-170, or Security Groups. It also includes support for CPUSE upgrade to R81.10. Important Notes {#Important Notes} ---------------------------------- * Each of the Jumbo Hotfix Accumulator Takes is based on Check Point R80.20SP. * This Jumbo Hotfix Accumulator must be installed only after the successful completion of the Gaia First Time Configuration Wizard and a reboot. * For Security Group installation: You must run all CPUSE commands only in the Global gClish (*gclish* ) shell only. * To check the Take number of the **currently** installed R80.20SP Jumbo Hotfix Accumulator (if it is installed), run the "*asg_provision*" command in the Expert mode and refer to the last section of the output. Resolved Issues per Take {#List of resolved issues per Take} ------------------------------------------------------------ > Enter the string to filter the below table: > > |--------------------------------|----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | ID | Product(s) | Description | > | Take 336 (23 January 2023) ||| > | MBS-16351, MBS-6399 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 230 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-16137, PRHF-25720 | General | The Chassis ID and Blade ID fields ("`asgTrapChassisID`" and `asgTrapBladeID`" ) in SNMP threshold events are empty. Refer to [sk179926](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179926). | > | MBS-16473, PMTR-86488 | General | When NAT is configured on the Source IP and the Destination IP, out-of-state drops may occur. | > | MBS-16432, PMTR-85516 | General | **Enhancement** : Add `pre_upgrade_verifier` to the `sp_upgrade` script with this command: `sp_upgrade --verify` | > | MBS-16343, PMTR-88702 | Maestro Gateway | In a rare scenario, the "sp_upgrade" script might not detect that the Maestro Security Group runs in the VSX mode. As a result, the upgrade of the Security Group to a higher version might fail. | > | Take 335 (16 November 2022) ||| > | MBS-15920, MBS-6399 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 220 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-15064, MBS-14488 | General | All Security Group Members but the SMO may go into the "Down" state after an Anti-Malware policy installation fails. Refer to [sk177607](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk177607). | > | MBS-15927, PMTR-77523 | General | The "Obtain IPv4 Address Automatically" option in the **IPv4** and **IPv6** tabs of the Gaia Portal's interface editor is disabled (as it is on gClish). | > | MBS-16074, PRJ-29955 | General | The "`asg perf --delay`" command does not change the "refresh time" on the screen. | > | MBS-14684, MBS-14468 | General | The output of the "`asg perf -6`" command shows "*IPV6 is Disabled*". | > | MBS-15939, PRHF-24453 | General | When you run the "`set kernel-routes on/off`" and "`set domainname `" commands through gCLish, the configuration is applied locally. | > | MBS-15850, PMTR-82241 | Maestro Gateway | The Security Group does not synchronize to Security Group Members the configuration of a Bond interface in LACP mode on shared interfaces when you configure this Bond interface in Gaia Portal. Configuration made in Gaia gClish is synchronized as expected. | > | MBS-15749, PMTR-83873 | Maestro Gateway | CPUSE upgrade packages are not available when working in "High Availability over Load Sharing" mode with VPN enabled. | > | MBS-15957, PRJ-40885 | Maestro Orchestrator | The HealthCheck Point (HCP) "Daemons state" test may fail if you do not maximize the SSH client window. | > | MBS-15449, PMTR-81227 | Maestro Orchestrator | The outputs of the "`top`" and "`ps -aux`" commands show "lldpd" and "snmp_trap_sender" as zombie processes. | > | Take 334 (06 July 2022) ||| > | MBS-15471, MBS-6399 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 211 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-15615, PRHF-22250 | General | OSPF installs a route to the incorrect IP when it is configured as P2P. Refer to [sk177686](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk177686). | > | MBS-15611 | General | The *routed* process unexpectedly exits when OSPF is configured as P2P. | > | MBS-15431, PRHF-22789 | General | "asg_copy_capture" logs repeatedly appear in the *var/log/messages* file. The reason given in the logs is "*capture file was not found on remote SGMs*". | > | MBS-15448, MBS-12143 | General | Static routes with the "ping" option enabled (to ping the next hop Gateways) do not appear on some Security Group Members. | > | MBS-15239 | Maestro Orchestrator | When you change the number of Orchestrators from 2 to 1 through the CLI, packet loss can occur because of an outdated LSP state. | > | Take 332 (20 April 2022) ||| > | MBS-15650 | Maestro (Orchestrator) | Packet loss may occur when: * A Maestro Orchestrator that is installed with R80.20SP Take 331 reboots * The user runs "`orchd restart`" or "`orchd stop`" on a Maestro Orchestrator that is installed with R80.20SP Take 331 | > | Take 331 (29 March 2022) ||| > | MBS-7740 | General | Improved the stability of the Gaia Backup / Restore feature. | > | MBS-15078, MBS-15075 | General | When the user runs the "*reconfigure_snmp_alerts* " script with the "`/usr/scripts/reconfigure_snmp_alerts`" command, the script does not correctly parse authentication passwords that include a "`>`" character. | > | MBS-14570 | General | After a Jumbo Hotfix uninstallation, the CCP propagates "admin_down" to other Security Groups. | > | MBS-15176, PRHF-21133 | General | Security Group may drop traffic during an internal failover between Security Group members when Dynamic Anti-Spoofing is enabled. | > | MBS-15029 | General | When the user connects more than one cluster to the same network segment (see [sk25977](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25977)), port flapping can occur because two different cluster members have the same correction MAC address. | > | MBS-15238 | General | After a Jumbo Hotfix Accumulator installation, the Rule Base Hit Count does not work correctly because the value of the 'HitCountLogPort' variable is overridden by a different value on the SMO. | > | MBS-15068, MBS-15063 | General | Changing the VLAN ID of an existing interface might cause a traffic interruption. See [sk176929](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk176929). | > | MBS-15115 PMTR-65248 | Maestro Gateway | "*sgm_pmd* " and "*lb_configd* " errors may appear in */var/log/messages* during boot process. | > | MBS-15145 PMTR-71033 | Maestro (Orchestrator) | **Enhancement**: Improved the stability of the Security Groups' topology apply process. | > | MBS-13101 PMTR-63357 | Maestro (Orchestrator) | Improved the stability of the Link State Propagation (LSP) mechanism. | > | MBS-15401 | Maestro (Orchestrator) | The Message of the Day (MOTD) is not updated correctly on the Maestro Hyperscale Orchestrator (MHO). | > | MBS-15060 PMTR-73959 | Maestro (Orchestrator) | IPv6 packets with a flow label field may be dropped as "*First packet isn't SYN*". | > | MBS-15111 MBS-14133 | Maestro (Gateway and Orchestrator) | In some scenarios, link flapping on a Maestro Gateway may cause an unexpected site failover, cluster state flapping on the other Gateways, or packet drops. | > | Take 328 (3 February 2022) ||| > | MBS-15207, MBS-6399 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 205 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | Take 327 (9 January 2022) ||| > | MBS-6399 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 203 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-14601 | General | TCP connection drops 60 min after a failover in the Security Group on Scalable Chassis / Maestro. See [sk172887](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172887). | > | PRHF-19991 | General | ADLOG stops working during policy installation. | > | MBS-14937 | General | In VSLS mode, you cannot configure the Security Group to forward specific inbound connections to the SMO. Note - For instructions, see the Maestro Administration Guide / Scalable Chassis Administration Guide for your version. | > | MBS-14105 | General | Security Group Members may drop internal connections over the sync interface because the kernel table "`cluster_members_ips`" is empty. | > | MBS-15008 | General | During the upgrade from R80.20SP to R81.10, a Security Group Member might change its state from ACTIVE to READY. | > | MBS-15055 | General | In a rare scenario, the CPD process may crash during policy installation. The issue occurs from Take 317 of the R80.20SP Jumbo Hotfix Accumulator. | > | MBS-14635 | General | The "`ip_block`" command now supports the `#` character in the feed file and ignores the lines that start with this character. | > | PMTR-68940 | General | The configuration of ISP Redundancy Links made with the "`fw isp_link ` down" command is not included in the main configuration that non-SMO Security Group Members pull from the SMO Security Group Member. | > | MBS-14732 | Chassis | The CMM is not updated with the time from a configured NTP server. As a result, SGMs stay in the Down state for a long time. | > | PMTR-76352 | Chassis | The clock verifier test (`clock_verifier -v`) does not work. | > | MBS-15012 | Chassis (Multiple Security Groups) | **Enhancement**: Added support for LACP Management Aggregation (MAGG) interfaces with Multiple Security Groups. | > | MBS-14669 | Maestro (Orchestrator) | **Enhancement** : New Gaia Clish command to disable port auto-negotiation on the Maestro Orchestrator: `set maestro port auto-negotiation disabled` | > | MBS-14962 | Maestro (Orchestrator) | **Enhancement** : The Maestro Orchestrator will read the IP address range for CIN interfaces from the *smodb.json* database. | > | MBS-14876 | Maestro (Orchestrator) | **Enhancement** : Added the HealthCheck Point (HCP) test to the Maestro Orchestrator. HCP validates the integrity of all of the Maestro Orchestrator's port links. | > | MBS-15012 | Maestro (Orchestrator) | The "`set maestro port admin-state `" command changes the port state on the remote MHO. With this fix, the command changes the port state only on the local MHO. | > | MBS-14479 | Maestro (Orchestrator) | In some scenarios, the port speed might change after the user reboots the Maestro Orchestrator or restarts the Maestro Orchestrator's daemons with the "`orchd restard`" command. | > | Take 326 (18 October 2021) ||| > | MBS-12953 | General | A new user that is added in the Gaia Portal of the Security Group receives a different password hash for each member of the Security Group. | > | MBS-14011 | General | DHCP Office Mode fails with "`failed to correct the packet to member=xx`". | > | PMTR-53642 | General | These error messages appear again and again in the *dmesg* and *var/log/messages* files: `May 13 13:12:54 2020 Setup3_5800_255_14 kernel: [SIM4];[snd];resume_packet: invalid in_corr_info => dropping packet, in_corr_info(sxl_dev_id:32, flags:0x0, pkt_flags:0x0), pkt_type:VM Reinject, next_state:Stateless checks, pkt:ffff880220824ec0, ifn:10, vsid:0, instance:-1, caller:resume_inbound_from_vm_reinject` | > | MBS-14572 | Chassis | Added support for 40G SFP transceiver for SSM160 (BTI40GSRDDQSFP). | > | MBS-14167 | Chassis | The BMAC address is not updated after moving an SGM from one slot to a different slot. (The issue applies to Security Gateway only, not to VSX.) | > | SPC-1602 | Chassis | In a rare scenario, the SSM may encounter an issue and stop working. | > | MBS-13580 | Chassis | A traffic outage occurs when removing a slave interface from a bond interface | > | MBS-13262 | Chassis (Multiple Security Groups) | **Enhancement**: In a Multiple Security Group (MSG) environment, each bond in the shared bond LACP mechanism now has the VMAC octet, rather than the global VMAC, as its Security Group MAC Magic. | > | MBS-14024 | Chassis (Multiple Security Groups) | In a Multiple Security Group (MSG) environment, SSM updates occur on both chassis. With this fix, the SSM updates will occur on the applicable chassis only. | > | MBS-14185 | Chassis (Multiple Security Groups) | In a Multiple Security Group (MSG) environment, different Security Gateways reject packets after a policy push on newly created VSs. | > | MBS-14195 | Chassis (Multiple Security Groups) | In a Multiple Security Group (MSG) environment, the *Toggle_kern_params* script runs in an endless loop. | > | MBS-14518 | Maestro (Gateway) | "`Updating SSMs amount`" message appears repeatedly in the */var/log/ports* file. | > | PMTR-71771 | Maestro (Orchestrator) | The Maestro Orchestrator's SDK API might stop responding (for example, when there are many periodic SNMP queries). | > | PMTR-71536 | Maestro (Orchestrator) | In a rare scenario, if the *lldp* daemon is restarted on the Maestro Orchestrator, it can lead to communication issues between the Gateways and the Orchestrator. | > | MBS-14503 | Maestro (Orchestrator) | When upgrading the Orchestrator with CPUSE from R80.20SP to R81.10, the Deployment Agent is not upgraded. | > | MBS-10506 | Maestro (Orchestrator) | If a Bond interface that is assigned to a Security Group is configured in the 802.3AD (LACP) mode, packet loss might occur on a Security Appliance when the Security Appliance regains connectivity to the Orchestrators. | > | Take 317 (Released 16 August 2021, GA from 18 October 2021) ||| > | MBS-14098 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 202 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-13989 | General | **Enhancement:** The data for "Throughput" and "Packet rate" in the output of the "asg perf" command were aligned with the CPView tool. | > | MBS-14077 | Chassis | **Enhancement:** Removed double logging of Global Clish (gclish) commands when "audit-log" is enabled. | > | MBS-14234 | General | Using Static NAT for the destination in asymmetric connections may lead to Out of State traffic drops. | > | MBS-8488 | General | In some scenarios, the fw_full core dump file is created randomly on Quantum Scalable Chassis and Quantum Maestro appliances. | > | MBS-9585 | General | * Output of the "`asg monitor`" command shows that the state of a Security Group Member is "DOWN". * Output of the "`cphaprob list`" command shows that the Critical Device "Policy" reports its state as "`problem`" on the Security Group Member. * Output of the "`asg_policy verify -a`" command shows "`Failed`" in the "Status" column for the Security Group Member. * Output of the "`asg_policy verify -a`" command shows "`Policy date is lower than max policy date`" in the "Summary" section for the Security Group Member. | > | MBS-14160 | General | A memory leak may occur when the Security Group fails to correct the packet. | > | MBS-14085 | Chassis | The */var/log/messages* file contains these errors: * `kernel: pif_create_if: error: failed to register interface eth1-Mgmt! (register_netdev() rc is -17)` * `kernel: pif_create_if: error: failed to register interface eth1-CIN! (register_netdev() rc is -17).` * `bfm_create_remote_ifs: error: failed to create pseudo interface!` | > | MBS-14079 | Maestro | When running the "`snmpwalk`" command on the Maestro Orchestrator, these errors about QSFP ports appear in the */var/log/messages* file: * `mhostatagent_get_port_cnt_data> Failed execute cmd tor_util stats port XX tx errs` * `mhostatagent_get_port_label_data> port XX seems not available` * `mhostatagent_get_portLinkState_data> Failed execute cmd tor_util get_port_link_state XX` | > | MBS-14108 | SNMP | The MIB file *$CPDIR/lib/snmp/chkpnt.mib* fails MIB validation tests in the SNMP tree OID .1.3.6.1.4.1.2620.1.48.0 (asg). | > | MBS-14165 | SNMP | SNMP OID .1.3.6.1.4.1.2620.1.48.16 (asgSecureXLStatusBitmask) always returns the status of SecureXL as enabled, even when it is not. | > | MBS-14076 | CoreXL | Improved the stability of the "`asg perf`" command when all CPU cores are equally assigned to CoreXL Firewall instances and CoreXL SND instances. | > | MBS-11293 | Identity Awareness | Improved stability in these scenarios on the Security Group: * Multiple Identity Collectors in redundancy mode * Multiple Identity Sharing connections | > | Take 315 (31 May 2021) ||| > | MBS-14025 | General | **Enhancement** : Disable the experimental daemon *cpview_collectd* at any time. | > | MBS-13922 | General | "`Quitting due to time-out`" message appears during JHF installation process on CPUSE. | > | MBS-13981 | General | If a connection is not symmetrical, the first packet drop is not an SYN/rule base drop. | > | MBS-13906 | Chassis | In some scenarios, a failure report is not collected fully if an SSM fails. | > | MBS-14041 | Chassis (Multiple Security Groups) | In a Multiple Security Group (MSG) environment, VSLS commands do not take effect. | > | Take 314 (02 May 2021) ||| > | MBS-13573 | General | **Enhancement**: New parameters for SNMP traps sent from Security Group Members. The parameters show the chassis ID and the blade ID of the member that sent the SNMP trap. | > | MBS-12620 | General | Rule base Hit Count is not updated by R80.20SP Virtual Systems (VSs). Refer to [sk170675](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170675). | > | MBS-7805 | General | After adding a slave interface to a Bond interface, the output of the "*asg diag*" command shows that the "Distribution Mode" test failed because of an issue with the slave interface. | > | MBS-9650 | General | 1. Output of the "*asg perf -p* " command shows that the "*Throughput* " is 0 in the "*Firewall*" column. 