> Source: [sk180180](https://support.checkpoint.com/results/sk/sk180180) # sk180180 - Software changes between Quantum release versions | Property | Value | |----------|-------| | Solution ID | sk180180 | | Date Created | 2022-10-26 | | Last Modified | 2026-06-09 | | Technical Level | General | | Products | Security Gateway, Security Management Server | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R82, R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution Quantum Software Changes ------------------------ ### This article lists important behavior changes between versions of Quantum releases starting from the R80.30 version. **Note** - This list is composed of major, noteworthy behavioral changes that may impact your environment. All of these changes are specified per version in the Release Notes. **Table of Contents:** * R82 to R82.10 * R81.20 to R82 * R81.10 to R81.20 * R81 to R81.10 * R80.40 to R81 * R80.30 to R80.40
*** ** * ** *** ### R82 to R82.10 {#R82toR8210}
* **Gaia Operating System** * Updated the Gaia OS Linux kernel version to "5.14". * Updated the OpenSSL version to "3.5.0". * Updated the OpenSSH version to "8.6". * Updated the network interface driver "mlx" version to "24.10-0.7.0". * Updated the Data Plane Development Kit (DPDK) version to "22.11". * Removed the user shell `/usr/bin/scponly`. * Disabled these in the default SSH configuration (only in a Clean Install): * Weak Message Authentication Codes (MACs) in SSH: * `hmac-sha1:` * `hmac-sha1-etm@openssh.com` * `umac-64-etm@openssh.com` * `umac-64@openssh.com` * Weak Public-Keys: * `ssh-rsa` * `ssh-rsa-cert-v01@openssh.com` * These Check Point Appliance models do not support R82.10: * 23500, 23800, 23900 * 15400, 15600 * 6500, 6800 * 5100, 5200, 5400, 5600, 5800, 5900 * 3100, 3200 * Smart-1 5150, Smart-1 5050, Smart-1 625, Smart-1 405, Smart-1 410 * Scalable Chassis 44000 / 64000

* **Security Gateway** * On Check Point Appliances, Virtual Machines, and Open Servers: * Firewall runs only in the User Space Firewall mode (USFW). The Kernel Space Firewall mode (KSFW) does not exist anymore. See [sk167052](https://support.checkpoint.com/results/sk/sk167052). * SecureXL runs only in the User Mode (UPPAK). The Kernel Mode (KPPAK) does not exist anymore. See the [R82.10 Performance Tuning Administration Guide](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_PerformanceTuning_AdminGuide/Default.htm). * Updated the Data Plane Development Kit (DPDK) version to 22.11. * Added support for SecureXL in the User Mode (UPPAK) in CloudGuard Network Security Gateways in all cloud environments. * Log Forwarding is now enabled by default in new Security Gateway / Cluster objects. At midnight, locally stored logs are sent to the primary Log Server. In the new Security Gateway / Cluster object, navigate to **Logs** \> **Additional Logging** and refer to the section **Log Forwarding Settings**. * By default, the Security Gateway's Multi-Portal (Web Portals for various Software Blades) is configured to use only recommended and secure TLS cipher suites. Weak cipher suites are now disabled by default. To re-enable the necessary weak ciphers, use the `cipher_util` tool. **Important:** Remote Access VPN connections and Multi-Portal use the same infrastructure on a Security Gateway. An R82.10 Security Gateway will fail Remote Access VPN connections from operating systems that: * Do not support TLS 1.3 connections. **and** * Do not support these TLS 1.2 ciphers: * `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` * `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` * `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` * `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA38` To support Remote Access VPN connections from such operating systems, you must use the `cipher_util` tool on the Security Gateway / each Cluster Member / Security Group and enable the cipher suite `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`. If the operating system of a Remote Access client supports either TLS 1.3 or these TLS 1.2 ciphers, then no need to change the configuration. * Mobile Access support for Citrix is deprecated. * Support for Hardware Security Module (HSM) from the FutureX vendor is deprecated. * These features are deprecated in VPN Communities: |--------------------|-------------------------------------------------------------------------------------------------------|-----------| | Deprecated Feature | How to Get There in SmartConsole R82 and lower | Next Step | | IKEv1 | VPN Community properties \> page Encryption \> section Encryption Settings \> field Encryption Method | Use IKEv2 | | Wire Mode | VPN Community properties \> page Wire Mode | Disable | | IP Compression | VPN Community properties \> page Advanced \> section Properties | Disable | | Aggressive Mode | VPN Community properties \> page Advanced \> section Properties | Disable | Important: * VPN Communities continue to work as configured before an upgrade to R82.10. * R82.10 SmartConsole: * Does not support the configuration of these deprecated features. * Shows the applicable message and the next supported step.

