> Source: [sk181134](https://support.checkpoint.com/results/sk/sk181134)
# sk181134 - Check Point R81.10.X Resolved Issues and Enhancements
| Property | Value |
|----------|-------|
| Solution ID | sk181134 |
| Date Created | 2023-06-15 |
| Last Modified | 2026-09-14 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| OS | Gaia Embedded |
| Platform | 1570R, 1500, 1900, 2000, 1600, 1800 |
## Solution
This article lists all Resolved Issues and Enhancements for R81.10.X releases on 1500, 1600, 1800, 1900, and 2000 appliances.
* For a comprehensive list of Known Limitations and Unsupported Features, see [sk178604](https://support.checkpoint.com/results/sk/sk178604).
* For more information about a specific release, see its Home Page article:
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| * [R81.10.17](https://support.checkpoint.com/results/sk/sk183153) * [R81.10.15](https://support.checkpoint.com/results/sk/sk182438) * [R81.10.10](https://support.checkpoint.com/results/sk/sk181080) * [R81.10.08](https://support.checkpoint.com/results/sk/sk181079) |
* Visit the [CheckMates Community](https://community.checkpoint.com) to ask questions, start a discussion, and get our experts' assistance.
Show the Entire Article
R81.10.17 Resolved Issues and Enhancements
------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
|------------------------------|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **ID** | **Category** | **Description** |
| **Build** ***99600*** **4968** |||
| *SMBGWY-22017* | *VPN* | *In a locally managed Spark Firewall appliance, IKEv2 negotiation for Site to Site VPN with DAIP peer fails with "INVALID_MAJOR_VERSION."* |
| *SMBGWY-22371* | *Certificates* | *After a new third-party CA-signed certificate is imported, Gaia Portal presents the default self-signed certificate instead of the selected imported certificate.* |
| *SMBGWY-20332* | *IOC* | *Obsolete IOC feeds are not removed from the system after a successful load.* |
| *SMBGWY-21771* | *Access Policy* | *In Access Policy, entering a domain value containing a hyphen may cause a domain entry to be treated as an IP range.* |
| *SMBGWY-21745* | *Access Policy* | *Users with Access Policy Admin permissions can not add access policies.* |
| *SMBGWY-21785* | *NAT* | *NAT entries are not refreshed after a PPPoE IP address change.* |
| *SMBGWY-21810* | *General* | *Because Domain objects on Locally Managed appliances ignore the FQDN setting, a rule allowing a domain also allows its sub-domains.* |
| *SMBGWY-21910* | *Cellular* | *SIM data usage may be counted twice after a file download is completed.* |
| *SMBGWY-17932* | *Review* | *CPVIEW_API_SERVICE, the service responsible for API-based monitoring, restarts repeatedly."* |
| *SMBGWY-22182* | *General* | *The Monitoring page in the WebUI does not display throughput and packet-rate values.* |
| *SMBGWY-22334* | *Hardware* | *On 1600, 1800, 1900, and 2000 Spark Firewalls running R81.10.17 build 4936, backing up setting to a USB failed due to USB detection errors.* |
| *SMBGWY-22389* | *Threat Prevention* | *In Threat Prevention Exceptions, domain names that contain hyphens can be misinterpreted as IP ranges.* |
| *SMBGWY-22398* | *Interface* | *Converting an interface with a static next-hop route to an Internet Connection can cause permanent loss of the default gateway route.* |
| *SMBGWY-22363* | *General* | *The system view continues showing an IP address after the address was changed.* |
| *SMBGWY-21745* | *Access Policy* | *Users assigned the Access Policy Admin role may be unable to add Access Policy entries.* |
| PMTR-131442 | VPN | Update: Resolved [CVE-2026-85102](https://www.cve.org/CVERecord?id=CVE-2026-85102 "https://www.cve.org/cverecord?id=cve-2026-85102"){#menurbhf} - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN. Refer to [sk1000117](https://support.checkpoint.com/results/sk/sk1000117 "https://support.checkpoint.com/results/sk/sk1000117"){#menurbhh}. |
| PMTR-131527 | VPN | Update: Resolved [CVE-2026-85103](https://www.cve.org/CVERecord?id=CVE-2026-85103 "https://www.cve.org/cverecord?id=cve-2026-85103"){#menurbhj} - ASN.1 decoding heap overflow leading to a remote code execution. Refer to [sk1000118](https://support.checkpoint.com/results/sk/sk1000118 "https://support.checkpoint.com/results/sk/sk1000118"){#menurbhl}. |
| ***ID*** | ***Category*** | ***Description*** |
| ***Build 996004936*** |||
| *SMBGWY-21651* | *Routing* | *Route information is not refreshed immediately after physical link reconnection events.* |
| *SMBGWY-21629* | *VPN* | *Remote Access VPN user objects cannot be removed if they are referenced in Access Policy rules.* |
| *SMBGWY-21646* | *Spark Management* | *When sfwd restarts while connectivity to Spark Management servers is temporarily unavailable, the scheduled Spark Management upgrade plan may not execute even after connectivity is restored* |
| *SMBGWY-21388* | *VPN* | *In Spark Firewall cluster deployments using L2TP Remote Access VPN, users may fail to establish remote access sessions.* |
| *SMBGWY-21720* | *VoIP* | *In the VoIP wizard, administrators can select SIP services that are not valid for the intended configuration flow, resulting in incorrect service mapping.* |
| *SMBGWY-21650* | *Cloud Services* | *The time shown on the device interface may differ from cloud-synchronized time values during monitoring and event review workflows.* |
| *SMBGWY-21055* | *Firewall* | *Policy installation fails with Error code: 0-2-2000245, potentially causing a cluster member to start after reboot without a policy or cluster membership.* |
| *SMBGWY-21517* | *General* | *Server configuration may not be applied correctly, causing the server to become unreachable.* |
| *SMBGWY-21723* | *VPN* | *After upgrading to R81.10.17 from a version earlier than R81.10.07, Remote Access VPN Two-Factor Authentication with use-authenticator may be incorrectly enabled.* |
| *SMBGWY-21813* | *NAT* | *In JPIX v6plus MAP-E deployments, NAT behavior may be incorrect, leading to connectivity anomalies for translated traffic flows.* |
| *PRJ-70032 / PMTR-129280* | *VPN* | *Improved certificate validation during IKEv2 VPN negotiations to ensure VPN connections are established only after successful certificate-based authentication.* |
| ***Build 996004914*** |||
| *SMBGWY-20729* | *Anti-Spam* | *Anti-Spam exception rules may not be applied correctly to messages with unusually long headers.* |
| *SMBGWY-21606* | *2FA* | *After upgrading to R81.10.17 Build 996004892, the Two-Factor Authentication SMS and email message templates appear garbled**.*** |
| *SMBGWY-21155* | *Users and Objects* | *When more than 40 local users are created, the most recently added user does not appear in the WebUI user list under Users and Objects \> Users, although it can still be found via the search box or the CLI command "show local-users." Each time a new user is added, the previously missing user is displayed but the newest one does not appear.* |
| *SMBGWY-21478* | *2FA* | *The email for setting up Two-Factor Authentication is not sent after enabling Two-Factor Authentication through the WebUI through an RMD link via Spark Management.* |
| *SMBGWY-21467* | *VPN* | *After upgrading to R81.10.17 Build 996004901, Capsule VPN clients fail to connect and show an error that the server sent an invalid response.* |
| *SMBGWY-21331* | *Logs* | *On a Spark Firewall appliance, only logs from the past day can load. On Spark Management, all the logs are displayed but it is not possible to filter for the desired time frame.* |
| *PRJ-69655, PMTR-128753* | *VPN* | ***UPDATE** :* * *Resolved [CVE-2026-50751](https://www.cve.org/CVERecord?id=CVE-2026-50751) - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to [sk185033](https://support.checkpoint.com/results/sk/sk185033).* * *Resolved [CVE-2026-50752](https://www.cve.org/CVERecord?id=CVE-2026-50752) VPN site-to-site certificate bypass vulnerability in deprecated IKEv1 key exchange. Refer to [sk185035](https://support.checkpoint.com/results/sk/sk185035).* |
| ***Build 996004892*** |||
| *PRJ-67985, PMTR-126652* | *Security Gateway* | ***UPDATE** : Resolved [CVE-2026-48131](https://www.cve.org/CVERecord?id=CVE-2026-48131) - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero. Refer to [sk184981](https://support.checkpoint.com/results/sk/sk184981).* |
| *PRJ-67840, PMTR-126457* | *Security Gateway* | ***UPDATE** : Resolved [CVE-2026-48132](https://www.cve.org/CVERecord?id=CVE-2026-48132) - VPN process may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP. Refer to [sk184982](https://support.checkpoint.com/results/sk/sk184982).* |
| *PRJ-67875, PMTR-126538* | *Security Gateway* | ***UPDATE** : Resolved [CVE-2026-48133](https://www.cve.org/CVERecord?id=CVE-2026-48133) - Identity Awareness Captive Portal - Unauthenticated Local File Inclusion. Refer to [sk184993](https://support.checkpoint.com/results/sk/sk184993).* |
| *PRJ-68010, PMTR-126694* | *Security Gateway* | ***UPDATE** : Resolved [CVE-2026-48135](https://www.cve.org/CVERecord?id=CVE-2026-48135) - HTTP service can incorrectly process malformed HTTP requests. Refer to [sk184991](https://support.checkpoint.com/results/sk/sk184991).* |
| *SMBGWY-17467* | *General* | *The Spark appliance may fail to download the Certificate Revocation List (CRL) in SSL inspection (SSLi).* |
| *SMBGWY-17071* | *General* | *Hosts located behind the bridge interface are unable to access internal servers using the appliance's external IP address on the server's port.* |
| *SMBGWY-17401* | *General* | *When the Local NTP Server is enabled, it is accessible from the WAN, allowing external clients to receive NTP responses, instead of being restricted to local/internal networks.* |
| *SMBGWY-19701* | *General* | *IPv4 over IPv6 (IPIP) Internet connection settings cannot be modified.* |
| *SMBGWY-19651* | *General* | *Periodic backup fails when configured in Spark Management.* |
| *SMBGWY-19465* | *General* | *The **Connected Remote Users** page may not display all connected users.* |
| *SMBGWY-19473* | *General* | *SmartConsole reports and the output of the `cpstat` command do not display scanned files. The scanned file counter remains at `0` even after Threat Emulation scans files.* |
| *SMBGWY-20724* | *General* | *Periodic backups are not scheduled when configured from Spark Management after an upgrade to R82.00.05, R82.00.10 (up to Build 998001645), or R81.10.17 (between Builds 996004668 and 998002171).* |
| *SMBGWY-19347* | *General* | *After a cluster failover in Locally Managed environments, proxy ARP may not function correctly, causing loss of access to internal servers using proxy ARP--defined IP addresses.* |