2. Output of the "*asg perf -v* " command shows the "*Throughput*" value is lower than expected (the F2F traffic is missing). 3. SNMP Query for OID .1.3.6.1.4.1.2620.1.48.20.1.0 (*asgThroughput*) returns a value lower than expected (the F2F traffic is missing). | > | MBS-12597 | General | The "`asg perf`" command does not appear, or shows "`0`" values for "Throughput" and "Packet rate". Refer to [sk174908](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk174908). | > | MBS-13440 | General | ICMP error packets may not be forwarded correctly if the generating device is not in the encryption domain. | > | MBS-13343 | General | When the user attempts to download an original attachment file that was extracted by Threat Extraction, the original file is downloaded with a size of 0KB if the file name contains spaces. | > | MBS-13463 | Chassis | Limited the maximum configured MTU value to 9000 on SSM440 to prevent traffic issues. | > | MBS-13450 | Chassis | Some Management and CIN interfaces share MAC addresses (for example, eth1-CIN, eth1-Mgmt1, eth1-Mgmt2). This means that the interfaces share IPv6 link-local addresses, as IPv6 link-local addresses are derived from MAC addresses. In some scenarios, this might cause duplicated link-local addresses on the interfaces. This fix updates the link-local addresses for the CIN and MGMT interfaces so that interfaces that share a MAC address do not share a link-local address. | > | MBS-8858 | Maestro (Gateway) | Improved the Distribution Mode configuration for Bridge slave interfaces - each slave interface has a different Distribution Mode. | > | MBS-13593 | Maestro (Gateway) | In a Dual Site environment: if one Site-Sync port link state is down and there is no active Gateway on site X, then when the first Gateway on site X boots, it may fail to become active. | > | Take 313 (31 March 2021, GA from 6 July 2021) ||| > | MBS-13347 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 190 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-10509 | General | **Enhancement** : * Added the "--max-file-size" flag to only collect files with a size smaller than N-Megabytes (by default, files smaller than 100MB will be collected). * After collecting all the files, CPSDC now prints the collected data size and its compressed size. * Added the file *cpsdc_skipped_items.txt* to the output archive that contains the skipped items and the reason for their being skipped. | > | MBS-13496 | General | After an upgrade to R80.20SP Take 310, Check Point Support Data Collector (CPSDC) does not create a symbolic link to the executable. | > | MBS-13282 | General | The */var/log/send_alert\** files repeatedly show this message for different interfaces: "`Site eth- link is up`". | > | MBS-13474 | General | In rare scenarios, the command` hw_utilization -d `fails when more than 9 Virtual Systems are configured. | > | MBS-13362 | General | While in the MDPS data plane (`set mdps environment dplane`), login from Gaia Clish to the Expert mode fails with "Wrong password" if the user is authenticated by a RADIUS server. | > | MBS-13202 | General | OIDs 1.3.6.1.4.1.2620.1.48.20.5 and 1.3.6.1.4.1.2620.1.48.21.5 are not supported. They have been removed from the *chckpnt.mib* file. | > | MBS-13032 | General | Resolved high memory consumption by the *cpview_collectd* process. | > | MBS-13344 | General | The local logging test will no longer run on the "asg_perf_hogs" utility, as it has its own HCP (HealthCheck Point test). | > | MBS-13477 | General | When a cluster admin is down or a member is rebooted, some packet loss may occur. | > | MBS-14222 | General | **Enhancement** : Added support for PIM. Known Limitations: * PIM all modes - Supported only with IGMP snooping disabled. * PIM Dense mode - Supported. * PIM Sparse mode - Supported only when the Security Group is configured as a downstream Rendezvous Point (RP). * PIM SSM mode - Not supported. | > | MBS-13362 | Maestro (Orchestrator) | **Enhancement** : Support for Link State Propagation (LSP) groups of Orchestrator ports. LSP binds Orchestrator ports together to work as a single logical port. * If one of the bound Orchestrator ports in the LSP group goes down, then the Orchestrator changes the state of all ports in the LSP group to "down". * If all the bound Orchestrator ports in the LSP group go up, then the Orchestrator changes the state of all ports in the LSP group to "up". For more information, see [sk172613](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172613). | > | MBS-13304 | Maestro (Orchestrator) | Added support for the SNMP sysOID .1.3.6.1.2.1.1.2.0 for Maestro Orchestrators. | > | MBS-13327 | Maestro (Orchestrator) | Added the ability to upgrade R80.20SP to R81.10 with the CPUSE upgrade package. | > | Take 310 (28 January 2021, GA from 31 March 2021) ||| > | MBS-12976 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 188 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-12809 | General | **Enhancement** : Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)). Changed the name of the **`cpdata_collector_sp`** command to **cpdata_collector**. | > | MBS-11351 | General | VPN Site-to-Site tunnel fails to establish when several interfaces with the Topology "External" are configured in the Security Gateway object. | > | MBS-12714, MBS-12883 | General | Remote Access client using the Visitor Mode, or connecting to a Mobile Access Portal, may disconnect several seconds after it connected. | > | MBS-12356 | General | If the "Chassis HA mode" is configured as "VSLS", the SNMP query for the OID "asgChassisParamsMaxGrade" (.1.3.6.1.4.1.2620.1.48.28.4.1.5) returns a wrong value. | > | MBS-12834 | General | The `asg diag` command shows that the "Licenses" test fails with the reason "`Licenses differ across blades`". The "asg_licenses_verifier -v" tool shows the error "`Differerent licenses are installed across blades`". | > | MBS-13054 | Chassis Multiple Security Groups (MSG) | A bond in the 802.3AD (LACP) mode that is shared between several Security Groups stops working because of duplicate LACP replies it sends to a connected switch. The connected switch shuts down the LACP because of duplicate replies (in Security Groups, a non-LACP task member sends replies in addition to the LACP task member). | > | MBS-12719 | Chassis Multiple Security Groups (MSG) | On chassis with Multiple Security Groups configured, added support for sending global commands to Security Members in all Security Groups. Syntax in Expert mode: `sgrm global_conf -a run_global_cmd -v ` | > | Take 309 (3 January 2021, GA from 28 January 2021) ||| > | MBS-12752, MBS-12941 | General | **Enhancement** : Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)). The new flag "last-modification-day" collects files that were modified in the last N days. By default, the CPSDC collects files that were modified in the last 7 days. | > | MBS-12843 | General | **Enhancement** : Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)) to collect additional files: * `/var/log/asg_diag_last_run.txt` * `/var/log/ssm_failure_reports/*` | > | MBS-12637 | General | **Enhancement** : Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)) to collect additional files: * `/etc/sgdb.json` * `/etc/distutil.conf` * `/var/log/sgrmd.elg` * `/var/log/resource_manager.elg` * `/proc/net/bonding` | > | MBS-12835 | Chassis | The SSM Allow Management Loss feature ([sk145792](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145792)) sends alerts even if a failure event's duration is short. Now the feature sends alerts only if a failure event's duration is long (30 seconds by default). | > | MBS-12230 | General | **Enhancement:** Ability to configure SNMP Traps in Gaia gClish. For more information and configuration instructions, see [sk171394](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171394). | > | MBS-12810, MBS-12952 | Maestro | **Enhancement:** Ability to send SNMP v2 / v3 traps for changes in port statuses on Maestro Orchestrator. New commands in Gaia Clish on Maestro Orchestrator: **To enable / disable the feature** : `set maestro snmp traps port-state {on | off}` **To add an SNMP Trap Sink** : `add snmp traps receiver version {v2 | v3} community ` | > | MBS-12738 | Maestro | Added support for Orchestrator Hardware Health Monitoring (resolves Known Limitation [MBS-5205](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk148074)). To monitor, use any of these: * Gaia Portal (Maintenance \> Hardware Health Monitoring) * The `show sysenv all` command in Gaia Clish * The `cpstat `command in Gaia Clish or Expert mode * `cpstat os --f sensors` * `cpstat os --f power_supply` * SNMP "Get" requests for the supported sensors * V2 and V3 * SNMP Traps for the supported sensors * V2 and V3 Supported hardware sensors: * Fan speeds: * 8 Fans on MHO-140 * 4 Fans on MHO-170 * Voltages: * 3 sensors for the first UCD regulator * 2 sensors for the second UCD regulator * Temperatures: * ASIC * CPU cores (3 on MHO-140 and 4 on MHO-170) * Power regulators (4 sensors - 2 per each UCD regulator) * System/ambient (2 sensors) * Power Supply status (2 PSUs) SNMP Notes: * SNMP GET and TRAP reuse same OIDs that are used for regular Security Gateway. * Example: for SNMP GET these are under iso.org.dod.internet.private.enterprise.checkpoint.products.s vn.svnPerf * SNMP trap behavior is like SGW behavior. Traps are periodically sent for failed sensors until it is recovered. | > | Take 306 (21 December 2020) ||| > | MBS-12788 | Maestro | In some scenarios, after rebooting several Security Group Members at the same time, the Security Group Members can boot up with a cluster state of LOST, READY, or DOWN. or may fail to communicate with one of the Orchestrators. **To resolve in R80.20SP Jumbo Hotfix Accumulator Takes 304/305:** Restart the `ssm_pmd` daemon on each one of the Maestro Orchestrators with these commands in the Expert mode: `[Expert@ORCH:0]# tellpm process:ssm_pmd ; tellpm process:ssm_pmd t` **Important Note** : This fix is part of the Orchestrator JHF. You do not need to install Take 306 on the Security Gateway to resolve this issue. You need to install it only on the Orchestrator. | > | Take 305 (1 December 2020) ||| > | MBS-12430 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 183 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-12561 | General | **Enhancement** : Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)) to run 5 threads by default (instead of 20 threads). To change the number of the running threads, change the value of the "check max_threads_amount" parameter in the configuration file "*/etc/cpsdc/conf/cpsdc_conf.json*". | > | MBS-11960, MBS-4866, MBS-12653 | General | **Enhancement** : Added support for ISP Redundancy. Note: If you enabled the ISP Redundancy in the Security Gateway object and you downgrade from the Jumbo Hotfix Accumulator to a Take lower than Take 305, the system may be stuck in the DOWN state: The output of the `asg monitor` command shows the state DOWN. The output of the `cphaprob stat` command shows that the Critical Device "Configuration" reports its state as "Problem". **To avoid this issue** : Before you downgrade from the Jumbo Hotfix Accumulator, you must disable the ISP Redundancy in the Security Gateway object in SmartConsole. **To resolve this issue** : Contact [Check Point Support.](https://www.checkpoint.com/support-services/contact-support/) | > | MBS-12525 | General | The output of the "`ps -aef | grep [d]efunc`" command shows multiple zombie processes "`[sh] `". The issue occurs after a reboot or policy installation. | > | MBS-11506 | General | The Check Point Support Data Collector "cpdata_collector_sp" (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)) fails with the "`Failed to open /etc/cpsdc/conf/cpsdc_logger.json`" error. See [sk168713](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168713). | > | MBS-12375 | General | Commands in Gaia gClish fail with: `CLINFR0739 error in command execution; see "/var/log/messages"` The */var/log/messages* file shows: `clish[]: timeout on read from all remote nodes; connections lost` Refer to [sk170301](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170301). | > | MBS-12532 | Maestro | The "`add maestro security-group id interface`(press the TAB key)" command on an Orchestrator shows VLAN interfaces in the list of available interfaces. | > | Take 304 (2 November 2020, GA from 1 December 2020) ||| > | MBS-11953 | General | Added support for the Threat Extraction Software Blade in VSX mode. | > | MBS-12216 | General | Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)) not to collect unnecessary log files. | > | MBS-12217 | General | Updated the Check Point Support Data Collector (CPSDC, see [sk164414](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164414)): * By default, the CPSDC scripts collect the data from Security Group Members that are in the UP state and those that are in the DOWN state. * Added a new flag "exclude-down" to collect the data only from Security Group Members that are in the UP state. * Removed the "include-down" flag. | > | MBS-11956 | General | These Gaia gClish commands do not take effect on all Security Group Members: * `set user password-hash` * `set user force-password-change` | > | MBS-12280 | General | If the IPSec Software Blade is disabled, this message appears repeatedly in the */var/log/messages* file: `fwhandle_get(fwvpn.c:4288): Table kbufs - Invalid handle XXX (bad pool)`. | > | MBS-12362 | Chassis \& Maestro | The CPD daemon consumes CPU at 100%. To resolve this issue, the SNMP OID 'asgVSXDropTable' (1.3.6.1.4.1.2620.1.48.30.110) was removed from the *$CPDIR/lib/snmp/chkpnt.mib* file. As a result, it is no longer possible to get information over SNMP about dropped packets by Virtual Systems. This issue applies to: * VSX mode * R80.20SP Jumbo Hotfix Accumulator Take 302 | > | MBS-6084 | Chassis \& Maestro | To support asymmetric connections, it is necessary to enable the cluster synchronization in the corresponding service's properties (**Advanced** pane \> in the **Cluster and synchronization** section, select **Synchronize connections if Synchronization is enabled on the cluster**\> install policy). | > | MBS-6525, MBS-12150 | Chassis | In a rare scenario, under a heavy load on the CPU cores that run SecureXL on SGM400, a traffic outage can occur when the i40e driver becomes unresponsive and resets itself (see [sk170002](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170002)). | > | MBS-10924 | Maestro | **Major enhancement** for configuration of VLAN interfaces on Maestro Orchestrators. See [sk170294](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170294). | > | MBS-11899 | Maestro | Reduced the memory consumption on Maestro Orchestrators. | > | MBS-12314 | Maestro | It is now possible to add these Check Point Appliance models to the same Security Group: * 26000 Turbo and 28000 Plus * 6900 Turbo and 7000 Plus **Important Note**: All the Security Appliances assigned to the same Security Group must have identical Memory size and Hard Disk size. | > | Take 302 (05 October 2020) ||| > | MBS-11443 | General | The "*config_verify -v* " command shows "`Performing xfer files verification... Failed!`" because the */etc/smo_uptime* files are not identical on all Security Group members. | > | MBS-11780 | General | The Gaia gClish command "*add backup-scheduled name \ local* " fails with "`Segmentation fault (core dumped`)". See [sk168913](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168913). | > | MBS-11892 | General | Non-SMO members of a Security Group can enter a reboot loop after the user installs Take 295 of the R80.20SP Jumbo Hotfix Accumulator. See [sk169515](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169515). | > | MBS-10748 | General | Added support for the new SNMP OID 1.3.6.1.4.1.2620.1.48.20.27.4: Total number (from all cluster members) of packets dropped by a security policy on the Security Gateway or specified VSX Virtual System. **Note** : You must use SNMP v3 in the VS mode as described in [sk90860](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90860). | > | MBS-10123 | General | Added support for the new SNMP OIDs to get performance statistics from VSX Virtual Systems. **Configuration in expert mode** : 1. Run: *g_all* "*vsx resctrl monitor enable*" 2. Run: *g_all* "*vsx mstat enable*" 3. Run: *g_all* "*reboot*" **Configuration in Gaia gClish** : 4. Configure SNMP v3 in the VS mode as described in [sk90860](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90860). **SNMP OIDs - statistics from the specified Virtual System, statistics from each cluster member** : * Number of concurrent connections - 1.3.6.1.4.1.2620.1.48.30.30.10.1.\* * Physical memory - 1.3.6.1.4.1.2620.1.48.30.40.10.1.\* * CPU usage - 1.3.6.1.4.1.2620.1.48.30.50.10.1.\* * Packet rate - 1.3.6.1.4.1.2620.1.48.30.80.10.1.\* * Throughput - 1.3.6.1.4.1.2620.1.48.30.90.10.1.\* * Interface packet rate - 1.3.6.1.4.1.2620.1.48.30.100.10.1.\* * Total number of dropped packets - 1.3.6.1.4.1.2620.1.48.30.110.10.1.\* * Connection rate - 1.3.6.1.4.1.2620.1.48.30.120.10.1.\* * Virtual memory - 1.3.6.1.4.1.2620.1.48.30.130.10.1.