* **Scalable Platforms** The CLI syntax to configure weights for Security Group Members changed: |------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------| | Syntax in R82 | Syntax in R82.10 | | `set smo security-group sgm-weight member-id weight {default | <0-512>}` | `set cluster configuration member-weight member-id weight {default | <0-512>}` | | `set smo security-group sgm-weight apply` | `set cluster configuration member-weight apply` | | `show smo security-group sgm-weight all` | `show cluster configuration member-weight all` | | `show smo security-group sgm-weight current` | `show cluster configuration member-weight distribution` | | `show smo security-group sgm-weight ` | `show cluster configuration member-weight ` |

* **Threat Prevention** * The Zero Phishing and the Threat Emulation Software Blade are now activated by default in newly created Security Gateway and Cluster objects. This feature requires a valid license be installed on a Security Gateway and Cluster Members. This feature helps to enhance our security measures and protect your systems from potential phishing attacks and malware attacks. See the [R82.10 Threat Prevention Administration Guide](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_ThreatPrevention_AdminGuide/Default.htm).

* **Management Server** * Updated the PostgreSQL version to 16.4. * In the Compliance Software Blade, removed these Best Practices: * FW202, FW203, FW204 * IPS110, IPS111, IPS117, IPS122, IPS123, IPS124, IPS125, IPS132 * MOB131 * TP106 * VPN112, VPN113, VPN120, VPN121, VPN127

*** ** * ** *** ### R81.20 to R82 {#R8120toR82}
* **Management Server** * Security Gateways R77.30 are not supported. * The search in SmartConsole Object Explorer and "Objects" sidebar was improved in a specific scenario. The partial search in text fields (name of an object, comment, and so on) does not require entering the wildcard character "\*"(asterisk) anymore. See [sk182006](https://support.checkpoint.com/results/sk/sk182006). * **Gaia Operating System** * Updated the Gaia OS Linux kernel version to 4.18. * Updated the DHCP server daemon version to 4.2.5 (see [sk184688](https://support.checkpoint.com/results/sk/sk184688) - must make sure all intermediate network devices between the DHCP clients and the Security Gateway explicitly allow DHCP unicast traffic to the UDP ports 67 and 68). * CPView Utility saves its log messages in these files: * On a Management Server / Log Server / Security Gateway: * *$CPDIR/log/cpviewd.elg* * *$CPDIR/log/cpview_api_service.elg* * On a VSX Gateway: * *$CPDIR/log/cpviewd.elg.vs\* * *$CPDIR/log/cpview_api_service.elg.vs\* * Added the Python v3.11 package. * Introducing a dedicated messaging daemon MSGD * You can use the Gaia Clish command "`set dns timeout `" to control how long Gaia OS waits for a response from a DNS server before it sends the DNS request to the next configured DNS server. * The log files in the *$RTDIR/laas/adjuster_service/log/* directory moved from the root partition "/" to the "*/var/log/*" partition. * More user space log files are now rotated based on the settings in the */etc/cpshell/log_rotation.conf* configuration file. * The name template of a Gaia regular backup file changed: from "backup_--_\.\_\_\_\_\_\_\.tgz" to "backup_--_\.\_\_\_\_\_\_\.tgz" * The name template of a Gaia scheduled backup file changed: from "backup_-\-_\.\_\_\_\_\_\_\.tgz" to "backup_-\-_\.\_\_\_\_\_\_\.tgz" * User Space Firewall (USFW) is now enabled by default on all environments except Threat Emulation (TE) Appliances and Standalone setup. * Default disk space limit for storing core dump files was increased: * Management Server - from 1000 MB to 5000 MB * Security Gateway in the Kernel Space Firewall (KSFW) mode - from 1000 MB to 5000 MB * Security Gateway in the User Space Firewall (USFW) mode - from 10000 MB to 15000 MB * **VSX** * In the Legacy VSX mode, the default value for concurrent connections in the Virtual System object was increased from 15,000 to 50,000 (Optimizations section \> Capacity Optimization page). * In the VSNext mode, the Expert mode command "`clish -c`" now supports the context of a