> Source: [sk185040](https://support.checkpoint.com/results/sk/sk185040)
# sk185040 - Check Point R82.20 Release Known Limitations
| Property | Value |
|----------|-------|
| Solution ID | sk185040 |
| Date Created | 2026-06-09 |
| Last Modified | 2026-10-07 |
| Technical Level | General |
| Products | Check Point Firewall, Security Management Server |
| Versions | R82.20 |
## Solution
### This article lists all R82.20 Release-specific known limitations and unsupported features, including those from previous versions.
For more information about R82.20, see the [R82.20 Release Notes](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_RN/Default.htm), [R82.20 Home Page](https://support.checkpoint.com/results/sk/sk185039), and [R82.20 Resolved Issues](https://support.checkpoint.com/results/sk/sk185041).
Visit the [Check Point CheckMates Community](https://community.checkpoint.com) to ask questions, start a discussion, and get assistance from our experts.
**Important notes:**
* To see if an issue has been fixed in other releases or Jumbo Hotfixes, search for the issue ID in Support Center.
* To get a fix for an issue listed below, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) with the issue ID.
Click Here to Show the Entire Article
Unsupported Features **Show this section**
**Table of Contents**
|-----------------------------------------------------------------------------------------|-----------------------------------------------------|---------------------------------------------------------------------------------------|
| * SmartConsole / Management Console * SmartProvisioning * Check Point Firewall * SD-WAN | * ClusterXL * SecureXL * VSNext * Threat Prevention | * Content Awareness * Mobile Access * VPN * ElasticXL and Maestro Hyperscale Firewall |
Enter the string to filter the below table:
{#Unsupported-SmartConsole}{#Unsupported-SmartProvisioning}{#Unsupported-SecurityGateway}{#Unsupported-SD-WAN}{#Unsupported-ClusterXL}{#Unsupported-VSNext}{#Unsupported-Threat Prevention}{#Unsupported-Content Awareness}{#Unsupported-Mobile Access}{#Unsupported-VPN}
|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Unsupported Features - SmartConsole / Management Console |||
| PMTR-59345 | Central Deployment in SmartConsole does not support: * Connection from SmartConsole to the Management Server through a proxy Server. In this case, use the applicable API command. * ClusterXL in Load Sharing mode * Standalone server * Installation of a package on a VSX VSLS Cluster that contains more than 3 members * Standby Security Management Server or Multi-Domain Security Management * Quantum Maestro | R81 |
| PMTR-104470 | SmartConsole does not support (or has limited support) the High Contrast Theme in these sections and windows: * "Gateways \& Servers" view \> select a Security Gateway / Cluster object \> at the top, click the Actions menu \> click Install Hotfix, or Version Upgrade * "Gateways \& Servers" view \> select a Security Gateway / Cluster object \> in the lower pane, click the Licenses tab * "Gateways \& Servers" view \> at the top, click Changes * "Security Policies" view \> Autonomous Threat Prevention \> click Policy, or File Protections * "Security Policies" view \> Access Control policy or Threat Prevention policy \> at the top, click Changes * "Manage \& Settings" view \> Sessions \> View Sessions \> at the top, click Changes * "Manage \& Settings" view \> Sessions \> Revisions \> at the top, click Changes * "Manage \& Settings" view \> Sessions \> Revisions \> select a revision \> at the top, click the Actions menu \> Revert to this Revision * "Manage \& Settings" view \> Package Repository | R81.10 |
| PROV-2200 | The "Get Interfaces" operation on the "Network Management" page of a Security Gateway (or Cluster) object only supports up to 500 interfaces of all types. * **To resolve:**If the Security Gateway (or Cluster) has 500 or more interfaces of all types, use the API `get-interfaces` on the Management Server to pull this information. Examples: 1)`get-interfaces target-name with-top?logy false` 2) `get-interfaces target-name with-top?logy true`For more information, refer to the Management API. | R81 |
| - | Changes to the Traditional Anti-Virus file types policy is not supported. Use the Anti-Virus blade to change the out-of-the-box Check Point policy. | R80 |