| *SMBGWY-18298* | *General* | *The Spark Management dashboard displays a `Connected (no probing)` status for PPPoE and flexiport connections, and does not show Internet probing statistics even when probing data is available on the Gateway.* |
| *SMBGWY-19116* | *General* | *The `disable-sd-logging` command does not function correctly.* |
| *SMBGWY-17977* | *General* | *Enabling NT LAN Manager Version 2 (NTLMv2) for Identity Awareness in Centrally Managed Mode does not work, causing authentication issues even when AD is configured to require NTLMv2 and the `ad_log_override.C` file is set to enforce NTLMv2.* |
| *SMBGWY-18704* | *General* | *Updating the IP address or subnet of a Local Network object is not applied in the backend under certain conditions, causing firewall rules that reference this object to continue using the old IP address or subnet.* |
| *SMBGWY-19001* | *General* | *No logs are available in the Infinity Portal for 1600, 1800, 1900, and 2000 Gateways managed via Spark Management.* |
| *SMBGWY-19280* | *General* | *The `sfp-diag` tool reports incorrect SFP diagnostics for the DMZ port on Quantum Spark 1600 V2 (D0) appliances.* |
| *SMBGWY-18339* | *General* | *The "Firmware Upgrade Completed" notification is not sent to or displayed in the Spark Management **Events** tab during a manual firmware upgrade via the WebUI, even when the notification is enabled.* |
| *SMBGWY-19014* | *General* | *Anti-Virus fails to process files in Centrally Managed Mode when the **Enable deep inspection scanning** option is selected.* |
| *SMBGWY-18622* | *General* | *The system does not display injected routes in the output of the `show route` command, although it displays them in the output of the `route -n` command.* |
| *SMBGWY-18227* | *General* | *When the Gateway is in IPv6 Bridge mode (dual-stack IPv4/IPv6), a firmware upgrade initiated from Quantum Spark Management in the Infinity Portal does not start, although manual upgrades via the local WebUI function correctly.* |
| *SMBGWY-20812* | *Firewall* | *SCTP services with port number configurations cannot be defined in the firewall policy.* |
| *SMBGWY-17645* | *Firewall* | *The IPv4 MAP?E service does not function correctly. Inbound IPIP (IP-in-IP tunneling protocol) encapsulated return traffic is dropped due to `local interface address spoofing`, resulting in only outbound traffic working despite an active tunnel.* |
| *SMBGWY-18134* | *Firewall* | *Clusters configured with strict or restrictive custom Firewall policies allow unrestricted traffic between cluster members over the Synchronization network.* |
| *SMBGWY-17848* | *Firewall* | *During an ISP redundancy failover triggered by Gateway probing failure, NAT Hide rules use the primary connection's IP address instead of the active secondary connection's IP address.* |
| *SMBGWY-18654* | *Firewall* | *The `fwConnectionsStat ConnectionRate` SNMP OID returns a `No Such Instance` error on Quantum Spark appliances.* |
| *SMBGWY-17626* | *Firewall* | *No network connectivity is observed on the DMZ fiber port.* |
| *SMBGWY-17486* | *Firewall* | *A firewall rule configured with **any but specific services** is incorrectly converted to **only specific services** after an upgrade to a version that includes the multiple objects feature* |
| *SMBGWY-19319* | *CPOS* | *After upgrading to R81.10.17, the Gateway allocates an incorrect number of CoreXL firewall instances on first boot.* |
| *SMBGWY-19361* | *CPOS* | *GRE cannot be configured on an external interface that uses an automatic Internet connection (for example, DHCP).* |
| *SMBGWY-17627* | *CPOS* | *Some 1600/1800 appliances do not establish a link on SFP ports.* |
| *SMBGWY-17852* | *CPOS* | *IPv6 Prefix Delegation cannot be enabled on LAN, DMZ, or WLAN interfaces, even though these interfaces support IPv6 Prefix Delegation. A validation mechanism incorrectly prevents activation of Prefix Delegation on these interface types.* |
| *SMBGWY-18836* | *CPOS* | *System logs are not written to the SD card after a boot.* |
| *SMBGWY-19633* | *SD-WAN* | *In rare cases, SD-WAN objects (such as Peer VPN Domain, My VPN Domain, or SD-WAN Internet) populate incompletely, causing SD-WAN rules to match traffic incorrectly.* |
| *PRHF-42303* | *SD-WAN* | *Spark Firewall fails to install SD-WAN Policy with the event `Failed to Initialize VPN Transports`. See [sk184225](https://support.checkpoint.com/results/sk/sk184225).* |
| *SDWANGW-5963* | *SD-WAN* | *AWS cross-availability-zone (XAZ) peer identification is handled incorrectly in SD-WAN overlay configurations.* |
| *SMBGWY-17317* | *SD-WAN* | *SD?WAN link "up" event notifications are not generated under certain conditions, preventing administrators from receiving alerts when an interface recovers.* |
| *SMBGWY-17819* | *CPOS* | *Cellular internet connection behavior may not meet the requirements of certain Canadian carriers, causing overly aggressive retry attempts when the connection fails to establish.* |
| *SMBGWY-18743* | *CPOS* | *On wireless Quantum Spark models, the `Enable Zero?Wait DFS` setting in the Wireless Radio settings is not retained after an appliance reboot (the setting reverts to `disabled`).* |
| *SMBGWY-19093* | *Identity Awareness* | *Even after disabling User Awareness in the WebUI, Identity Awareness still appears as enabled in `enabled_blades` / `active_blades.txt`.* |
| *SMBGWY-18011* | *GUI* | * *Deleting the static Office Mode IP from the WebUI triggers a system error and does not remove the entry from the `ipassignment.conf` file.* * *Modifying the static Office Mode IP for usernames containing special characters creates duplicate entries in the `ipassignment.conf`file.* * *Multiple users can be assigned the same Office Mode IP address.* |
| *SMBGWY-19749* | *GUI* | *Adding categories to the **Other Undesired Applications** group fails, resulting in an empty application name.* |
| *SMBGWY-17897* | *GUI* | *When clicking **Force Member Down** on the High Availability page for a Locally Managed Quantum Spark appliance, the member correctly changes to Down, but the button does not switch to **Disable Manual Failover**.* |
| *SMBGWY-18323* | *GUI* | *The option to upload a signed certificate for the Web Portal is unavailable when the appliance is in Centrally Managed Mode, although it is available in Locally Managed mode.* |
| *SMBGWY-18277* | *GUI* | *After a Gateway reboot, the PPPoE interface is automatically disabled as a steering candidate in the SD-WAN steering object.* |
| *SMBGWY-17475* | *GUI* | *The**Incoming Rules** page displays unsupported action options, and selecting them triggers this system error: `Current action is not supported for the selected services.`* |
| *SMBGWY-20829* | *GUI* | *Offline IPS signature updates uploaded via the WebUI are not applied.* |
| *SMBGWY-18682* | *GUI* | *LAN1 is not available as a selectable interface in the WebUI when configuring a Link Aggregation Group (LAG) for Internet connectivity.* |
| *SMBGWY-18184* | *GUI* | *IPv6 addresses cannot be assigned using Prefix Delegation (PD) on WLAN (wireless) interfaces, while ND?Proxy remains available.* |
| *SMBGWY-18788* | *GUI* | *When operating in strict mode with the **APPI policy -- Bypass Check Point products** advanced setting enabled, an AppiBypass rule is automatically generated.* |
| *SMBGWY-17728* | *GUI* | *The WebUI displays an incorrect Internet connection mode after switching from High Availability to Load Balancing via Clish.* |
| *SMBGWY-19641* | *GUI* | *Certain application categories cannot be added to the **Other Undesired Applications** group under URL Filtering / Application Control. Attempts to add these categories via the WebUI do not complete successfully.* |
| *SMBGWY-19301* | *GUI* | *Automatically generated application groups are not created properly.* |
| *SMBGWY-19381* | *VPN* | ***New**: Support for Perfect Forward Secrecy (PFS) mode on VPN sites of type "Only remote site initiates VPN" and "Hostname" in Locally Managed Mode.* |
| *SMBGWY-17494* | *VPN* | *When a client establishes an L2TP connection with **Route Internet traffic from connected clients through this Security Gateway** enabled, the client receives an IP address but does not receive DNS server information. As a result, external IP connectivity works, but hostname resolution fails.* |
| *SMBGWY-18850* | *VPN* | *After upgrading to R81.10.17, Remote Access VPN clients cannot connect to the Gateway and receive a `no response from gateway for 1st packet` error. In some cases, site-to-site VPN tunnels also go down.* |
| *SMBGWY-18484* | *VPN* | *SNMPWalk queries for IPSec tunnel monitoring OIDs return `No Such Instance` errors.* |
| *SMBGWY-18624* | *VPN* | *Unable to configure All-Day or Multi-Day schedule via Remote Access VPN WebUI.* |
| *SMBGWY-18529* | *VPN* | *Remote Access VPN Phase 2 cannot be configured to use custom encryption and authentication methods.* |
| *SMBGWY-19565* | *VPN* | *SNMPwalk queries for VPN-related OIDs hang on a Centrally Managed cluster's standby member, though they work correctly on the active member.* |
| *SMBGWY-20107* | *VPN* | *L2TP Remote Access VPN connections fail when Site-to-Site VPN options are disabled.* |
| *SMBGWY-20681* | *VPN* | *The `fw load_sigs -b` APCL command fails* |
| *SMBGWY-18012* | *VPN* | *PCI compliance scan fails with these error messages (see [sk184658](https://support.checkpoint.com/results/sk/sk184658) ):* * *Weak Diffie-Hellman groups on UDP/500.* * *3DES encryption on UDP/500.* |
| *SMBGWY-19097* | *VPN* | *On Quantum Spark appliances (Locally Managed and Centrally Managed) the IKE daemon and VPN port listeners (UDP ports 500, 4500, 30500, and 34500) run continuously, regardless of whether the VPN feature is enabled or disabled.* |
| *SMBGWY-17613* | *VPN* | *When **Route Internet traffic from connected clients through this Security Gateway**is disabled (Split Tunnel mode) and the Local Encryption Domain is set to Automatic (default), the L2TP client does not receive the automatic encryption domain subnet route in its routing table.* |
| ***Build 996004721*** |||
| *SMBGWY-17136* | *General* | ***UPDATE** : Updated CRL and OCSP validation in Remote Access VPN, Site-to-Site VPN, and HTTPS Inspection to use HTTP/1.1 instead of HTTP/1.0. This ensures continued compatibility with DigiCert's updated requirements and prevents certificate validation failures. Refer to [sk183884](https://support.checkpoint.com/results/sk/sk183884).* |