Virtual Gateway / Virtual Switch with this syntax: `clish -v -c ""` * **VPN** * When a Check Point Management Server creates an IKE certificate, by default this certificate contains the "Server Authentication" attribute within the "Extended Key Usage" field. * Changed the default value of "Maximum concurrent IKE negotiations" from 1,000 to 10,000 in the Security Gateway / ClusterXL object \> the "Optimization" page. * Changed the default value of the kernel parameter `cphwd_medium_path_qid_by_mspi` from 1 to 0. * Changed the default value of the kernel parameter `cphwd_medium_path_qid_by_cpu_id` from 0 to 1. * **Quantum Maestro, Scalable Chassis, and ElasticXL** * Newly added Scalable Platform Member always clones the image from the SMO Member, regardless of the SMO Image Cloning state. * Outputs of CLI commands were unified to use the same terms on an ElasticXL Cluster, a Maestro Security Group, and a Scalable Chassis: * "Site" (instead of "Chassis") * "Member" (instead of "SGM") * The hostname shows the letter "`s`" instead of the letters "`ch`" (for example, *SG-s01-01*) * The feature name changed from "Unique IP Address per Chassis" (UIPC) to "Unique IP Address per Site" (UIPS). * On the Maestro Orchestrator MHO-175 ports, increased the default MTU size from 9216 to 10240 bytes. * Automated creation of the management bond interface (MAGG). All management interfaces assigned to a Security Group are automatically assigned to this MAGG interface. * If an administrator stops a Maestro Orchestrator with the "`orchd stop`" command (or reboots it), and the Orchestrator detects that other Orchestrators on the Maestro Site are not operational, then before stopping (or rebooting) the Orchestrator shows a warning and a prompt to the administrator. * When an administrator changes the administrative state of a port on a Maestro Orchestrator, this change now survives an Orchestrator reboot and the restart of the Orchestrator daemon with the "`orchd restart`" command. * On the Orchestrator, the Gaia Portal \> Network Management section \> Network Interfaces page now hides interfaces that are used for internal purposes: Sync-ext Sync-int dl\ eth\ eth\-CIN\ swid0_eth * On the Maestro Orchestrator, it is no longer supported to convert an existing Security Group from the 'Gateway' mode to the 'VSX' mode (by selecting the corresponding checkbox in the Security Group properties). * The output of the Gaia gClish / Gaia Clish command "`show interfaces`" on Scalable Platforms was aligned with the output of this command on a regular Security Gateway. * These CLI commands were deprecated and replaced (where possible): |--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Deprecated Command | Use this Command in the Expert mode | Use this Command in Gaia gClish | | `asg cluster_site_admin` | `cluster_site_admin -c {down | up}` | `set cluster site-id admin-state {up | down}` `set cluster sites-admin-state id {down | up}` | | `asg conns` | `insights` `cluster-cli show connection --help` `g_connview --help` | `insights` `show cluster info connection ` | | `asg cores_stat` | `insights` `cluster-cli show cpu` | `insights` `show cluster info cpu` | | `asg diag` `asg_diag` `asg6 diag` | `insights` `hcp --help` (run the applicable tests) | `insights` | | `asg if` `asg_if` `asg6 if` | `insights` `hcp --help` (run the applicable tests) `cluster-cli show interfaces` | `insights` `show cluster info interfaces` | | `asg perf` | `insights` `cluster-cli show --help` | `insights` `show cluster info ` | | `asg resource` `asg6 resource` | `insights` `cluster-cli show --help` | `insights` `show cluster info ` | | `asg search` `asg6 search` | `insights` `cluster-cli show connection --help` | `insights` `show cluster info connection ` | | `asg_bond` | `hcp --help` (run the "Bond Health" test) | N / A | | `asg_chassis_admin` | `cluster_site_admin -c {down | up}` | N / A | | `toggle_same_vmac` | `toggle_same_vmac_os` | N / A | | `show smo` `set smo` `delete smo` | | `show cluster ` `set cluster ` | | `show chassis id {1|2} general unique_ip` `set chassis id {1|2} general unique_ip` `delete chassis id {1|2} general unique_ip` | N / A | `show cluster configuration unique-ip interface ` `set cluster configuration unique-ip interface ` `delete cluster configuration unique-ip site-id interface ` | | `show chassis high-availability ` `set chassis high-availability ` | N / A | `show cluster configuration high-availability ` `set cluster configuration high-availability ` | | `asg_collect_vsx_logs` | `cpinfo -h` (see [sk92739](https://support.checkpoint.com/results/sk/sk92739)) | `cpinfo -h` (see [sk92739](https://support.checkpoint.com/results/sk/sk92739)) | | `drop_monitor` | N / A | N / A | | `asg_affinity_enhance` | N / A | N / A |