| Unsupported Features - SmartProvisioning |||
| PMTR-124448 | SmartProvisioning managing with SmartLSM Profiles and Provisioning Profiles is not supported on Windows Server 2025. | R82.20 |
| PMTR-109023 | SmartProvisioning / SmartLSM is not supported in VSNext mode. | R82 |
| Unsupported Features - Check Point Firewall (Security Gateway) |||
| PMTR-60143 | The `perf` command is not supported on Threat Emulation appliances and on all other Check Point appliances that have only one or two CPU cores. * On these appliances, use the `top` and `turbostat` commands to monitor the performance. | R81.10 |
| PMTR-58361 | Intra-Tunnel Inspection of GTP-U user traffic is not supported. | R81 |
| PMTR-58366 | The "Produce extended logs on unmatched PDUs" option is not supported in the Security Gateway (Cluster) object \> Carrier Security \> Track. As a result, it is not possible to generate informative logs for unmatched GTP-C control packets (except for a plain clean-up rule logging). | R81 |
| Unsupported Features - SD-WAN |||
| PMTR-129847 | When the Check Point Security Gateway is configured to act as an HTTP/HTTPS Proxy, SD-WAN does not support steering the proxy traffic generated by the Security Gateway towards the Internet. In this scenario, the client traffic is terminated on the Security Gateway proxy service, and the Security Gateway itself initiates the outbound connection to the Internet. SD-WAN does not steer this gateway-generated proxy traffic. | R82.20 |
| PMTR-131318 | SD-WAN does not support WAN interfaces configured with a /31 prefix length. | R82.20 |
| PMTR-108481 | Anti-Spam, Threat Emulation, and Threat Extraction Blades do not support Security Gateways with Dynamically Assigned IP (DAIP). | R82 |
| PMTR-108485 | SD-WAN Overlay does not support VPN Tunnel between gateways while both sides behind CGNAT / Dynamic NAT. | R82 |
| PMTR-107839 | SD-WAN Overlay does not support the "Exclude gateway's external IP addresses from the VPN Domain" configuration. | R82 |
| PMTR-106717 | In a Spoke-Hub-Spoke configuration, an encrypted connection from a Satellite SD-WAN DAIP Security Gateway to another Satellite Security Gateway VPN Domain is not supported when both conditions are met: * The source IP is from a Dynamic IP interface * The connection is routed through the central Security Gateway | R82 |
| PMTR-108004 | SD-WAN does not support "Overlay - VPN" over Route Based VPN configured with unnumbered VPN Tunnel Interfaces (VTI). | R82 |
| PMTR-105725 | In a cluster, SD-WAN does not support interfaces in which the "Network Type" is set to "Private" (Non-Monitored Interface). | R82 |
| PMTR-105213 | SD-WAN Overlay VPN is only supported between Check Point Security Gateways that are connected to the same tenant. | R82 |
| PMTR-105370 | SD-WAN Overlay VPN does not support the configuration of the probing IP address. By default, SD-WAN Overlay VPN probing sends ICMP requests only to the IP addresses of the VPN Peers. | R82 |
| PMTR-105209 | SD-WAN Overlay VPN is supported only between Check Point Security Gateways managed by the same Security Management Server. | R82 |
| PMTR-108031 | SD-WAN Overlay VPN is supported only between Check Point Security Gateways managed by the same Domain Management Server. | R82 |
| PMTR-108901 | SD-WAN does not support using DAIP Security Gateway objects in Access Control rules (neither in the Source column, nor in the Destination column). | R81.20 |
| PMTR-104984 | SD-WAN does not support VPN Route Injection Mechanism (RIM) configuration. | R81.20 |
| PMTR-104981 | SD-WAN does not support IPv6 traffic. | R81.20 |
| PMTR-105533 | SD-WAN does not support Security Gateways that are managed with SmartProvisioning / LSM Profiles. | R81.20 |
| PMTR-105543 | SD-WAN does not support Geo Cluster in Microsoft Azure. | R81.20 |
| PMTR-105544 | SD-WAN does not support Geo Cluster in Google Cloud Platform (GCP). | R81.20 |
| Unsupported Features - ClusterXL |||
| PMTR-59404 | Geo Cluster does not support IPv6 traffic. Therefore, it is not supported to configure an IPv6 address on the Cluster and Sync interfaces. | R81 |
| Unsupported Features - VSNext |||
| PMTR-109340 | Virtual Gateway / Virtual System in Monitor Mode is not supported. | R82 |