| *SMBGWY-16556* | *General* | ***NEW** : Advanced Settings -- Third NTP Server* * *Added a checkbox in **Advanced Settings** to enable or disable the use of a third NTP server.* * *When enabled, an input field appears to specify the third NTP server address. The default value is time.google.com, and it is editable.* ***Fallback Usage Collector*** * *Added a field in the NTP collector to track the last time both NTP Server 1 and NTP Server 2 failed, and the system successfully used NTP Server 3.* |
| *SMBGWY-16544* | *General* | *Immediately after a cluster member reboots, it sends RIP/BGP/OSPF advertisements using its physical IP address instead of its Virtual IP (VIP) address.* |
| *SMBGWY-16775* | *General* | *In an Outgoing Internet Access Policy, the Action and Log settings of the CP_Products_Bypass_Rule cannot be changed.* |
| *SMBGWY-16636* | *General* | *LAN interface MAC address could be incorrectly assigned to a LANX interface during configuration.* |
| *SMBGWY-16936* | *General* | *Policies created in R77.20.xx and restored to R80.20.xx change behavior after upgrading to R81.10.17. A rule containing both a URL and services is treated as `AND`. However, after the unification into a single field `appsAndServies`, the rule effectively became `OR`.* |
| *SMBGWY-16459* | *General* | *When a Locally Managed appliance has more than 350 manual Access Policy rules configured, upgrading to R81.10.17 completes but reverts to the previous version after 15 minutes.* |
| *SMBGWY-16697* | *General* | *LANX cannot be used for a bridged internet connection on 1900/2000 appliances.* |
| *SMBGWY-16829* | *General* | *VLANs created on non-LAN ports were incorrectly assigned the MAC address of a LAN port.* |
| *SMBGWY-17369* | *General* | *Possible database corruption after upgrading from R81.10.10 or R81.10.15 to R81.10.17 Build 532--716 may cause internet connection errors or WebUI unresponsiveness.* |
| *SMBGWY-16468* | *GUI* | *The `show configuration` command fails with the error `Illegal characters in administrator password-hash`.* |
| *SMBGWY-16623* | *GUI* | *The **Categories**option does not appear in the WebUI.* |
| *SMBGWY-16896* | *GUI* | *When editing an internet connection with a WAN interface, selecting LANX and returning to WAN automatically enables the **Disable auto negotiation** checkbox.* |
| *SMBGWY-16650* | *GUI* | *Attempting to view host logs from the **Threat Prevention** \> **Infected Devices** section in the WebUI results in a `Page Not Found` error.* |
| *SMBGWY-16679* | *GUI* | *The thoroughput values displayed in the Quantum Spark WebUI are incorrect when compared to the actual performance.* |
| *SMBGWY-16538* | *GUI* | *In the **Security Logs** page in the WebUI, the IP column is too narrow for the IP addresses to be properly displayed.* |
| *SMBGWY-12630* | *VPN* | *Internet Key Exchange Security Association (IKE SA) information is stored in the kernel before the authentication exchange completes, which could trigger asynchronous flows, cause mismatched states with the peer, and result in outages.* |
| *SMBGWY-16733* | *VPN* | *A confirmation dialog for unsaved items appears in this specific scenario.* 1. *From the **Manually choose a VPN certificate** dropdown, **select Cloud Services provider certificate**.* 2. *Click **Save**.* 3. *Move to another page.* 4. *Return to **VPN** \> **Advanced Settings** \> **Remote Access Advanced Settings**, and a confirmation dialog appears.* |
| *SMBGWY-17064* | *VPN* | *When the appliance is in the Centrally Managed mode and uses MEP in a VPN star community as a satellite, failover between MEP centers causes the tunnel to either go down or remain connected to the non-active center.* |
| *SMBGWY-16831* | *VPN* | *When the pfrm2.0 partition becomes exhausted due to SAML Portal logs, VPN connections fail. The VPN attempts to authenticate with the Identity Provider (for example, Microsoft Entra ID) but eventually times out.* |
| *SMBGWY-17220* | *VPN* | *Routes are not added in MEP RIM configuration when the tunnel is created again after a reboot or failover\\failback.* |
| *SMBGWY-16941* | *VPN* | *In a rare scenario, the Gateway fails to find a valid certificate for a Remote Access (RA) VPN connection.* |
| *SMBGWY-17072* | *VPN* | *Previously, it was not possible to configure the parameter `internet-traffic-through-this-gw` for VPN Site-to-Site in Clish. It is now configurable with these Clish commands:* * *set vpn site internet-traffic-through-this-gw true* * *set vpn site internet-traffic-through-this-gw false* |
| *SMBGWY-17195* | *IPS* | *IPs protections added with IPS signatures are not displayed in the **Logging and Monitoring** Security Report.* |
| *SMBGWY-16306* | *Routing* | *In some scenarios, access to internal servers via bridge does not work properly. You can now restore the original behavior with this FW parameter: `fw_br_route_use_in_ifn=1`* |
| *SMBGWY-16383* | *Routing* | *When ND-proxy is enabled in the WebUI on an existing IPv6 internet-connection used by MAP-E, an old route is not deleted, causing connectivity issues.* |
| *SMBGWY-16685* | *Access Policy* | *A Network Object's group name or description cannot contain special characters.* |
| *SMBGWY-17055* | *Networking* | *After receiving DHCPv6 prefix via prefix delegation, the internal interface(example: LAN1) is assigned an IPv6 address/prefix, but SLAAC remains disabled. Workaround: Change IPv6 Auto Assignment to "SLAAC" manually.* |
| *SMBGWY-17282* | *VLANS* | *Deleting VLANs from a disabled port incorrectly enables the port while still displaying the port as disabled in the WebUI.* |
| ***Build 996004653*** |||
| *SMBGWY-10943* | *General* | ***New**: support for configuring IPv6 internet connections over LAN and LANX ports.* |
| *SMBGWY-16325* | *General* | *Quantum Spark Gateway fails to connect to Smart-1 Cloud through a Proxy server.* |
| *SMBGWY-15868* | *General* | *After removing an item from the **Infected Devices** page, the list becomes empty until the WebUI page is refreshed.* |
| *SMB-18388* | *General* | *SmartConsole sometimes shows inaccurate license information for Software Blades on Quantum Spark Appliances running R80.20.X: `No License` or `About to Expire`.* |
| *SMBGWY-16040* | *GUI* | *When configuring an IPv6 bridge composed of both LAN and WAN interfaces, the WAN interface does not appear as active in the 2D model interface statistics on the **Home**tab.* |
| *SMBGWY-15926* | *GUI* | *WebUI and Gaia Clish do not support configuring static routes with a 31-bit subnet mask (as specified in RFC 3021).* |
| *SMBGWY-15475* | *GUI* | *Security Log columns (Action, Source, Destination, and Service) are not visible in the WebUI when viewed on small screens.* |
| *SMBGWY-15970* | *GUI* | *The Japanese text for "Probing Settings" in Quantum Spark Management is truncated.* |
| *SMBGWY-15720* | *GUI* | *In the WebUI, the entire SD-WAN page becomes blank in this scenario:* 1. *In the WebUI, go to the **Access Policy** view \> **Firewall** section \> **SD-WAN** page* 2. *In the **Policy** section, click **New*** 3. *In the column **Application / Services** , click **+*** 4. *At the bottom, click **Add** \> **URL*** 5. *Enter the Name and the URL and click **Save*** 6. *The entire SD-WAN page becomes blank* |
| *SMBGWY-16369* | *VPN* | *Site to Site VPN tunnel between a Centrally Managed Quantum Spark Gateway and a VPN peer with a Dynamic IP address (DAIP) goes down after policy installation.* |
| *SMBGWY-16334* | *VoIP* | *When renaming a VoIP Network Group, this error appears when saving the configuration: `Cannot edit VoIP network object group.`* |
| *SMBGWY-15716* | *IoT* | *This error may appear in the WebUI **Access Policy** view \> **Firewall** section, when clicking the **IoT** page: `Internal error has occurred. If the problem persists, contact Check Point Technical Assistance Center.`* |
| *SMBGWY-16191* | *IoT* | *When upgrading a Quantum Spark appliance with IoC Feeds enabled from R81.10.17 Build 996004508 to Build 996004620, the appliance reboots after 10--15 minutes and reverts to the previous firmware version.* |
| ***Build 996004620*** |||
| *SMBGWY-15367* | *General* | ***New**: Added MAP-E and IPIP support for the BIGLOBE vendor in Japan.* |
| *SMBGWY-15461* | *General* | ***Enhancement**: Improved update handling for IPS, Anti-Malware, and Application Control: if an update fails, the system will retry after 24 hours or at the next scheduled update time, whichever occurs first.* |
| *SMBGWY-15339* | *General* | ***Enhancement** : Increased the minimum update interval for IOC feeds to 30 minutes. Administrators can manually reduce the interval using the `ioc_feeds force_interval` command, though shorter intervals may affect device performance and are not recommended.* |
| *SMBGWY-14643* | *General* | *When querying a Quantum Spark Gateway with SNMP, the values of OIDs with the 'Counter64' type are returned with the type 'String'. For example, OID 'memFreeReal64'.* |
| *SMBGWY-14877* | *General* | *In the Locally Managed mode, selecting Citrix Cloud Services in the source or destination columns of the Access Policy rulebase may result in a firewall policy error.* |
| *SMBGWY-13017* | *General* | *When a Quantum Spark Gateway is disconnected from Cloud Services, all settings options are grayed out, and the **Managed Services** - **Disable Logging to SD** option is set to true. However, logs continue to be saved on the SD card despite this setting. After reconnecting the Quantum Spark Gateway to Cloud Services, the settings options become available, but the **Disable Logging to SD** option remains unmodifiable.* |
| *SMBGWY-15884* | *General* | *After an upgrade, a Quantum Spark Gateway may fail to load the configuration for the enabled Software Blades in this scenario (the `configload_status` command shows `fw (Failed)` ):* 1. *You performed a clean install of a firmware image.* 2. *The Application Control package was updated.* 3. *In the **Access Policy** view \> **Firewall** section \> **Policy** page, in the **Applications and Services** column you selected a category that was not part of the default Application Control package that is built into the original firmware.* 4. *You upgraded the firmware image to a higher version that does not contain this Application Control category in its default Application Control package.* |
| *SMBGWY-15425* | *General* | *Periodic backups via FTP may fail for some FTP servers.* |
| *SMBGWY-13203* | *General* | *When creating a High Availability (HA) WAN Bond, the primary slave interface in the Bond is not always set according to the user's selection.* |