* **Security Gateway** * In the feature "Hide NAT behind IP Address Range", it is now possible to configure the Security Gateway to select the Hide NAT IP address based on the combination of the source IP address and the source port. See [sk105302](https://support.checkpoint.com/results/sk/sk105302). * Improved the output of the `adlogconfig` command. See the [R82 CLI Reference Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_CLI_ReferenceGuide/Default.htm). * In the Threat Prevention Engine Settings, the default "Connection Unification" period changed from 600 minutes to 180 minutes (in SmartConsole, click "Manage \& Settings" \> "Blades" \> in the "Threat Prevention" section, click "Advanced Settings" \> click the "General" page). * **Mobile Access** * Changed the default value of the "`max_concurrent_vpn_tunnels`" parameter from 200 to 10000 in VSX environments. * **QoS** * QoS policy now supports different Service objects with the same Destination Port and different Source Ports. * **SmartConsole** * Upgraded the SmartConsole .NET Framework from 4.5 to 4.8. * Upgraded the SmartConsole Visual C++ Redistributable from 2012 to 2019. * Hovering over the SmartConsole icon on the Windows OS taskbar now shows the SmartConsole version in the tooltip in this format: \-\-SmartConsole * The "HTTPS Inspection" tab was removed from the Legacy SmartDashboard. *** ** * ** *** ### R81.10 to R81.20 {#R8110toR8120}
* **Gaia Operating System** * Update to Gaia OS Linux kernel version. * New Gaia installer: * You must upgrade to the latest Deployment Agent (DA) before upgrading to R81.20. See [sk92449.](https://support.checkpoint.com/results/sk/sk92449) * A new partition layout is introduced to accommodate the new Gaia installer changes. * Upgrade of a Security Gateway from R77.30 to R81.20 is supported only if the Gaia works with the 64 bit kernel edition. For more information on configuring the Kernel edition, see [sk94627](https://support.checkpoint.com/results/sk/sk94627). * ISOmorphic Tool: You must use build 187 or higher. See [sk65205](https://support.checkpoint.com/results/sk/sk65205). * SmartConsole download is no longer available from the Gaia Portal(you are redirected to Support Center). * The password for the Gaia GRUB (boot loader - maintenance mode) is a dedicated password (separated from the Expert mode password). You can configure the Gaia GRUB password during the Gaia First Time Configuration Wizard, or after the Gaia installation. * The messaging and logging daemon now uses Rsyslog (previously Syslog). * Changed the date format for the Gaia manual backup file. Gaia always uses this template (regardless of the Gaia Display Format for Time and Date): `backup_--_._
_____.tgz` * Changed the date format for the Gaia scheduled backup file. Gaia always uses this template (regardless of the Gaia Display Format for Time and Date): `backup_--_._
_____.tgz` * **SmartConsole** * The IoT Network Protection properties in SmartConsole are **read-only**. Manage your IoT policies and objects through the IoT Network Protect application in the Infinity Portal. * Certificate status indication: * For the Internal CA certificate - ICA certificate expires in less than one year. * For IPsec VPN certificates - SmartConsole certificates - SmartConsole \> Gateways \& Servers view shows a warning near the VPN Gateway object about the certificate expiration. * In an IoC Feed object, the button "Test Connectivity" was renamed to "Test Feed". * **VSX** * CLI commands for DHCP server configuration on VSX now support