| PMTR-109011 | The "Mirror and Decrypt" feature is not supported in VSNext mode. | R82 |
| PMTR-109016 | Enhanced Link Selection is not supported. | R82 |
| PMTR-109026 | Mail Transfer Agent (MTA) for Threat Emulation is not supported in VSNext mode. | R82 |
| PMTR-109028 | Alias / Secondary IP address is not supported in VSNext mode. | R82 |
| PMTR-109029 | ECMP (Equal Cost Path Splitting - Static Routs) is not supported. | R82 |
| PMTR-109032 | Web SmartConsole is not supported when working in VSNext mode. | R82 |
| PMTR-109033 | Object Sharing from on-premises Management Server to Check Point Portal is not supported. | R82 |
| PMTR-109034 | Log Sharing from on-premises Management Server to Check Point Portal is not supported. | R82 |
| PMTR-109035 | Playblocks is not supported in VSNext mode. | R82 |
| PMTR-108070 | ISP Redundancy is not supported in VSNext mode. | R82 |
| PMTR-109023 | SmartProvisioning / SmartLSM is not supported. | R82 |
| PMTR-111386 | Maestro in VSNext mode do not support DHCP Server configuration. | R82 |
| Unsupported Features - Threat Prevention |||
| PMTR-42537 | Threat Prevention does not support files with the HTTP 206 partial format with multiple ranges in the same HTTP connection (multipart). | R80.40 |
| PMTR-129398 | SSH Deep Packet Inspection limitations: * Outbound inspection is not supported. * Traditional VSX and VSNext deployments are not supported. * Cluster members do not synchronize data about the inspected SSH traffic. | R80.40 |
| Unsupported Features - Content Awareness |||
| PMTR-130034 | UserCheck Popups are not supported in IPv6-only network environments. The UserCheck redirect mechanism relies on IPv4 addressing for the portal communication flow and cannot establish the required session in a pure IPv6 topology. Administrators operating in IPv6-only environments should configure policy response actions that do not depend on UserCheck notifications. | R82.20 |
| PMTR-125229 | Workforce AI Security solution is not supported in Global Domains of a Multi-Domain Management environment. | R82.20 |
| PMTR-125225 | Workforce AI Security solution is not supported in Active-Active deployments - Maestro and ElasticXL environments. Administrators could configure Content-Awareness policy response actions (block/allow) that do not rely on UserCheck notifications in these environments. | R82.20 |
| Unsupported Features - Mobile Access |||
| PMTR-60331 | These limitations apply to the Guacamole feature: 1. A dedicated Apache Guacamole Server version 1.1.0 or higher is required. 2. The following Guacamole features are not supported: * The VNC protocol * RDP file transfer * The SFTP protocol * Session recording 3. RDP/SSH is not supported from Capsule Workspace. 4. RDP/SSH is supported only by web browsers with HTML5 support. 5. RDP and SSH applications can be configured only by using their corresponding service objects in SmartConsole: * "Remote_Desktop_Protocol" * "SSH" * "SSH_version_2" 6. The Clipboard function in RDP sessions is supported with these limitations: * Text only * Supported browsers: Chrome and Explorer 7. This Single Sign-On option is not supported for Guacamole applications: "This application reuses the portal credentials. If authentication fails, Mobile Access prompts users and stores their credentials" 8. In a VSX environment where the "custom user directory attribute" feature is used, adding a new Virtual System requires manually adding the *customUserRecordAttribute.conf* file as well. | R81 |
| PMTR-58003 | Mobile Access rules in the Unified Access Policy do not support Native Applications that authorize non-TCP or non-UDP services (for example, "*icmp-proto*"). | R81 |
| PMTR-47745 | The Mobile Access Portal does not support Web-Form SSO for Citrix StoreFront Web interface. | R80.10 |
| PMTR-47591 | Mobile Access does not support viewing or editing files with "*Office Online apps"*, Microsoft's browser-based Office applications. Outlook Web Access is supported, however you cannot open or edit Office Online app files from emails. | R7x |
| Unsupported Features - VPN |||
| AAD-2302 | IKEv2 VPN tunnels and Remote Access VPN connections may fail to establish when fragmented packets are encountered during IKEv2 negotiation, because IKEv2 Fragmentation is not supported. | R81.20 |