| *SMBGWY-15101, SMBGWY-15102* | *General* | *When a Quantum Spark Gateway is located behind a Network Address Translation (NAT) device and uses a Dynamically Assigned IP address (DAIP), it does not encrypt traffic that originates from the Gateway itself and is destined for the internal network of the VPN peer. In this configuration, the Gateway sends clear-text traffic through the NAT device before it enters the Site-to-Site VPN tunnel. This issue does not affect traffic originating from the Gateway's internal network.* |
| *SMBGWY-14782, SMBGWY-14923* | *General* | *In a rare scenario, the Quantum Spark Gateway may crash with these messages:: `;fwchain_is_non_inline: chain dir X, XXX -> XXX IPP XXX has invalid ifnum (-1)` `Unable to handle kernel NULL pointer dereference at virtual address XXX` `...` `PC is at fg_is_qos_active_on_chain+XXX` `LR is at fg_is_qos_active_on_chain+XXX` `...` `fg_is_qos_active_on_chain+XXX` `fw_ipsec_encrypt_ex+XXX` `vpn_encrypt_chain+XXX` `fwchain_do_ex+XXX` `...` `Starting crashdump kernel..`* |
| *SMBGWY-14883* | *CPOS* | *Resolved an issue in which spaces are not allowed in Wireless Network Names (SSIDs).* |
| *SMBGWY-15222* | *VPN* | *In rare scenarios, VPN stops working because the iked process fails to start.* |
| *SMBGWY-15853* | *VPN* | *The `vpn tu tlist -p ` command returns no information.* |
| *SMBGWY-15484* | *VPN* | *Configuring a VTI IP address with a last octet greater than 223 (e.g., 10.0.0.224) fails.* |
| *SMBGWY-14114* | *VPN* | *Remote Access (RA) VPN users lose internet access even though the **route all traffic to the gateway field** is enabled.* |
| *SMBGWY-15534* | *VoIP* | *One-way audio issue during calls when Session Initiation Protocol (SIP) inspection is enabled.* |
| *SMBGWY-15073* | *GUI* | *When trying to access a blocked website, the expected Check Point block page does not appear. Instead, this generic browser error appears: `This site can't be reached`.* |
| *SMBGWY-14158* | *GUI* | *The **Destination**field in existing SSL inspection policy rules is grayed out and cannot be edited.* |
| *SMBGWY-14966* | *GUI* | *After upgrading to R81.10.17, DSL interfaces were incorrectly shown as "disabled" in the WebUI, even though they were active. This status appeared in the 2D view on the **Overview** screen.* |
| *SMBGWY-15494* | *GUI* | *In the Japanese WebUI \> **Access Policy** \> **Servers** \> **New** \> select **Mail Server** \> click **Edit** , the **Edit Mail Server Ports** window does not show the fields **POP3** and **IMAP**.* |
| *SMBGWY-14861* | *GUI* | *Manual Upgrade results show overlapping Japanese fonts.* |
| *SMBGWY-14985* | *GUI* | *In the Firewall Access Policy, an "Auto Generated" rule may show the Service object "ANY", which is not supported in "Auto Generated" rules.* |
| *SMBGWY-14964, SMBGWY-14963* | *GUI* | *When editing an existing IPv4 over IPv6 internet connection (DS-Lite, IPIP, or MAP-E) alongside another IPv4 connection (examples: PPPoE, Static IP, or DHCP), the associated IPv6 Linked connection does not appear.* |
| *SMBGWY-15215* | *GUI* | *In the Firewall Access Policy, an "Auto Generated" rule may show an incorrect Service object.* |
| *SMBGWY-15374* | *GUI* | *The "Edit Rule" option for Incoming, Internal, and VPN traffic does not display all configuration settings. Specifically, the "Match only for encrypted traffic" option is missing.* |
| *SMBGWY-15660* | *GUI* | *After an upgrade from R81.10.10 to R81.10.17, when editing a local user group in the **User Management** tab, all previously assigned users are removed, and only the newly added user is retained.* |
| *SMBGWY-15785* | *GUI* | *In **Home** -\> **Cloud Services** -\> **Reports** -\> **Settings**, only "Daily" and "Weekly" reports are displayed even though "Monthly" reports are enabled in Quantum Spark Management.* |
| *SMBGWY-12026* | *WebUI* | *If a new Administrator user was configured to change the password at first login, then during the first login, clicking the **Cancel**button leads to an empty page.* |
| *SMBGWY-13303* | *Firewall* | *Quantum Spark Gateway may crash with a core dump file when installing the SD-WAN policy. This applies to the Locally Managed mode and the Centrally Managed mode.* |
| *SMBGWY-15515* | *Firewall* | *SIP inspection is disabled after an upgrade.* |
| *SMBGWY-15518* | *Firewall* | *The "Protection Name" field is not displayed in the IPS security logs.* |
| *SMBGWY-15714* | *Firewall* | *On the **Users \& Objects** \> **Services** page, when editing the port number of a system default service and clicking **Save** , the following error message appears: `Cannot change prototype of system default services`. Additionally, when the protocol type is set to None, the **Disable**Inspection checkbox is disabled.* |
| *SMBGWY-15816* | *Firewall* | *In the **Device** view \> **Network** section \> **Wireless** page, when clicking **Clone** \> **Save** , this error message appears: `Field must have a value.`* |
| *SMBGWY-12486* | *Firewall* | *In a Quantum Spark Cluster, it is possible to add additional interfaces to the SYNCBOND interface and to delete interfaces from the SYNCBOND interface in Gaia Clish.* |
| *SMBGWY-12903* | *Firewall* | *In a Quantum Spark cluster setup, changes made to DHCP advanced settings (example: DNS) on the Active Member's local connection are not synchronized with the Standby Member. As a result, hosts in the internal network of the Quantum Spark cluster could receive incorrect DHCP configurations after a cluster failover.* |
| ***Build 996004508*** |||
| *SMBGWY-13472* | *General* | ***Enhancement** : Added the **Export to CSV** option in WebUI \> **Device** view \> **Cloud Services** section \> **Extended Monitoring** page \> **Remote Access VPN** tab \> widget **Top users by duration**.* |
| *SMBGWY-12801* | *General* | *In some scenarios, upgrading to version R81.10.15 fails.* |
| *SMBGWY-12492* | *General* | *Logs are not sent to the Log Server when the connection between the Quantum Spark Gateway and the Log Server is over IPv6.* |
| *SMBGWY-13038* | *General* | *If one of the connected internal hosts (that receives its IP address from the Quantum Spark appliance's DHCP server) does not report its hostname to the Quantum Spark appliance, then it is not possible to show the DHCP Lease information for all connected internal hosts:* * *The **Home** view \> **Troubleshooting** section \> **Tools** page \> command "**DHCP leases**" shows "`No items found`".* * *The Gaia Clish command "`show dhcp-leases table`" shows "`No items found`".* |
| *SMBGWY-13717* | *General* | *A Quantum Spark appliance fails to boot in this scenario:* 1. *The appliance is restored to default settings.* 2. *IPv6 support is enabled in the Gaia Embedded OS settings.* |
| *SMBGWY-11460* | *General* | *The Quantum Spark Gateway does not get the correct time zone when connected to Quantum Spark Management with the Automatic GMT setting enabled.* |
| *SMBGWY-13258* | *General* | *The Quantum Spark Gateway fails to synchronize with the NTP server. Synchronization fails with this error: "`no server suitable for synchronization found.`"* |
| *SMBGWY-12404* | *General* | *Retrieving the asset interface with the "`arp -a"` command takes too long in some environments. The process now uses the connection table instead, improving response time.* |
| *SMBGWY-14099* | *General* | *In rare cases, the SIM switch may fail on the 1575RWL appliance model.* |
| *SMBGWY-12804* | *General* | *On 1600/1800/1900/2000 Quantum Spark Appliances, Internet connections of type "MAP-E dynamic" are stuck in the "connecting..." stage.* |
| *SMBGWY-13369* | *General* | *In Quantum Spark Management, logs from the Gateway are not received after a cluster failover event.* |
| *SMBGWY-12262* | *General* | *A cellular appliance with two SIMs configured with different carrier configuration packages fails to switch SIMs. The issue occurs only on old LTE systems (1570/1590/1570R).* |
| *SMBGWY-13483* | *General* | *When a Mapping of Address and Port with Encapsulation (MAP-E) connection is configured as dynamic and the actual environment is static, or when a MAP-E connection is configured as static and the actual environment is dynamic, the connection fails, but no clear error message appears in the system logs.* |
| *SMBGWY-14324* | *General* | *When used on 1900 and 2000 Quantum Spark Appliances, the "`show sfp-diag`" Clish command returns the following message: "` port has no SFP support.`"* |
| *SMBGWY-12495* | *General* | *The Gaia Clish command "`show configuration`" shows all Internet Connections as type "`pppoa"`.* |
| *SMBGWY-13927* | *General* | *You can now configure one or more aliases on the same subnet as the physical interface where the alias is configured. Previously, UI validation blocked this configuration.* |
| *SMBGWY-11002* | *CPOS* | ***Enhancement**: Added support for probing in the static default route, in which the next hop is a VTI or a GRE interface.* |
| *SMBGWY-12614* | *CPOS* | *Configuring DHCP relay on more than 50 interfaces causes the DHCP relay agent to stop working.* |
| *SMBGWY-12043* | *CPOS* | *After rebooting a Quantum Spark appliance, the MAC address for a bond interface changes. The fix enables MAC address override for WAN bond interfaces. Previously, the override could be set in the UI but was ignored.* |
| *SMBGWY-14213* | *CPOS* | *On Quantum Spark Cellular Appliances 1595 and 1595R, system logs repeatedly display these messages: "`No SIM in slot`" and "`SIM failure`".* |
| *SMBGWY-13809* | *CPOS* | *When restoring the configuration from a Quantum Spark appliance with a different number of ports, some static routes can point to invalid interfaces. For example, restoring a backup from a Quantum Spark 1400 appliance that has six switch ports on a Quantum Spark 1570R appliance that has eight switch ports.* |
| *SMBGWY-12414* | *CPOS* | *When using the "`set wlan radio operation-mode`" Clish command, you cannot change the radio band on Gateways with a single wireless module.* |
| *SMBGWY-13437* | *VPN* | ***Enhancement**: Improved the description of the advanced setting "Remote Access VPN - Legacy NAT traversal" to show "Accept NAT traversal (affects both VPN Site to Site and Remote Access)".* |
| *SMBGWY-11699* | *VPN* | *The following error appears when you run the "`add/set administrator`" command or reconfigure Remote Access (RA) VPN local users on a new Quantum Spark Gateway using the configuration from your previous Gateway. `Could not set local-user password-hash: Not valid password hash.` The command only validates password hashes when they use the DES or MD5 hash functions.* |