the Virtual System context notation(`set virtual-system <`*ID*`>`). * **Maestro** * The Enhanced NAT Port Allocation Mechanism (GNAT) is enabled by default on Maestro Security Groups. * **HTTPS Inspection** * In SmartDashboard \> HTTPS Inspection, the default value for the "**Automatic Updates** " changed to "**Download and install updates automatically**". The change applies to a Management Server upgrade from a lower version. For more information, see [sk173629 How to update trusted CAs automatically](https://support.checkpoint.com/results/sk/sk173629). Important - Policy installation is required for the changes to take effect on the Security Gateway. * **IPS** * The download package location of the IPS updates changed **from** `/opt/CPsuite-`R81.20`/fw1/ips` **to** `/var/log/opt/CPsuite-`R81.20`/fw1/ips` * **ClusterXL MVC Upgrade** * During a cluster MVC upgrade, kernel tables with data about VPN are not synchronized from the cluster members with the current version to the upgraded cluster member: * In the case of IKEv2 - cluster members do not synchronize the data about VPN at all. * In the case of IKEv1 - cluster members do not synchronize the data about IPsec SAs. * Delta Sync operates fully only from the upgraded cluster members to the cluster members with the current version. * A new VPN tunnel is created after failover from the cluster members with the current version to the upgraded cluster member. * **Internal Certificate Authority (ICA)** * Ability to create certificates with 3072-bit RSA keys - the root ICA certificate and SIC certificates. See [sk96591](https://support.checkpoint.com/results/sk/sk96591).
*** ** * ** *** ### R81 to R81.10 {#R8100toR8110}
* **Management Server** * The **SOLR** functionality is replaced with a PostgreSQL database to improve the stability and performance of the Management Server. Notes: * SOLR is still in use for logs and SmartEvent. * All SOLR-based scripts are removed (for example `$MDS_FWDIR/scripts/solr_monitor.sh`, `$MDS_FWDIR/scripts/solr_recovery.sh`, `$MDS_FWDIR/scripts/solr_cure.sh`). * All custom SOLR-based scripts are no longer operational. * The **ICA** (Internal Certificate Authority) service uses two separate ports: * Port 18265 for the ICA portal: `http://<`*IP Address of Domain Management Server*`>:18265`. * Port 18264 for CRL (Certificate Revocation List) retrieval. For more information, refer to the *[R81.10 Security Management Administration Guide](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuide/Default.htm)* \> Chapter "*The ICA Management Tool*". * **Automatic revision purge** is enabled by default: * Every 30 days, a purge operation executes automatically at 02:00 AM (according to Management Server time settings) and purges all revisions older than 14 days. * The 30 most recent revisions are kept and are not purged (even if older than 14 days). * Change the default settings or disable the automatic revision purge is available through API (see *[Check Point Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/index.html)*). * For more information, see [sk170059](https://support.checkpoint.com/results/sk/sk170059 "Automatic Revisions Purge"). * **Multi-Domain Server** * In Management High Availability, publishing a session for the Global Domain or the Domain Management does not automatically trigger synchronization. It may take up to 5 minutes for synchronization to start. * A Log Exporter configured on a Multi-Domain Server or a Multi-Domain Log Server now sends logs with the source IP address of the Domain Management Server or the Log Server. Important - If a rule that allows the Log Exporter connection already exists in the Rule Base, you must update it to allow connections using the Domain Management Servers or the Domain Log Server as the source IP address of the Log Exporter. * **Endpoint Security** * The Web Management Portal is enabled by default when you enable the Endpoint Policy Management Software Blade in the Security Management Server object. * **Endpoint Security VPN** * Simultaneous Login Prevention (SLP) default was changed to "User is allowed only single login" in SmartConsole Menu \> Global properties \> Remote Access page \> Simultaneous Login. * Visitor Mode is enabled by default in Security Gateway object \> VPN Clients section \> Remote Access page \> Support Visitor Mode section. * Support connectivity enhancement for gateways with multiple external interfaces is enabled by default in: Security Gateway / Cluster object properties \> VPN Clients \> Office Mode \> Multiple Interfaces. * **Access Control Policy** * New default values for Access Rules, the value None replaces the value Any for new installations. * **VSX** * Starting R81.10, VSLS is the only supported mode for new installations. Upgrade to R81.10 from earlier versions that use High Availability is supported. The change delivers a single unified model (Virtual System High Availability is one use case of the VSLS mode). To convert the upgraded VSX Cluster to VSLS, use the "`vsx_util to convert`" command. * **HTTPS Inspection** * Transport Layer Security (TLS) v1.3 is enabled by default for Security Gateways (and Cluster Members) that use the User Space Firewall Mode (USFW). For more information, see {#sk167052}[sk167052](https://support.checkpoint.com/results/sk/sk167052). * **Gaia** * Changed the name of the output Gaia manual backup file (added '--'). Gaia uses this template (the date format is based on the Gaia Display Format for Date): `backup_--_.____.tgz` * Changed the name of the output Gaia scheduled backup file (added the name of the scheduled backup task surrounded with '-'). Gaia uses this template (the date format is based on the Gaia Display Format for Date): `backup_--_.____.tgz` * **SmartConsole** * The Autonomous Threat Prevention option replaces the Threat Extraction First Time Activation Wizard. * In the Gateways \& Servers view, when available, the actual software version appears instead of the one set in the Management Server database. * To add or remove licenses on the Licenses tab, an administrator must have the Run One Time Script permission selected in their profile. To assign this permission: 1. In SmartConsole, go to Manage \& Settings \> Permissions \& Administrators \> Permission Profiles. 2. Open the applicable permission profile. 3. In the left panel, click the "Gateways" page. 4. In the \> Scripts section, select "Run One-Time Script". 5. Click OK. 6. Publish the SmartConsole session. * In Menu \> "Global properties" \> "Remote Access" section, the page "Certificates" was removed.
*** ** * ** *** ### R80.40 to R81 {#R8040toR8100}
* **Threat Prevention** : Two Threat Prevention defaults are changed to further increase the security value our customers get from the product. * Threat Emulation will now scan executable files by default. * Threat Extraction for Web will now be enabled by default. **Note** - For this to take effect, make sure SandBlast Threat Emulation and Threat Extraction are enabled on the relevant Security Gateways. * To provide you with more accurate and personalized protections against cyberattacks, Check Point collects Indicators of Compromise (IOC) and other information from detected malicious events. You can review the sharing settings in the Security Gateway object \> Anti-Virus and Anti-Bot tab. * Ability to control SMB protocol inspection for Anti-Virus and SandBlast Threat Emulation using SmartConsole. * The Identity Awareness *pdp ifmap* CLI command is deprecated and is no longer supported in R81. * Log description change for DNS sinkhole trap - log is changed to Prevent instead of Detect, the Security Gateway prevents users from reaching malicious sites. * Password length restriction for users in *User Database* (Security Management Database) are extended. * Threat Prevention - Starting R81, using Traditional Anti-Virus is not supported. * End of development support for Geo Policy, customers facing issues with Geo Policy can use Network Objects instead. For more information, see [sk126172](https://support.checkpoint.com/results/sk/sk126172) * CoreXL Dynamic Balancing (previously known as Dynamic Split) is enabled by default. For more information, support, and limitations, see [sk164155](https://support.checkpoint.com/results/sk/sk164155). **Note** - Dynamic