| PMTR-60396 | Large Scale VPN (LSV) does not support: * IPv6 * Route Based VPN (VTI) * Two VPN peers behind the same NAT device * Suite-B-GCM-128 * Suite-B-GCM-256 with IKEv1-only (it is necessary to change the global properties of Phase 1 for Remote Access VPN) * Multiple Hubs * Route Injection Mechanism (RIM) * IKE Aggressive Mode * Permanent Tunnel * Multiple Entry Point (MEP) VPN * Dead Peer Detection (DPD) * Global VPN Community (GVC) * Tunnel Per Security Gateway pair (Universal Tunnel) | R80.40 |
| PMTR-47783 | NAT-T initiator is not supported on VSX Gateways. | R80.10 |
{#limitationTable}
ElasticXL and Maestro Hyperscale Firewall Unsupported Features {#Unsupported-SP}
--------------------------------------------------------------------------------
Enter the string to filter the below table:
{#NSF_General}{#NSF_GaiaOS}{#NSF_Hardware}{#NSF_Licensing}{#NSF_Cluster}{#NSF_VSX}{#NSF_VSX}{#NSF_Networking}{#NSF_VPN}{#NSF_IA}{#NSF_DLP}
|------------------------|-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Product | Description | Found in version |
| ElasticXL and Maestro Unsupported Features - General ||||
| PMTR-131996 | Maestro | Connecting the 9400 and 9700 appliance models in the same Security Group is not supported. Refer to [sk162373](https://support.checkpoint.com/results/sk/sk162373). | R82.20 |
| PMTR-108783 | ElasticXL | DHCP Server is not supported on ElasticXL. | R82 |
| PMTR-107886 | ElasticXL | Interface Active Check (IAC) is not supported on ElasticXL. | R82 |
| PMTR-111368, MBS-9128 | All | The Unique IP address per Chassis (UIPC) feature is not supported for IPv6 addresses. | R80.20SP |
| PMTR-111386, MBS-3246 | Maestro | Maestro in VSNext mode does not support the DHCP Server configuration | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Gaia OS ||||
| PMTR-101680 | ElasticXL | ElasticXL supports IP Broadcast Helper (iphelper) in Gaia OS only when two ElasticXL Sites are configured. | R82 |
| PMTR-108178 | ElasticXL | In the Gaia First Time Configuration Wizard, when configuring the first ElasticXL Cluster Member, it is possible to configure an IP address only on the "Mgmt" (Management) interface. This is done on the "Management Connection" page of the wizard. Configuring an IP address on any other interface, such as on the "Internet Connection" page of the wizard, is not supported. | R82 |
| PMTR-111362, MBS-13308 | All | The `set iphelper` (IP Broadcast Helper) commands are not supported in Gaia gClish. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Hardware ||||
| PMTR-111375, MBS-4754 | All | Central Management of Gaia Device Settings is not supported: 1. In SmartConsole, click "Gateways \& Servers" on the navigation panel. 2. Right-click the Gateway object or the Maestro Security Appliance Gateway object. 3. The "Scripts" menu and "Actions" menu are not supported. | R80.20SP |
| PMTR-111360, MBS-5227 | Maestro | It is not supported to install both of the following expansion cards in the same Security Appliance connected to a Maestro Hyperscale Orchestrator: * 10 GbE and 40 GbE * 10 GbE and 100 GbE | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Licensing ||||
| PMTR-111374, MBS-7929 | Maestro | Central License is not supported on Maestro. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Cluster ||||
| PMTR-99761 | ElasticXL | Bridge is not supported on ElasticXL in Load Sharing mode. | R82 |
| PMTR-111390, MBS-12227 | Maestro | Active-Active cluster does not support Maestro. | R81 |
| PMTR-111364, MBS-7913 | Maestro | Cluster Control Protocol (CCP) encryption is not supported. | R80. 30SP |
| ElasticXL and Maestro Unsupported Features - SecureXL ||||
| PMTR-122236 | ElasticXL | Policy-Based Routing (PBR) with ElasticXL requires configuring the incoming interface and any PBR rules. | R82 |
| ElasticXL and Maestro Unsupported Features - VSX ||||
| PMTR-111371, MBS-16945 | All | NAT46 is not supported in VSX. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Networking ||||
| PMTR-111442, MBS-14222 | Maestro | Maestro does not support Dynamic Routing protocols over GRE tunnels. | R81 |
| PMTR-104455, MBS-3946 | Maestro | Maestro does not support Carrier Security (LTE). | R80.20SP |
| PMTR-111367, MBS-12823 | All | "*6in4 tunnel*" interface is not supported. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - VPN ||||