| *SMBGWY-13325* | *VPN* | *In rare scenarios, a connection over a Site-to-Site VPN tunnel passing through a Quantum Spark Gateway may experience interruptions. This occurs when the connection is initiated by a host that is not directly connected to the Quantum Spark Gateway. **Example of an affected topology** : \[Site to Site VPN source\] === \[Router\] === \[Quantum Spark Gateway\] === \[Site to Site VPN destination\]* |
| *SMBGWY-12306* | *VPN* | *The Security Logs do not contain the "`Key Install`" log when a Site to Site VPN Tunnel is established.* |
| *SMBGWY-13386* | *VPN* | *When creating a new VPN site, the configuration page fails to load and continues spinning indefinitely until the user exits the window.* |
| *SMBGWY-13932* | *VPN* | *On 1900/2000 appliances, a GRE interface is not created properly and does not appear in the output of the "`ifconfig`" command.* |
| *SMBGWY-11643* | *VPN* | *In a Site to Site VPN, a Quantum Spark cluster does not hide the VPN probing packets (RDP) behind the cluster Virtual IP. The cluster sends the RDP packets with the source IP address of a cluster member instead of the VIP address, and with a source port from an internal pool instead of source port 259.* |
| *SMBGWY-12538* | *GUI* | *In a specific case, WebUI \> **Device** view \> **Advanced Routing** section \>**Routing Table** page does not show the configured VTI interface in the column **Next Hop** in static routes.* |
| *SMBGWY-12044* | *GUI* | *The right-click menu does not appear for rules in WebUI \> **Access Policy** view \> **Firewall** section \> **Policy**page.* |
| *SMBGWY-12766* | *GUI* | *In WebUI \> **Device** view \> **Network** section \> **Internet** page \> edit an Internet connection \> in the **Type** field, select **IPv4 over IPv6 (IPIP)** . The field titles of "**BR address** " / "**AFTR address** " do not change correctly when selecting values in the section **VNE Settings** in the field **Service name**.* |
| *SMBGWY-13563* | *GUI* | *"`Web server error`" and "`An internal error has occurred`" popups when creating a new Network Object on a Locally Managed Quantum Spark Gateway. See [sk183210](https://support.checkpoint.com/results/sk/sk183210).* |
| *SMBGWY-13206* | *GUI* | *In a rare case, disabling IoT in the WebUI (in **Access Policy** view \> **Firewall** section \> **IoT** page) may cause traffic issues. When logging into the WebUI, the "**System Error** " popup appears with these lines: `An Internal error has occurred` `If the problem persists, contact Check Point Technical Assistance Center` `Web server error`* |
| *SMBGWY-11766, PRHF-33612* | *Firewall* | ***UPDATE**: Optimized the Generic Data Center JSON file processing on the Security Gateways to improve performance when handling a large number of IP ranges.* |
| *SMBGWY-14054* | *Firewall* | *Centrally Managed Quantum Spark Gateway does not send "Bypass" logs for HTTPS Inspection of white-listed categories and services.* |
| *SMBGWY-14090* | *Firewall* | * *Traffic sent to the Quantum Spark Cluster Virtual IP addresses is not matched to rules that include the Dynamic Object "This Gateway" in the "Destination" column.* * *Traffic sent from the Quantum Spark Cluster Virtual IP addresses is not matched to rules that include the Dynamic Object "This Gateway" in the "Source" column.* |
| *SMBGWY-14171* | *Firewall* | *Improved the way system logs are saved on an SD card:* 1. *When an SD card is detected, a system log is written on the SD card, in addition to the `/var/log/messages` file.* 2. *When the system log's size reaches 200KB, a backup of it is compressed (in the gzip format) and saved on the SD card. The log is then truncated.* 3. *Up to 100 of the most recent backups are kept.* |
| *SMBGWY-12323* | *Firewall* | *The body of Check Point emails with the subject "**Spark Notification Service - Attention Required: Administrator logged in to Expert Shell** " contains the string "`(null)`" instead of the administrator username and contact information: `A connection of type SSH initiated by administrator , +(null), (null), from XXX to Expert Shell on `* |
| *SMBGWY-13288* | *Firewall* | *Quantum Spark Appliance upgrade in SmartConsole fails if there is insufficient free space in the /storage partition. See [sk183082](https://support.checkpoint.com/results/sk/sk183082).* |
| *SMBGWY-13332* | *Firewall* | *"`idapi_load_data_impl: session id XXX not found in client_db, although ip XXX was assigned to it`" appears repeatedly in the `/var/log/messages` file. See [sk167174](https://support.checkpoint.com/results/sk/sk167174).* |
| *SMBGWY-13252* | *Firewall* | *A Locally Managed Quantum Spark cluster member may go down when using OSPF and configuring the Access Policy in Strict mode (**Access Policy** \> **Firewall** \> **Blade Control**).* |
| *SMBGWY-14395* | *Firewall* | *When configuring two or more Internet Connections in the High Availability mode, the directly-attached subnets of the non-active Internet Connections may not be reachable.* |
| *SMBGWY-14115* | *Firewall* | *In WebUI \> **Logs and Monitoring** view \> **Logs** section \> **System Logs** ,the page repeatedly shows "`Error`" entries like these for some interfaces: `[CPOSD] Error: Illegal value _enable for field: mode` `[CPOSD] Error: Failed to set object: network`* |
| *SMBGWY-12348* | *Firewall* | *The Identity Awareness Blade displays the error message "`At least one server has many disconnection occurrences in the last hour`" in SmartConsole on the standby member of a centrally managed Spark cluster.* |
| *SMBGWY-12952* | *Firewall* | *During policy installation, the CPU could reach 100% usage for extended periods (up to several minutes) due to how large batches of IPs were processed in updatable objects.* |
| *SMBGWY-12940* | *WebUI* | ***Enhancement** : Customizable popup windows. A new **Advanced Settings** parameter allows users to configure whether clicking outside a popup closes it or keeps it open. By default, popups close when users click outside them.
**Key Features** :* * *Customizable Behavior -- Choose whether background clicks dismiss popups.* * *Easy Configuration -- Adjust this setting in the **Advanced Settings** panel.* |
| *SMP-8666* | *WebUI* | *In Quantum Spark Management, in **Remote access** \> **Statistics**, a Gateway on which Two-Factor Authentication (2FA) was enabled shows 2FA as disabled.* |
| *SMBGWY-12523* | *WebUI* | *The WebUI stops working when you edit an IPv6 interface.* |
| *SMBGWY-12892* | *IPS* | *When you switch the mode of the IPS Software Blade to Intrusion Detection System (IDS), some protections (examples: command injection, SQL injection) remain active even though the IDS mode should set all protections to "Detect."* |
| *SMBGWY-13818* | *Cluster* | *A cluster member stops sending multicast PIM traffic after failover or a reboot.* |
| *SMBGWY-13489* | *Cluster* | *A cluster configured with Virtual MACs (VMACs) may silently drop traffic arriving to the Internet Connection.* |
| *SMBGWY-12365* | *IoT* | *After an asset was recognized as working with a randomized MAC Address ("Locally Administered Address (LAA) MAC), when this asset connects again, the Quantum Spark Gateway does not send this asset again for recognition.* |
{#Filter_R811015Table}
R81.10.15 Resolved Issues and Enhancements
------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
> |----------------------------|--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | **ID** | **Category** | **Description** |
> | **Build 996003913** |||
> | SMB-19844 | General | **Enhancement** : OpenSSH has been upgraded to version 9.8p1, which contains the fix for [CVE-2024-6387](https://support.checkpoint.com/results/sk/sk182459). |
> | SMBGWY-10328, SMBGWY-10327 | General | Improved the stability of the "`sfwd`" daemon when the IPS blade is enabled on a Centrally Managed Quantum Spark Gateway. |
> | SMBGWY-6374 | General | Locally Managed Quantum Spark Gateway generates "Accept" logs for all TCP DNS queries to external DNS servers. |
> | SMBGWY-10470 | General | Restarting (for example, disabling/enabling) an Internet connection causes other Internet connections on the same interface to restart. |
> | SMBGWY-11425 | General | On some Wired 1500 series models, the 802.1x authentication may not work. |
> | SMBGWY-8050 | General | The default behavior is to forward DNS requests to all configured DNS servers. Starting in this build, you can change the behavior to forward the DNS requests only to the DNS servers configured in the Primary Internet connection. For more information, refer to the [R81.10.X Quantum Spark 1500, 1600, 1800, 1900, 2000 Appliances Locally Managed Administration Guide](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Default.htm) (section: Managing the Device \> Configuring the DNS Server). |
> | SMBGWY-9678 | General | Monthly report is sent two times in one month. |
> | SMBGWY-10494 | General | `Error 00351` when creating a Custom Service Object/Group. |
> | SMBGWY-11136 | CPOS | High CPU use on a Locally Managed Quantum Spark appliance with a bridge interface configuration after an upgrade from R80.20.xx to R81.10.xx. |
> | SMBGWY-10892 | CPOS | After enabling MAC Filtering, instead of opening the WebUI on a Quantum Spark Gateway, the web browser shows an empty page with this error: "`Either invalid input was specified or an internal error has occurred. If the problem persists contact Check Point Technical Assistance Center"`. This issue occurs on 1600 / 1800 / 1900 / 2000 models with an advanced LAN configuration (for example, Bridge, Bond). |
> | SMBGWY-9881 | CPOS | Wireless channel 169 is missing from the list of channels that should not participate in Automatic Channel Selection (ACS). As a result, the automatic mechanism may select this unsupported channel, and the WebUI would show this error: "`Value is not valid" when configuring a Wireless connection`". |
> | SMBGWY-10877 | VPN | Manual selection of a Remote Access VPN certificate for the strongSwan client does not work on a Locally Managed Quantum Spark Gateway. |
> | SMBGWY-9889, SMBGWY-9391 | VPN | Site to Site VPN may fail to work on a Locally Managed Quantum Spark Cluster (because the VPN Tunnel Test packets are not sent as expected). |
> | SMBGWY-10109 | VPN | Site to Site VPN may fail to work on a Centrally Managed Quantum Spark Gateway after establishing SIC for the second time. |
> | SMBGWY-9297 | VPN | IKE negotiations in a Site to Site VPN might fail in IKE Packet #3 on a Centrally Managed Quantum Spark Gateway managed with SmartProvisioning.