Balancing is **disabled**by default if manual changes to the Dynamic Balancing configuration are applied before an R81 upgrade. * For new installations, NetFlow no longer requires Log/Accounting to be enabled. Logging is disabled by default. Log/Accounting must still be configured in the Access Control Rule Base for Security Gateways running earlier versions. * Management API is enabled by default on all types of devices, regardless of the amount of free memory. * CPU Spike Detective is enabled by default. For more information about CPU Spike Detective, see [sk166454](https://support.checkpoint.com/results/sk/sk166454) * Upgrade of Management Servers configured as Log Servers to R81: * Logs older than the last 24 hours are not available for queries. * Management Servers that store logs on an external storage device must follow [sk66003](https://support.checkpoint.com/results/sk/sk66003) to change the locations of the existing indexes and keep the log data. **Note** - The logs are not lost, indexing can be configured to re-index the logs after the upgrade process completes. * Changes and Enhancements to Compliance. For more information, see [sk170578](https://support.checkpoint.com/results/sk/sk170578). * In Gaia OS, the hash algorithm MD5 was removed from the user password configuration. The default password hash algorithm is SHA512.
*** ** * ** *** ### R80.30 to R80.40 {#R8030toR8040}
* R80.40 supports only the 3.10 kernel for all Security Gateways. * Security Gateway upgrade from 2.6.18 kernel to 3.10 kernel is supported. * Starting from R80.20, Management Severs support only the 3.10 kernel. * SMT (HyperThreading) is enabled after an upgrade to R80.40. For more information, see [sk172304](https://support.checkpoint.com/results/sk/sk172304). * These appliances are no longer supported: * 21600 * Smart-1 25B, Smart-1 50, Smart-1 150 * R80.40 Management Server cannot manage UTM-1 Edge devices. Remove or replace these devices before you upgrade the Management Server. * In-place upgrade from the R75.4x versions to the R80.40 version is not supported. The recommended upgrade path is: 1. Upgrade from R75.4x to R77.30 2. Upgrade from R77.30 to R80.40 * By default, Policy Verification now only warns about conflicting rules, in previous versions the verification process warned for rules configured with the same action. For more information, see [sk161574.](https://support.checkpoint.com/results/sk/sk161574) * After a CloudGuard Controller upgrade to R80.40, the Subnet and Security Group objects may include more IP addresses which will be enforced by the security policy. * ClusterXL - The default value of the parameter "`fwha_cluster_hide_active_only`" was changed from 0 to 1. For more information, see [sk169154](https://support.checkpoint.com/results/sk/sk169154) \> Section 3.4 - Standby member's connections. * ClusterXL - The command "`cphaconf set_ccp {auto | broadcast | multicast | unicast}`" was removed. CCP runs only in the Unicast mode. * AES-NI (Intel Advanced Encryption Standard New Instructions) is supported and configured automatically. The command "`sim -i 0 enable_aesni`" is deprecated. Starting R80.40 Jumbo HotFix Accumulator Take #13, you can use the "`fw ctl get int AESNI_is_supported`" command the to see if your system supports AES-NI. * The "tunnel_keep_alive_method" in 3rd party VPN objects has been modified to use DPD (Dead Peer Detection) instead of TUNNEL_TEST. This alteration might impact the connection with 3rd party VPN peers that do not support the DPD protocol. To address this issue, it is recommended to reconfigure the 3rd party objects with "Tunnel Test" as the preferred method for keeping the tunnel alive. For more information, see [sk108600](https://support.checkpoint.com/results/sk/sk108600) scenario 5. * The Expert mode command "`ip rule show`" does not show hits for PBR rules anymore (in Gaia kernel 2.6, Check Point customized the Linux kernel to show this data). Related Solutions ----------------- * [sk98226 - Dynamic Routing and VRRP Features on Gaia OS](https://support.checkpoint.com/results/sk/sk98226) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content