| PMTR-111847, MBS-12310 | Maestro | Maestro does not support Large Scale VPN (LSV). | R81 |
| PMTR-111366, MBS-14408 | All | Simultaneous Login Prevention (SLP) is not supported. | R80.20SP |
| PMTR-111444, MBS-4097 | All | Remote Access VPN from IPv6 clients is not supported. | R80.20SP |
| AAD-1653, MBS-8316 | All | IPv6 VPN is not supported. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - Identity Awareness ||||
| PMTR-111378, MBS-14460 | Maestro | Maestro Security Group does not support the Identity Awareness Captive Portal if the L4 distribution is enabled. | R80.20SP |
| ElasticXL and Maestro Unsupported Features - DLP ||||
| PMTR-111370, MBS-13243 | All | Data Loss Prevention does not support rules with the Action "Ask". | R80.20SP |
{#SPTable}
*** ** * ** ***
Known Limitations
**Check Point Firewall** / Identity Awareness / Gaia OS / Traditional VSX \& VSNext / VPN / ClusterXL / SecureXL
Check Point Firewall \| Identity Awareness \| Gaia OS \| Traditional VSX / VSNext \| VPN \| ClusterXL \| SecureXL
Enter the string to filter the below table:
{#Security Gateway}{#Identity Awareness}{#Gaia OS}{#VSX}{#VPN}{#ClusterXL}
|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Check Point Firewall |||
| PMTR-129882 | Even if configured, the policy fetch interval is not enforced for the static IP address Firewall. | R82.20 |
| PMTR-92527 | The `enabled_blades` command shows these errors instead of the expected output when running this command multiple times in parallel: `cat: /tmp/bladesStatus/blades_list: No such file or directory` `sed: can't read /tmp/bladesStatus/local_obj: No such file or directory` | R82 |
| PMTR-59152 | Traffic on a single GRE tunnel cannot be distributed to multiple CoreXL Firewall instances. Therefore, the maximum throughput of a single GRE tunnel is limited by the throughput of a single CoreXL Firewall instance. | R81 |
| PMTR-47316, PMTR-17546 | Logging session does not switch to the backup logging Server after connectivity loss. Refer to [sk118697](https://support.checkpoint.com/results/sk/sk118697). | R7x |
| Identity Awareness |||
| PMTR-117380 | When working in parallel with the Management API and SmartConsole, sometimes you cannot navigate to/from the Sharing Identity page. * **To resolve:** close and reopen the SmartConsole. | R82.10 |
| Gaia OS |||
| PMTR-131804 | A snapshot cannot be reverted to a different appliance of the same model. | R82.10 |
| PMTR-81308, GAIA-3345 | Changing the MTU on the directly connected switches may cause drops of fragmented traffic due to an MTU mismatch. | R80.30 |
| PMTR-47577 | If the backup schedule is changed to an invalid date or time, all backup schedules are lost, and the *"Backup schedule failed. The backup will not be scheduled"* error message is displayed. | R80.10 |
| Traditional VSX / VSNext |||
| PMTR-130099 | In some scenarios, after boot, VSX comes up in a Down state instead of becoming standby as expected. This prevents VS failover, and other operations may also fail. **To resolve:** Run the `cpstart` command on the down VSs. | R82.20 |
| PMTR-120495 | It is not recommended to run the `fw unloadolcal` command on a VSX/VSNext, as this may break packet forwarding on all virtual switches. | R82 |
| VPN |||
| PMTR-132137 | In some scenarios, when a VCE Cloud task completes with warnings after applying changes, the notification displays the status "Completed with warnings." but does not include the reminder *"To apply the changes, install the Access Control Policy."* | R82.20 |
| PMTR-101631 | The "IPSec VPN" page in the Security Gateway object still shows a selected VPN Community, even though the configuration changes were discarded. Refer to [sk182068](https://support.checkpoint.com/results/sk/sk182068). | R82 |
| PMTR-68228 | If the Diffie-Hellman (DH) group configuration is changed (SmartConsole \> Global Properties \> Remote Access \> VPN - Authentication and Encryption \> Encryption algorithms \> Edit \> Phase 1 \> Use Diffie-Hellman group) while an Endpoint VPN client is connected, the client disconnects during the next Phase 2 negotiation. | R81 |
| PMTR-55445 | Site to Site VPN with a Large Scale VPN profile can drop traffic after decryption with the log " *According to policy traffic shouldn't have been decrypted* ".