**Immediate Workaround** : On a Quantum Spark Gateway, run these commands in the Expert mode: 1. f`w ctl set int ike_in_separate_daemon 0` 2. `sfwd_restart` |
> | SMBGWY-9562 | VPN | A Remote Access VPN connection with the strongSwan client using IKEv2 does not work. |
> | SMBGWY-11491 | VPN | Multiple packets that enter the same VPN tunnel may be encrypted with the same sequence number. As a result, the VPN peer may treat this traffic as a replay attack. |
> | SMBGWY-11356 | GUI | After you add more than eight Network objects into the Network Object Group object and save it, when you open this Network Object Group object, it shows only eight objects. To see other objects, you must click the last object and then press the down arrow key on the keyboard. |
> | SMBGWY-10490 | GUI | The **Configure Cluster**button in the WebUI may not open the wizard. |
> | SMBGWY-10707 | GUI | The WebUI shows the status "`No Internet access (probing failed)`" for `monitored `Internet connections when ISP Redundancy is disabled. |
> | SMBGWY-10750 | Firewall | MAC Filtering may stop working on 1500 models (traffic may be blocked for allowed MAC addresses). |
> | SMB-19803 | Firewall | Disabling an internet connection that uses one of the LAN ports in 1600/1800/1900/2000 might cause the switch configuration to be partially applied. |
> | SMBGWY-10713 | VoIP | Error "`sip_any-tcp service has overlapping ports`" when editing the "**SIP_TCP** " service object in the **Users \& Objects** view \> **Network Resources** section \> **Services** page. Error "`SIP_TCP service has overlapping ports`" when editing the "**sip_any-tcp** " service object in the **Users \& Objects** view \> **Network Resource** s section \> **Services**page. |
> | SMBGWY-10301 | VoIP | After a policy modification, there is a brief interruption of NAT connections from the Internet to internal hosts. |
> | SMBGWY-10650 | ClusterXL | After a cluster failover, a Quantum Spark Cluster Member may stop sending its logs to the Infinity Portal \> Quantum Spark Management service. |
> | SMBGWY-10769 | WebUI | It is not possible to configure the same VLAN ID on different Internet connections. |
> | SMBGWY-11758, SMBGWY-11429 | WebUI | Instead of opening the WebUI, the web browser shows "`500 Internal Error`" and "`There was an unusual problem serving the requested URL`". |
> | SMBGWY-9842 | IoT | On a Centrally Managed Quantum Spark Gateway, many IoT assets appear in the **Unrecognized** section of the WebUI \> **Home** view \> **Monitoring** section \> **Assets**page. |
> | SMBGWY-11602 | IoT | In a cluster of Locally Managed Quantum Spark Gateways, IoT Discovery may not work when the Firewall blade is configured in the Strict Mode. |
> | SMBGWY-10429 | IoT | "`Assets discovery is at maximum. All newly connected assets will appear as unrecognized`" warning in the WebUI because there are too many IoT log entries in the */tmp/log/iot_lmm.elg*file. |
> | SMBGWY-10649 | IoT | High CPU utilization when the IoT blade is enabled because multiple domain objects are created automatically in the Network Group objects used for the IoT policy. |
> {#Filter_R811015Table}
R81.10.10 Resolved Issues and Enhancements
------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
> |--------------------------|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | **ID** | **Category** | **Description** |
> | **Build 996002993** |||
> | SMB-19844 | General | **Enhancement** : OpenSSH has been upgraded to version 9.8p1, which contains the fix for [CVE-2024-6387](https://support.checkpoint.com/results/sk/sk182459). |
> | **Build 996002945** |||
> | **SMBGWY-9641** | **VPN** | **Added the protection against CVE-2024-24919 - a vulnerability in Security Gateways with Remote Access VPN enabled. Refer to [sk182357](https://support.checkpoint.com/results/sk/sk182357).** |
> | SMBGWY-7140, SMBGWY-7476 | GUI | **NEW** : Ability to configure messages for the CLI login: * A Banner message - a message that appears before the user enters their credentials. * A Message-of-the-Day (MOTD) - a message that appears after a user logs in. These messages appear only in CLI for an SSH connection and a Serial (Console) connection.
In the R81.10.X CLI Guide, refer to these commands: * `set message banner` * `set message motd` |
> | SMBGWY-8593 | General | **NEW**: Support for Wildcards on Locally Managed Quantum Spark appliances. Wildcards represent IP addresses that share a common pattern (for example: all IP hosts with the IP address 250 on different networks: 192.168.\*.250 / 24). You can use these Wildcard objects in the Access Policy in the "Source" or the "Destination" columns. |
> | SMBGWY-8276 | General | **Enhancement** : In the **Logs \& Monitoring** view \> **Status** section \> **Assets** page \> **Actions** \> **Export assets to a csv file** \> added these new columns **MAC Address** , **IP Address** , **Interface** , **Blocked**('true' or 'false') |
> | SMBGWY-8816 | General | **Enhancement** : Added new Gaia Clish commands : * `set interface-type ` * `show interface-type ` |
> | SMBGWY-7530 | General | Implemented fail-accept ability for parser errors. |
> | SMBGWY-8248 | General | Expired certificates are not removed completely from the appliance when deleted manually. |
> | SMBGWY-9423 | General | Configuring the custom logo does not work in R81.10.10. It is not possible to configure the logo through the WebUI (in WebUI \> Device \> Advanced Settings \> Web Interface Settings and Customizations - Use a company logo in the appliance's web interface) or through Clish. |
> | SMBGWY-9004 | General | SSL Inspection stops working for some HTTPS web sites because Trusted CA certificates are not updated automatically (WebUI \> **Access Policy** \>**SSL Inspection** \> **Advanced**page). |
> | SMBGWY-8895 | General | Quantum Spark Gateway may crash. |
> | SMBGWY-9298 | General | A "`System Error`" popup appears with this message when opening the Home view \> **System** page: `An internal error has occurred.` `If the problem persists, contact Check Point Technical Assistance Center` `Web server error` |
> | SMBGWY-8959 | General | On the 1535 model, the error "`Value is not valid`" appears in WebUI \> **System** section \> **Device** page in the **Web portal certificate** field when selecting a previously uploaded 3rd-party Root CA certificate and clicking **Apply** . Refer to [sk182293](https://support.checkpoint.com/results/sk/sk182293). |
> | SMBGWY-9553 | General | Gaia OS Scheduled Backups to an SCP server fail. |
> | SMBGWY-8507 | General | SNMP query for memory utilization OID .1.3.6.1.4.1.2620.1.6.7.4 returns an Active Virtual Memory (memActiveVirtual64) value that is less than the Active Real Memory (memActiveReal64) value. |
> | SMBGWY-9493 | General | It is not possible to modify your own admin unless you are a Super Admin. |
> | SMBGWY-8331 | VPN | SNMP query for OID "tunnelTable" (the list of VPN Tunnels) returns "`CHECKPOINT-MIB::tunnelTable: No entries`". |
> | SMBGWY-7712 | VPN | In rare cases, when using ISP Redundancy in the High Availability mode, and there is an ISP Link failover from the cellular ISP to the regular ISP, the VPN tunnel recovery mechanism might fail.
**Immediate Workaround** : 1. Connect to the command line on the Quantum Spark Gateway. 2. Log in to the Expert mode. 3. Set the value of the kernel parameter "`vpn_force_configload_upon_failover`" to 1: `fw ctl set int vpn_force_configload_upon_failover 1` 4. Clear the VPN cache: `vpn tu tlist del all` |
> | SMBGWY-9297 | VPN | IKE negotiations in a Site to Site VPN might fail in IKE Packet #3 on a Centrally Managed Quantum Spark Gateway that is managed with SmartProvisioning.
**Immediate Workaround** : On a Quantum Spark Gateway, run these commands in the Expert mode: 1. f`w ctl set int ike_in_separate_daemon 0` 2. `sfwd_restart` |
> | SMBGWY-9440 | GUI | 1. Go to **Device** \> **Network** section \> **Internet**. 2. Edit the Internet connection of type **IPv4 over IPv6 (IPIP)**. 3. In the section **VNE Settings** , in the field **Service name** select **v6plus Static IP service**. 4. The checkbox **Unnumbered IP address** does not appear. **Immediate Workaround** : 1. In the section**VNE Setting** s, in the field **Service name** select another service. 2. In the section **VNE Settings** , in the field **Service name** select **v6plus Static IP service** again. |
> | SMBGWY-9560 | GUI | Error "`The settings overlap with those of another network or bridge`" in the WebUI when configuring a LAN interface with the same IPv4 address as was assigned in an Internet connection of type **IPv4 over IPv6 (IPIP)** in the field **BR addres**s. |
> | SMBGWY-8512 | Firewall | When a cluster of Quantum Spark appliances is connected to Smart-1 Cloud, and an administrator configures the interface "maas_tunnel" as "Non-monitored" in SmartConsole in the cluster object, the cluster configuration may not recognize the interface "maas_tunnel" as "Non-monitored" ("Disconnected"). As a result, the cluster changes the state of this interface to "DOWN". **Immediate Workaround** : On each cluster member, manually add the interface "maas_tunnel" to the configuration file. Run this command in the Expert mode: `echo "maas_tunnel" >> $FWDIR/conf/discntd.if` |
> | SMB-19803 | Firewall | Disabling an internet connection that uses one of the LAN ports in 1600/1800/1900/2000 might cause the switch configuration to be partially applied. |
> | SMBGWY-9513 | Threat Prevention | The "Categorized HTTPS Sites" option does not classify specific websites when "TLS 1.3 hybridized Kyber support" is enabled in the browser. Refer to [sk182318](https://support.checkpoint.com/results/sk/sk182318). |
> | **Build 996002906** |||
> | SMBGWY-8050 | General | The default behavior is to forward DNS requests to all configured DNS servers. Starting in this build, you can change the behavior to forward the DNS requests only to the DNS servers configured in the Primary Internet connection. For more information, refer to the [R81.10.X Quantum Spark 1500, 1600, 1800, 1900, 2000 Appliances Locally Managed Administration Guide](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Default.htm) (section: Managing the Device \> Configuring the DNS Server) |
> | SMBGWY-8630 | General | The IoT Protection remains enabled after an administrator enabled the IoT Protection in the Locally Managed mode and changed the configuration to the Centrally Managed mode. |
> | SMBGWY-6194 | General | "'`Web server error`" in the First Time Wizard while trying to move forward from "Step 6 - Wireless Network" to the next step. |
> | SMBGWY-8176 | General | CPU load may increase on a Locally Managed appliance with enabled IoT protection if an IoT device changes its MAC address repeatedly. |
> | SMBGWY-8336 | General | Text in System Logs that are related to Cloud configuration (Quantum Spark Management, Smart-1 Cloud, and so on) may contain internal parameter names instead of the parameter values. |
> | SMB-17498 | Access Policy | "`Error has occurred while applying the Firewall settings (error 00351)`" when saving a Firewall Access Policy rule that contains a Group object (in Source or Destination) that contains a Network object of type 'Device'. Such unsupported configuration is now blocked. |
> | SMBGWY-8288 | VPN | The "`vpn tu`" command fails to delete VPN IPsec SAs and VPN IKE SAs when using Visitor Mode. |
> | SMBGWY-8519 | VPN | A Remote Access VPN client cannot connect to a Quantum Spark in the Centrally Managed mode because the DynamicID authentication fails to send an email with a one-time password.