\* **SNMP OIDs - statistics from the specified Virtual System, total statistics from all cluster members** : * Total number of concurrent connections - 1.3.6.1.4.1.2620.1.48.30.30.20 * Total packet rate - 1.3.6.1.4.1.2620.1.48.30.80.20 * Total throughput - 1.3.6.1.4.1.2620.1.48.30.90.20 * Total number of dropped packets - 1.3.6.1.4.1.2620.1.48.30.110.20 * Total connection rate - 1.3.6.1.4.1.2620.1.48.30.120.20 | > | MBS-11765 | General | Gaia users other than the 'admin' cannot use SCP to connect to a Security Group Member, even if the default shell '/bin/bash' and the 'admin' role are configured. | > | MBS-11674 | General | Fetching packet capture from a violation log in SmartConsole fails with the error "`Failed at getting the incident file from the gateway`". | > | MBS-11806 | General | On VSX Cluster Members, the last octet of the MAC address on WRP interfaces is wrongly set based on the Global VMAC instead of the MAC Magic value. | > | MBS-12049 | General | Security Group member reboots in a loop after installing R80.20SP JHF Take 295, if IPv6 was enabled. * This issue applies to Take 295 released before 30 September 2020. * Take 295 released on 30 September 2020 resolves this issue. | > | MBS-11764 | General | The output of the "*show smo verifiers*" command shows that the "ARP Consistency" test fails. This issue was caused by an unused padding in the kernel table 'arp_table'. | > | MBS-11821 | General | The output of "*asg diag* " shows that a test failed because the *$CPDIR/conf/skip_interfaces.conf* file is not identical on Security Group Members. See [sk169873](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169873). | > | MBS-11367 | General | In rare cases, a Security Group member can crash (with the message "`Entering kdb`") during the installation of the R80.20SP Jumbo Hotfix Accumulator. | > | MBS-12001 | General | On VSX Cluster Members, VMAC address is set on WRP interfaces in the Decimal format instead of the Hexadecimal format. | > | MBS-9767 | General | VPN IKE packets are forwarded to a Security Group member even after its state changes to "Down". | > | MBS-10768 | General | The output of the "*asg diag verify* " command shows that the Proxy ARP test fails because the*local.arp* files are not consistent on Security Group Members. | > | MBS-4414 | General | While a Security Group member reboots, some existing connections can fail on the Security Group. See [sk169765](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169765), | > | MBS-2581 | General | Logs generated by Software Blades on Scalable Platforms, do not show the Group ID and SGM ID. | > | MBS-11831 | General | After installing Take 295 of the R80.20SP Jumbo Hotfix Accumulator, Gaia Clish commands for Dynamic Routing fail with these errors (see [sk169232](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169232)): * `RTGRTG0019 source_tclfile(rtgmisc.tcl)` * `RTGRTG0019 tclproc: invalid command name ` | > | MBS-11227 | Chassis | Scalable Platform automatically collects statistics and data in the */var/log/ssm_failure_reports/* directory in these cases: * An SSM enters the management loss state (see [sk145792](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145792)). * An SSM goes down. | > | MBS-11777 | Chassis | If the kernel parameters 'fw_reject_non_syn' and 'fw_reject_out_of_state_syn_resp' are enabled, and an administrator makes changes in SSM configuration (for example, adding a new interface to a Security Group), then Security Group Members can flood the chassis with reject packets. | > | MBS-10744 | Maestro | The "*show maestro port X/Y/Z optic-info* " command incorrectly returns "`Not supported`" for Check Point supported transceivers. | > | MBS-11844 | Maestro | In a Dual Site deployment, when one of the Maestro Orchestrators boots up on one of the sites, both sites might become active for a short time. | > | MBS-11611 | Maestro | The REST API server may remain down on the Maestro Orchestrator if it was forcefully unplugged from the electricity. | > | MBS-11847 | Maestro | It is now possible to add 16000 Turbo and 16200 Plus Security Appliance models to the same Security Group. **Note**: All Security Appliances within the same Security Group must have an identical Memory size and HD size. | > | PRJ-10396, MBS-12023 | Maestro | In some scenarios, transmit queues may stop, causing packet loss. Applies to these Line Cards on Security Appliances: * 40 GbE Fiber card (CPAC-2-40F-B) * 100 GbE Fiber card (CPAC-2-100/25F-B) | > | MBS-11728 | Maestro (Orchestrator) | If the user upgrades the Maestro Hyperscale Orchestrator (MHO) from R80.20SP Jumbo Hotfix Take 295 or older to a new Take, the upgrade may have an effect on traffic because "*orchd stop* " was not done at the start of the Jumbo Hotfix installation process." Refer to [sk173686](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173686). | > | Take 295 (19 August 2020, GA from 30 September 2020) ||| > | MBS-11071 | General | Aligned the R80.20SP Jumbo Hotfix Accumulator with Take 161 of the R80.20 Jumbo Hotfix Accumulator (see [sk137592](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592)). | > | MBS-11633 | General | UserCheck Portal does not work on a VSX Gateway after the user installs the R80.20SP Jumbo Hotfix Accumulator. This applies to Take 279 to Take 283 (see [sk168754](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168754)). | > | MBS-10095 | General | VPN outage when a Check Point Security Gateway renegotiates IPsec with a 3rd party VPN peer. | > | MBS-10263 | General | Clear packets that should be encrypted are not forwarded between Security Group members from interfaces whose MAC addresses start with the hexadecimal digits 02 (example: 02:AB:CD:EF:12:34). | > | MBS-11388 | General | The '*asg diag*' command does not add failed tests to the Message Of