**To prevent this traffic drop** :
1. Edit the Large Scale VPN profile object: 1. On the VPN Domain page, in the section "IP addresses allowed in the VPN Domain" select "Restrict to these groups or networks" 2. Select the applicable "Host", "Network", and "Group" objects. 2. Edit the LSV peer object: 1. In the VPN Domain (Encryption Domain), select the "Address Range" objects, whose IP addresses contain the IP addresses of the "Host", "Network", and "Group" objects you selected in the Large Scale VPN profile object. 3. Install the Security Policy. | R81 |
| PMTR-33694, PMTR-44902 | After running the `cpstop ; cpstart` commands, the "*FW-1: fwconn_chain_get_opaque: invalid id -1*" message appears repeatedly on the screen and in the dmesg. This is a cosmetic issue only. | R80.20 |
| PMTR-58668 | If a Security Gateway with PIM configured is part of a VPN community, PIM service must be added to the Excluded Services in the VPN community object. This only applies in one of these scenarios: * Security Gateway is directly connected to a multicast sender * Security Gateway is configured as a PIM Rendezvous Point | R80.10 |
| PMTR-47752 | The VPN client shows as " *Not Compliant* " when it is not compliant according to the local.scv file, even if SCV is disabled. * **To resolve**: Configure the VPN site again on the client. | R80.10 |
| PMTR-47501 | When using a VPN client, activity logs are not generated for ICMP traffic. | R7x |
| ClusterXL |||
| ACCHA-3403 | Traffic outage may occur in a ClusterXL / VSX Virtual System configured in the Active/Standby Bridge Mode after a cluster failover that was caused by the disconnection of the direct bridge link. | R80.10 |
{#GatewayTable}
*** ** * ** ***
**Security Management** / Compliance / Logging / SmartProvisioning
Security Management \| Compliance \| Logging \| SmartProvisioning
Enter the string to filter the below table:
{#Quantum Security Management}{#Compliance}{#Logging}{#SmartProvisioning}
|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Security Management |||
| PMTR-85908 | When configuring the SD-WAN interface of the Security Gateway with the `set_sdwan` command and then perform "Get Interfaces" in SmartConsole while the interface has already been listed on the Network Management page (as internal), the interface may not turn to external as expected. * **To resolve:** Remove this interface from the Network Management page and perform "Get Interfaces" again. | R81.10 |
| PMTR-56141 | When fetching a VPN Tunnel Interface (VTI) from Cluster Members using the `get-interfaces` Management API command, you must configure the Cluster VIP address using the `set simple-cluster` API before publishing the session. Examples: 1. `mgmt_cli -s sid.txt set-simple-cluster name cluster1 interfaces.update.name vpnt1 interfaces.update.interface-type "private"` 2. `mgmt_cli -s sid.txt set-simple-cluster name cluster1 interfaces.update.name vpnt1 interfaces.update.interface-type "cluster" interfaces.update.ip-address 1.2.3.4 interfaces.update.ipv4-mask-length 24` | R81 |
| PMTR-81309, PRHF-14607 | Running a one-time script on a Security Gateway (that reads files or outputs of commands) using a "One Time Script" feature in SmartConsole or with API may fail after 5 minutes with the "Operation timed out" error. The limit for reading files is 9,730 lines or 730 KB (whichever is reached first). | R80.10 |
| Compliance |||
| PMTR-47756 | In a Multi-Domain Management environment, in the local Domain policy, some Compliance best practices, which validate the status of rules in the policy, incorrectly identify the section header, "Parent section for domain rules," as a rule, and report it as not valid. * **To resolve**: Manually exclude this result from the Best Practices view. To do so, in the Best Practices view, select the practice. In the bottom pane \> Relevant Object section \> double-click the desired rulebase object and disable the rule/section from the list. | R80.10 |
| Logging |||
| PMTR-131252 | In some scenarios, starting the affected domain with the `mdsstart_customer` command works, and the domain stays up until the next reboot, when the same domain fails again. Refer to [sk185255](https://support.checkpoint.com/results/sk/sk185255). | R82.20 |
| PMTR-92829 | The output of the commands `cpstat mg -f log_server` or `cpstat ls -f logging` on a Security Management Server or Log Server that receives logs from a Maestro Security Group displays Log Receive Rate only for the individual Security Group Member (SMO), and not the combined log receive rate for all Security Group Members in the group. | R81.10 |
| SmartProvisioning |||
| PMTR-49235 | A new object called "NewObject" is left in SmartConsole when an administrator creates a new object with same name as an object that exists in SmartProvisioning. * **To resolve**: Either click "No" when SmartConsole shows "Do you want to keep changes anyway?" or manually delete the new object called "NewObject". | R81 |
| PMTR-1568 | When working with LSM managed Security Gateways in a Management High Availability environment, creating and working with LSM Gateways must be consistent, they can only be used in the Security Management Server they are created in. Using the secondary Security Management Server might lead to inconsistent actions/status related to LSM objects. | R80.20.M1 |