The Remote Access VPN client: 1. Shows the "Connecting to site" progress bar 2. Shows the authentication window: > `Authenticating user 'XXX'. Please fill the required input.` > `User XXX authenticated by FireWall-1 authentication` > `DynamicID timeout failure. To retry, please type r and select Submit.` |
> | SMBGWY-8212 | CPOS | DHCP Server functionality may not work on tagged-based VLANs configured on LANX interfaces. |
> | SMBGWY-7819 | GUI | When editing an interface in the WebUI, the **Advanced** tab in the **Link speed** field shows an unsupported value `1 Gbps/Half duplex`. |
> | SMBGWY-8028 | GUI | In First Time Wizard, on the **Wireless Network** page, even though the checkbox **Protected network**is cleared, it is still necessary to enter a password. |
> | SMBGWY-8256 | GUI | The WebUI shows `N/A` for the ranks of OSPF routes. |
> | SMBGWY-2120 | GUI | To disable the "Connect to the appliance by name from the Internet (DDNS)" option, it is necessary to enter the DDNS password again. |
> | SMBGWY-8189 | Firewall | Security Gateway may reboot unexpectedly after a policy installation. |
> | SMBGWY-8052 | Firewall | The cluster state of a Standby cluster member constantly changes between "Down" and "Standby". |
> | SMB-19803 | Firewall | Disabling an internet connection that uses one of the LAN ports in 1600/1800/1900/2000 might cause the switch configuration to be partially applied. |
> | SMBGWY-8556 | Firewall | The Gaia Clish command "`show configuration`" shows the string "`nil`" instead of the interface name in commands for configuring DHCP Options. Example: `set dhcp server interface "nil" custom-option name ...` |
> | SMBGWY-8631 | Firewall | **New Feature** : In the `ioc_feeds` command on a Centrally Managed Gateway, added support for IoC Feed from a custom CSV format. Supported IoC types: IP Address, Domain Name, MD5 Hash, SHA1 Hash, SHA256 Hash. |
> | **Build 996002845** |||
> | SMBGWY-7839 | General | The *SFWD* daemon crashes in this scenario: 1. SNMP Trap is configured to send a trap when a VPN tunnel is down (OID 1.3.6.1.4.1.2620.1.2000.8.1) 2. Multiple VPN tunnels are in the down state |
> | SMBGWY-8103 | General | When configuring BGP with "local-address" (for both AS and the peer), the BGP peering is stuck in the "Idle" state: `set bgp external remote-as local-address ` `set bgp external remote-as peer local-address ` |
> | SMBGWY-7135 | General | After you fetch the policy from the cloud, the new policy might not be applied. |
> | SMBGWY-7083 | General | The Quantum Spark appliance automatically removes files from the "`/tmp`" partition if the file becomes full. |
> | SMBGWY-6870 | General | If multiple internet connections are configured on the appliance, associating an internet connection during the configuration of an unnumbered VTI interface results in the association of an incorrect internet connection. |
> | SMBGWY-6711 | General | The `/tmp` directory becomes full when the "`cloud_update_gw_stats.xml`" file grows too large. This file is created for cloud updates in cpdiag, but is not applicable to Quantum Spark. |
> | SMBGWY-7576 | General | If no IPv6 address/prefix is acquired through SLACC/DHCPv6, the Internet connection is not established, even if an IPv6-prefix was acquired through PD (Prefix-Delegation). |
> | SMBGWY-7486 | General | Although in Infinity Portal \> in Quantum Spark Management \> **Plans** view \> edit a Plan \> in the "**Services** " section \> on the "**Firmware** " page, the option "**The firmware version is managed locally on the device**" is selected, the managed Quantum Spark appliances automatically upgrade their firmware. |
> | SMBGWY-6296 | CLI | Creating a VPN site in Gaia Clish fails with the error "`Incomplete command`". |
> | SMBGWY-8154 | CPOS | In some scenarios, a misconfiguration on a DNS Server may lead to the exhaustion of ephemeral ports on the Security Gateway. |
> | SMBGWY-6029 | VPN | On centrally managed Quantum Spark appliances, when you query the status of a permanent VPN tunnel with the "`snmpwalk`" command, the command prints duplicate statuses for the tunnel. |
> | SMBGWY-7153 | VoIP | SIP calls do not work when the internal PBX and the external VoIP provider use different signaling ports. |
> | SMBAUTO-57 | VoIP | Add Gaia Clish commands to configure and view VoIP settings: * `set voip` (press the Tab key to see the options) * `show voip` |
> | SMBGWY-7529 | Gaia Embedded OS | If in version R81.10.00 or versions R80.20.xx, you added a static route with enabled monitoring (with the Gaia Clish command "`add static-route ... monitored-ip on`"), then after an upgrade to version R81.10.05 or version R81.10.07, the configured probing fails because the configured monitored IP address became corrupted in the Gaia Embedded OS configuration. |
> | SMBGWY-7197 | GUI | When you connect to Cloud Services and change some advanced settings, this web server error appears: `An internal error has occurred.` ` If the problem persists, contact Check Point Technical Assistance Center` |
> | SMBGWY-8115 | Firewall | In a cluster connected to Smart-1 Cloud, local probing may start on the "maas_tunnel" interface, although it is not monitored by the cluster (output of the Expert command "`cphaprob -i list`" or the Gaia Clish command "`show cluster members pnotes problem`" shows that the Critical Device "Local Probing" reports its state as "problem"). |
> | SMBGWY-7902 | Firewall | The output of the "`fw ver`" and "cpstat os" commands on a 1555 model shows the model as '1550'. |
> | SMBGWY-7084 | Firewall | A Quantum Spark cluster member in the Active state loses its OSPF neighbors if its cables are disconnected and then connected again, even though its cluster state changes to Standby. |
> | SMBGWY-6348 | Firewall | When you enable Virtual MAC (VMAC) mode on a centrally managed cluster, the standby member sends GARP packets. |
> | SMBGWY-6690 | Firewall | MAC address flapping occurs between cluster members when a bridge interface is configured in the cluster. See [sk181859](https://support.checkpoint.com/results/sk/sk181859). |
> | SMBGWY-7775 | Firewall | Quantum Spark appliance drops multicast traffic on a Bridge interface with the log "IP routing failed (bridge routing failure)". See [sk182050](https://support.checkpoint.com/results/sk/sk182050). |
> | SMBGWY-6869 | Core | On 1600/1800 Quantum Spark appliances, the size of the Firewall memory pool's initial allocation (hmem) is too high. As a result, the available memory is lower than expected. |
> | SMBGWY-7782 | WebUI | When the WebUI language is changed to Japanese, some notifications are not displayed in Japanese. |
> | SMBGWY-7954 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**FW Monitor Tool** ". **Warning** - When you select this option, the CPU load increases. |
> | SMBGWY-7955 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**Firewall Ctl Tool** ". **Warning** - When you run this tool, the CPU load increases. |
> | SMBGWY-7957 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**VPN Debug Tool** ". **Warning** - When you run this tool, the CPU load increases. |
> | SMBGWY-6588 | WebUI | In WebUI, in the **Device** view -\> **System** section \> **Tcpdump Tool** - it takes a long time to start showing the output if you expand the **Advanced** section and select **VPN**. |
> {#Filter_R811010Table}
R81.10.08 Resolved Issues and Enhancements
------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
> |-------------------------|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | **ID** | **Category** | **Description** |
> | **Build 996001750** |||
> | **SMBGWY-9641** | **VPN** | **Added the protection against CVE-2024-24919 - a vulnerability in Security Gateways with Remote Access VPN enabled. Refer to [sk182357](https://support.checkpoint.com/results/sk/sk182357).** |
> | SMBGWY-8593 | General | **New**: Support for Wildcards on Locally Managed Quantum Spark appliances. Wildcards represent IP addresses that share a common pattern (for example: all IP hosts with the IP address 250 on different networks: 192.168.\*.250 / 24). |
> | SMBGWY-7839 | General | The *SFWD* daemon crashes in this scenario: 1. SNMP Trap is configured to send a trap when a VPN tunnel is down (OID 1.3.6.1.4.1.2620.1.2000.8.1) 2. Multiple VPN tunnels are in the down state |
> | SMBGWY-9513 | Threat Prevention | The "Categorized HTTPS Sites" option does not classify specific websites when "TLS 1.3 hybridized Kyber support" is enabled in the browser. Refer to [sk182318](https://support.checkpoint.com/results/sk/sk182318). |
> | SMBGWY-8050 | General | The default behavior is to forward DNS requests to all configured DNS servers. Starting in this build, you can change the behavior to forward the DNS requests only to the DNS servers configured in the Primary Internet connection. For more information, refer to the [R81.10.X Quantum Spark 1500, 1600, 1800, 1900, 2000 Appliances Locally Managed Administration Guide](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Default.htm) (section: Managing the Device \> Configuring the DNS Server) |
> | SMBGWY-8103 | General | When configuring BGP with "local-address" (for both AS and the peer), the BGP peering is stuck in the "Idle" state: `set bgp external remote-as local-address ` `set bgp external remote-as peer local-address ` |
> | SMBGWY-7135 | General | After you fetch the policy from the cloud, the new policy might not be applied. |
> | SMBGWY-7083 | General | The Quantum Spark appliance automatically removes files from the "`/tmp`" partition if the file becomes full. |
> | SMBGWY-6870 | General | If multiple internet connections are configured on the appliance, associating an internet connection during the configuration of an unnumbered VTI interface results in the association of an incorrect internet connection. |
> | SMBGWY-6711 | General | The `/tmp` directory becomes full when the "`cloud_update_gw_stats.xml`" file grows too large. This file is created for cloud updates in cpdiag, but is not applicable to Quantum Spark. |
> | SMBGWY-7576 | General | If no IPv6 address/prefix is acquired through SLACC/DHCPv6, the Internet connection is not established, even if an IPv6-prefix was acquired through PD (Prefix-Delegation). |
> | SMBGWY-7486 | General | Although in Infinity Portal \> in Quantum Spark Management \> **Plans** view \> edit a Plan \> in the "**Services** " section \> on the "**Firmware** " page, the option "**The firmware version is managed locally on the device**" is selected, the managed Quantum Spark appliances automatically upgrade their firmware. |
> | SMBGWY-6296 | CLI | Creating a VPN site in Gaia Clish fails with the error "`Incomplete command`". |
> | SMBGWY-8154 | CPOS | In some scenarios, a misconfiguration on a DNS Server may lead to the exhaustion of ephemeral ports on the Security Gateway. |
> | SMBGWY-6029 | VPN | On centrally managed Quantum Spark appliances, when you query the status of a permanent VPN tunnel with the "`snmpwalk`" command, the command prints duplicate statuses for the tunnel. |
> | SMBGWY-7712 | VPN | In rare cases, when using ISP Redundancy in the High Availability mode, and there is an ISP Link failover from the cellular ISP to the regular ISP, the VPN tunnel recovery mechanism might fail.