The Day (MOTD) if the names of these failed tests contain a hyphen (for example, "Multi-Queue"). | > | MBS-11177 | General | Terminal Escape Sequences appear around the "OK" and "FAILED" statuses of Software Blade verifications in the summary file, which the '*asg diag* ' command creates. **Note**: These Terminal Escape Sequences add color to the status text. | > | MBS-11085 | General | The "Hits" counter value in the SmartConsole rulebase does not update when traffic reaches a non-SMO Security Group member (for Security Gateway only). | > | MBS-11359 | General | After every change to VSX objects in SmartConsole and pushing of VSX configuration, the output of the '*ps -auxw*' command on the VSX Gateway / VSX Cluster Members shows the "\[gzip\] \" processes. | > | MBS-11427 | General | Improved stability of the FWD daemon when adding or deleting "fw samp" rules. | > | MBS-11295 | General | IPv6 traffic outage during cluster fail-overs. | > | MBS-11375 | General | Memory leak in the stateless correction flows (example: local connections that pass through the Mgmt interface of a Security Group, like a connection from a non-SMO member of a Security Group to the Management Server). | > | MBS-10092 | General | Added new SNMP OIDs for Maestro Hyperscale Orchestrators in the *chkpnt.mib* file (the new branch "mho" with the OID .1.3.6.1.4.1.2620.1.55): * .1.3.6.1.4.1.2620.1.55.1 - Statistics for ports * .1.3.6.1.4.1.2620.1.55.1.1 - RX statistics for ports * .1.3.6.1.4.1.2620.1.55.1.2 - TX statistics for ports * .1.3.6.1.4.1.2620.1.55.1.3 - RX buffer statistics for ports * .1.3.6.1.4.1.2620.1.55.1.4 - State of ports (logical port ID, physical port / port label ID, link state, admin state, speed) * .1.3.6.1.4.1.2620.1.55.1.5 - Summary information for ports (logical port ID, physical port / port label ID, link state, admin state, speed, RX statistics, TX statistics) * .1.3.6.1.4.1.2620.1.55.2 - Number of ACL rule memory entries * .1.3.6.1.4.1.2620.1.55.2.1 - Number of used ACL rule memory entries * .1.3.6.1.4.1.2620.1.55.2.2 - Total number of ACL rule memory entries * .1.3.6.1.4.1.2620.1.55.2.3 - Number of free/unused ACL rule memory entries | > | MBS-11397 | Chassis | Added support for 40G SFP transceiver for SSM440 (BTI40GSRQSFPP). | > | MBS-11063 | Chassis \& Maestro | Security Group Members are now able to synchronize their Fast Acceleration rules ([sk156672](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk156672)) with those on the SMO Security Group Member and load them without reboot. | > | MBS-11175 | Maestro | The '*asg_bond -v*' command does not validate LACP system ID received from switches. | > | MBS-11283 | Maestro | Improved the stability of Gaia Clish operations on Security Groups topology on Maestro Orchestrators. | > | Take 283 (02 July 2020) ||| > | MBS-10870 | General | The '*$SMODIR/bin/coredumps_bt* ' command shows the message "`In order to use gdb, please run: /opt/CPsmo-R80.20/bin/debug_tools/install_debug_tools`". | > | MBS-10921 | General | The autocomplete for the Gaia Clish command '*show bonding group \* ' shows "`Sorry, no help available here`" for the "interfaces" option. | > | MBS-6708 | General | When interrupting the '*asg_perf_hogs* ' command with the CTRL+C keys, the message on the screen shows "`Operation was canceled/terminated by user`" instead of "`No issues were found`". | > | MBS-10962 | General | Query for the SNMP OID "asgNetIfTx" (.1.3.6.1.4.1.2620.1.48.26.1.1.12) returns inconsistent values. | > | MBS-10407 | General | **New feature** : The Custom Intelligence Feeds feature provides an ability to add custom cyber intelligence feeds into the Threat Prevention engine. It allows fetching feeds from a third-party server directly to the Security Gateway to be enforced by the Anti-Virus and Anti-Bot Software Blades. For more information, see [sk132193](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193). **Known Limitation** : When editing local source feeds, make sure to copy the edited files to all Security Group Members (with the '*asg_cp2blades \*' command). | > | MBS-8473 | Chassis | Removed the '*ccutil reset_parity_counter*' command from the code. | > | MBS-7630 | Chassis | The output of the '*asg stat vs*' command in the section "Virtual System Status" shows "active chassis" in lowercase when a Virtual System is in a freeze. Now the output shows "Active chassis" with a capital letter. | > | MBS-11048 | Chassis | "`KERLAG0429 cant read "set_list": no such variable`" error in Gaia gClish when running the '*delete bonding group \*' command and working with Multiple Security Groups. | > | MBS-11068 | Chassis | The output of the '*ps aux \| grep defunct* ' command shows "vrf" processes after an SNMP query for one of these: * OID .1.3.6.1.4.1.2620.1.48.32 - SSM CPU and RAM usage * OID .1.3.6.1.4.1.2620.1.48.33 - SSM Ports (speed, link, packets) The issue occurs from Take 210 of the R80.20SP Jumbo Hotfix Accumulator, in which these OIDs were added (see MBS-8719). | > | MBS-9798 | Chassis \& Maestro | Fragmented packets are dropped with the "`fwfrag_expires Reason: timeout has expired for fragment;`" message in kernel debug. **Note**: This issue was fixed in Gateway mode. A fix for VSX mode is planned. | > | MBS-11045 | Maestro | Improved stability of the *ssm_pmd* daemon when changing the QSFP mode. | > | MBS-10929 | Maestro | "`NMSSG0429 error copying "/tmp/sgdb.json": no such file or directory`" in Gaia Clish on Maestro Orchestrator when modifying a Security Group topology. | > | MBS-10961 | Maestro | Maestro Orchestrator does not require a license. Therefore, this message was removed from the Gaia Portal on Maestro Orchestrator (from the **Upgrades (CPUSE)** \> **Status and Actions** page): "`The trial license is currently active and will expire on