{#ManagementTable}
*** ** * ** ***
**SmartConsole** / Management Console / SmartLog / SmartView
{#Management_Console}{#SmartLo}
|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| SmartConsole / Management Console |||
| PMTR-131475 | In the Virtual System object \> General Properties \> Network Security tab, there is no space between the last Blade checkbox and the description panel below it. The checkbox text touches the top of the grey description panel. The issue is cosmetic only. | R82.20 |
| PMTR-62190 | When creating a test user via the Mobile Access configuration page, the user's password is limited to 8 characters. | R81.20 |
| PMTR-81166 | In a Multi-Domain Environment, when log in with SSO to a Domain behind NAT, the Security Gateway object will load but not open. * **To resolve:** Connect to the Domain directly. | R81.20 |
| PMTR-71266 | In SmartConsole, the "Get Interfaces" operation in a cluster object does not fetch interfaces with IP addresses from the 1.1.1.0 subnet. * **To resolve:** Use the `get-interfaces` Management API. | R81.20 |
| PMTR-58272 | In the "Gateways \& Servers" view, the "Task" tab in the bottom pane does not show messages about a successful license attachment (shows messages only about a failed license attachment). | R81.10 |
| PMTR-31345 | In languages other than English, the blades in the summary tab are not arranged correctly. | R80.30 |
| PMTR-31193 | Search for disabled or expired rules in Access Control policy does not work. | R80.30 |
| SmartLog / SmartView |||
| PMTR-111298 | Query for the "drop_reason" field in SmartConsole / SmartView \> Logs \& Events view \> Logs tab does not return data because this log field is not indexed in Security Gateway traffic logs. | R82 |
{#ConsoleTable}
*** ** * ** ***
**Access Control**
Enter the string to filter the below table:
{#Mobile Access}
|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Mobile Access |||
| PMTR-70 | If you use Outlook Anywhere application with Mobile Access Reverse Proxy, and then want to disable Outlook Anywhere or Reverse Proxy, perform: 1. Delete Outlook Anywhere rule from reverse proxy. 2. Run `cvpnrestart --with-pinger` to close all Outlook Anywhere open connections. If you do not perform step 2, open connections of Outlook Anywhere will not be closed and users can still work with it. | R80.10 |
| PMTR-47499 | When Mobile Access is included in the Unified Access Policy, in Mobile Access Authorization logs \> Log Details \> Matched Rules, the Mobile Access Application name and Category do not show. | R7x |
{#AccessTable}
*** ** * ** ***
**Threat Prevention** / Content Awareness
Enter the string to filter the below table:
{#Anti-Malware}{#Anti-Malware}
|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Threat Prevention |||
| PMTR-85353 | When you activate Threat Emulation with the "Hold" mode, Threat Extraction, Zero Phishing, or Anti-Virus Deep Inspection, the Security Gateway downgrades the relevant connections from HTTP/2 to HTTP 1.1. To force HTTP/2, run this command on the Security Gateway / Security Group / each Cluster Member: `fw ctl set -f int disable_http2_with_strict_hold 0` Limitation: Zero Phishing will keep downgrading HTTP/2 to HTTP 1.1. | R81.20 |
| PMTR-80495 | An exception in an Anti-Virus or Anti-Bot protection added manually to the rule base does not work. * To add an exception in an Anti-Virus or Anti-Bot protection, open the corresponding Security Gateway log in SmartConsole and click the link "Add Exception". | R81.20 |
| PMTR-76710 | When Security Gateways use an Autonomous Threat Prevention policy: * Compliance Best Practices do not support the checks for the Threat Prevention. * Compliance may show an incorrect status for the Threat Prevention checks. | R81.20 |
| Content Awareness |||
| PMTR-131013 | * For non-browser-based GenAI applications, the UserCheck client must be installed on the end user's server for UserCheck Content-Awareness pop-ups to appear as desktop notifications. * For non-browser-based GenAI applications, if the UserCheck client is not installed, Content Awareness violation pop-ups may be redirected to the user's web browser rather than appearing as desktop notifications. Users should treat any such browser-based pop-up as a legitimate notification and respond accordingly. | R82.20 |
{#ThreatTable}
*** ** * ** ***
**Endpoint Security**
{#Endpoint Security}
|------------|----------------------------------------------------------------------------------------------|------------------|
| ID | Description | Found in version |
| Endpoint Security / SmartEndpoint |||
| PMTR-68226 | The Perfect Forward Secrecy (PFS) feature supports only Diffie-Hellman (DH) groups 2 and 14. | R81.10 |
*** ** * ** ***
**ElasticXL and Maestro Hyperscale Firewall**
General Limitations \| Gaia OS \| VSX \| CoreXL \| Networking \| VPN
Enter the string to filter the below table:
{#KL_General}{#KL_GaiaOS}{#KL_VSX}{#KL_CoreXL}{#KL_SBVPN}
|-------------|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
| ID | Product | Description | Found in |
| ElasticXL and Maestro - General Limitations ||||
| PMTR-107077 | ElasticXL | ElasticXL Cluster requires each appliance to be after a Clean Install or restored to factory defaults. | R82 |