**Immediate Workaround** : 1. Connect to the command line on the Quantum Spark Gateway. 2. Log in to the Expert mode. 3. Set the value of the kernel parameter "`vpn_force_configload_upon_failover`" to 1: `fw ctl set int vpn_force_configload_upon_failover 1` 4. Clear the VPN cache: `vpn tu tlist del all` |
> | SMBGWY-8519 | VPN | A Remote Access VPN client cannot connect to a Quantum Spark in the Centrally Managed mode because the DynamicID authentication fails to send an email with a one-time password.
The Remote Access VPN client: 1. Shows the "Connecting to site" progress bar 2. Shows the authentication window: > `Authenticating user 'XXX'. Please fill the required input.` > `User XXX authenticated by FireWall-1 authentication` > `DynamicID timeout failure. To retry, please type r and select Submit.` |
> | SMBGWY-7153 | VoIP | SIP calls do not work when the internal PBX and the external VoIP provider use different signaling ports. |
> | SMBAUTO-57 | VoIP | Add Gaia Clish commands to configure and view VoIP settings: * `set voip` (press the Tab key to see the options) * `show voip` |
> | SMBGWY-7529 | Gaia Embedded OS | If in version R81.10.00 or versions R80.20.xx, you added a static route with enabled monitoring (with the Gaia Clish command "`add static-route ... monitored-ip on`"), then after an upgrade to version R81.10.05 or version R81.10.07, the configured probing fails because the configured monitored IP address became corrupted in the Gaia Embedded OS configuration. |
> | SMBGWY-7197 | GUI | When you connect to Cloud Services and change some advanced settings, this web server error appears: `An internal error has occurred.` ` If the problem persists, contact Check Point Technical Assistance Center` |
> | SMBGWY-8115 | Firewall | In a cluster connected to Smart-1 Cloud, local probing may start on the "maas_tunnel" interface, although it is not monitored by the cluster (output of the Expert command "`cphaprob -i list`" or the Gaia Clish command "`show cluster members pnotes problem`" shows that the Critical Device "Local Probing" reports its state as "problem"). |
> | SMBGWY-7902 | Firewall | The output of the "`fw ver`" and "cpstat os" commands on a 1555 model shows the model as '1550'. |
> | SMBGWY-7084 | Firewall | A Quantum Spark cluster member in the Active state loses its OSPF neighbors if its cables are disconnected and then connected again, even though its cluster state changes to Standby. |
> | SMBGWY-7530 | General | Implemented fail-accept ability for parser errors. |
> | SMBGWY-6348 | Firewall | When you enable Virtual MAC (VMAC) mode on a centrally managed cluster, the standby member sends GARP packets. |
> | SMBGWY-6690 | Firewall | MAC address flapping occurs between cluster members when a bridge interface is configured in the cluster. See [sk181859](https://support.checkpoint.com/results/sk/sk181859). |
> | SMBGWY-7775 | Firewall | Quantum Spark appliance drops multicast traffic on a Bridge interface with the log "IP routing failed (bridge routing failure)". See [sk182050](https://support.checkpoint.com/results/sk/sk182050). |
> | SMBGWY-6869 | Core | On 1600/1800 Quantum Spark appliances, the size of the Firewall memory pool's initial allocation (hmem) is too high. As a result, the available memory is lower than expected. |
> | SMBGWY-7782 | WebUI | When the WebUI language is changed to Japanese, some notifications are not displayed in Japanese. |
> | SMBGWY-7954 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**FW Monitor Tool** ". **Warning** - When you select this option, the CPU load increases. |
> | SMBGWY-7955 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**Firewall Ctl Tool** ". **Warning** - When you run this tool, the CPU load increases. |
> | SMBGWY-7957 | WebUI | In WebUI, in the **Device** view \> **System** section \> **Tools** page \> added "**VPN Debug Tool** ". **Warning** - When you run this tool, the CPU load increases. |
> | SMBGWY-6588 | WebUI | In WebUI, in the **Device** view -\> **System** section \> **Tcpdump Tool** - it takes a long time to start showing the output if you expand the **Advanced** section and select **VPN**. |
> | **Build 996001683** |||
> | SMBGWY-6117 | General | It is not possible to access services accelerated by SmartAccel when the Internet connection MTU value is below the default |
> | SMBGWY-6234 | General | Removing "external Custom Intelligence Feeds" from SmartConsole and installing the policy do not take effect, and traffic is blocked as if the feeds were not removed. |
> | SMBGWY-5785 | General | In some scenarios, the SD-WAN next hop is not reachable, which causes link failure. |
> | SMBGWY-5297 | Firmware | When Anti-Virus blade is enabled, it is possible to fetch a maximum of only 4 emails with POP3 (110). |
> | SMBGWY-6026 | Firmware | The output of the `fw ctl affinity -l` is incomplete and contains this error regarding the IRQs of network devices: *No such file or directory* *fwaff_read_ifn_irq: error in getting irq values* |
> | SMBGWY-6620 | Firmware | A malicious email notification shows the protocol as SMTP regardless of the actual protocol used. |
> | SMBGWY-5328 | CLI | The output of the `ips stat` command shows "*Failed to read IPS profiles*". |
> | SMBGWY-5856 | CLI | The output of the Gaia Clish command `show configuration` stops with this text: `HostName> show configuration` `... ...` `# Fonic settings allow traffic to pass directly between two network ports (bridged by hardware) even if power is out` `/pfrm2.0/bin/lua: /pfrm2.0/bin/cli/showConfig.lua:0: attempt to index a nil value` `stack traceback:` ` /pfrm2.0/bin/cli/showConfig.lua: in main chunk` ` /pfrm2.0/bin/cli/showConfig.lua: in main chunk` ` [C]: at 0x00013625` `HostName>` |
> | SMBGWY-6443 | CLI | The output of the Gaia Clish command `show configuration` stops with this text: `HostName> show configuration` `... ...` `delete static-routes` `/pfrm2.0/bin/lua: /usr/local/share/lua/5.1/sys/model.lua:0: staticRoutes.1.getCalculated_interfaceWrapper property or method does not exist.` `stack traceback:` ` [C]: in function 'error'` ` /usr/local/share/lua/5.1/sys/model.lua: in function '__index'` ` /usr/local/share/lua/5.1/app/model/staticRoutes.lua: in function ''` ` /usr/local/share/lua/5.1/sys/LCM.lua: in main chunk` ` /usr/local/share/lua/5.1/sys/CDL.lua: in function 'smartGetByPath'` ` /pfrm2.0/bin/cli/showConfig.lua: in function 'command name'` ` /pfrm2.0/bin/cli/showConfig.lua: in function 'showConfig_staticRoutes'` ` /pfrm2.0/bin/cli/showConfig.lua: in main chunk` ` [C]: at 0x00013625` `HostName>` |
> | SMBGWY-6381 | Backup - Restore | In the centrally managed mode, after you restore settings from a backup, performing an additional settings backup may fail. |
> | SMBGWY-5034 | CPOS | For some Internet connection types, it is not possible to change the MTU value. |
> | SMBGWY-5591 | CPOS | In some scenarios, the process in charge of dynamic routing (*routed* ) starts before the process in charge of the OS (*cposd*). |
> | SMBGWY-5969 SMBGWY-5945 | CPOS | When a cellular Internet connection with only one SIM loses its DHCP lease, it may stay stuck trying to get a new DHCP lease. |
> | SMBGWY-5552 | Logging \& Monitoring | It is not possible to disable the sending of specific notifications to SMS/Mail. |
> | SMBGWY-5596 | Logging \& Monitoring | It is not possible to disable the sending of specific notifications to the Watch WatchTower application. |
> | SMBGWY-5759 | VPN | The VPN Passthrough feature introduced in R81.10.08 does not work. |
> | SMBGWY-6180 | VPN | When handling UDP packets with identical source and destination ports (example: 3343), the S2C packet is dropped if it arrives first. |
> | SMBGWY-5508 | VoIP | Incoming traffic is dropped on a cleanup rule instead of matching the SIP rule. |
> | SMBGWY-5272 | WebUI | During the configuration of IPv6 static routes in the WebUI, a message appears to reload the page. |
> | SMBGWY-5640 | WebUI | The WebUI does not display some images (branding fix). |
> | SMBGWY-5531 | WebUI | The WebUI homepage and login do not correctly show white labeling texts and images for features. |
> | **Build 996001608** |||
> | SMBGWY-5760 | WebUI | The "*fwtmp partition is about to be full*" notification in the WebUI is not translated correctly and shows the system variable. |
> {#Filter_R811008Table}
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content