| PMTR-113582 | All | On non-SMO members, QoS is enabled after policy installation despite being disabled. | R81.10 |
| PMTR-93476 | All | Management Aggregation (MAGG) bond mode is available only through the gClish of the Security Group (and not via the Gaia portal). | R80.20SP |
| ElasticXL and Maestro - Gaia OS ||||
| PMTR-122415 | All | Manual update of the image's md5sum is required post-upgrade. Run this command before using image auto-clone: `"set cluster configuration image md5sum"` | R82.20 |
| PMTR-107433 | ElasticXL | Adding an unassigned interface to or from Sync bond leads to the flags reset and, as a result, it disrupts the ElasticXL detection and ElasticXL drops the packets. | R82 |
| PMTR-71458 | Maestro | Collecting Gaia Backup and restoring Gaia Backup in Global Clish (gclish) is not supported on a Security Group that contains appliances of different models. * To collect Gaia Backup and restore Gaia Backup, you must use Gaia Clish (clish) on each appliance in the Security Group. | R81.10 |
| PMTR-111373 | All | To prevent the Gaia configuration mismatch between Security Group Members, it is not supported to change the user's password on a Security Group in these ways: * In Gaia Portal \> User Management \> Change My Password * In Gaia gClish with the command `set selfpasswd` To change the user's password on a Security Group, run one of these commands in Gaia gClish: * `set user password` * `set user password-hash ` | R80.20SP |
| PMTR-109474 | All | When you run multiple Gaia gClish `set <...>` commands, one after another, some of these commands can stop running. When this happens, the message `"Processing Transaction"` shows in the output. | R76SP |
| PMTR-108601 | All | The arguments of the global commands are processed before the local (native) arguments, and this can cause the local arguments to be ignored. For example, the `g_ls -l /tmp/` command is processed as `ls /tmp/` on the local SGM instead of as `ls -l /tmp/` on all SGMs. Relocating the local arguments within the command (where applicable) can resolve the problem. For example, run the `g_ls /tmp/ -l` command instead of the `g_ls -l /tmp/` command. | R76SP |
| ElasticXL and Maestro - VSX ||||
| PMTR-108547 | ElasticXL | No information is shown on both servers when attempting to see the LLDP (lldpneighbors) between Security Management and a Virtual Gateway. | R82 |
| ElasticXL and Maestro Known Limitations - CoreXL ||||
| PMTR-74532 | All | To make sure there is connectivity after changing the number of instances in the CoreXL configuration, follow these steps: 1. Reboot all Security Group Members one by one, **except the SMO**. **IMPORTANT: Traffic capacity is greatly reduced after you reboot all Security Group Members except the SMO, because only the SMO handles traffic until it is rebooted.** **Examples**: In a Dual Site deployment with four Security Group Members (two on each Site), where the SMO is "1_1", reboot the Security Group Members in this order: 1. Reboot the Security Group Member 2_2 on Site 2 and wait for it to finish the reboot. 2. Reboot the Security Group Member 2_1 on Site 2 and wait for it to finish the reboot. 3. Reboot the Security Group Member 1_2 on Site 1 and wait for it to finish the reboot. In a Single Site deployment with four Security Group Members, where the SMO is "1_1", reboot the Security Group Members in this order: 1. Reboot the Security Group Member 1_4 and wait for it to finish the reboot. 2. Reboot the Security Group Member 1_3 and wait for it to finish the reboot. 3. Reboot the Security Group Member 1_2 and wait for it to finish the reboot. 2. When a Security Group Member finishes the reboot, it enters the "DOWN" state because of a mismatch in the number of CoreXL Firewall instances with other Security Group Members. All other Security Group Members that were not rebooted yet, including the SMO, are in the "ACTIVE!" state (Active Attention) and handle traffic. 3. When all Security Group Members except the SMO have finished the reboot, you must reboot the SMO Security Group Member. A failover occurs immediately, and one of the other Security Group Members becomes the SMO. All other Security Group Members become "ACTIVE" and start to handle traffic. 4. When the last Security Group Member, which was the SMO, finishes the reboot, all Security Group Members become "ACTIVE" and full capacity is restored. | R80.20SP |
| ElasticXL and Maestro Known Limitations - VPN ||||
| PMTR-108430 | All | Performing Hide NAT on Remote Access VPN connection (on the decrypt connection) with L4 distribution enabled may lead to NAT port collisions. | R81.10 |
| PMTR-111380 | All | VPN traffic on a VSX Virtual System that is connected to a VSX Virtual Switch is supported only when the distribution mode configured for the WRP interface is the same as the distribution mode configured for the physical interface on the VSX Virtual Switch. Example of a VSX topology: (Virtual System) == wrp100 == (Virtual Switch) == (eth1-01) The same distribution mode must be configured for the interface wrp100 as was configured for the interface eth1-01. | R80.20SP |
{#ScalableTable}
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content