> Source: [sk185041](https://support.checkpoint.com/results/sk/sk185041)
# sk185041 - Check Point R82.20 Resolved Issues and Enhancements
| Property | Value |
|----------|-------|
| Solution ID | sk185041 |
| Date Created | 2026-06-09 |
| Last Modified | 2026-10-04 |
| Technical Level | General |
| Products | Check Point Firewall, Security Management Server |
| Versions | R82.20 |
| OS | Gaia |
## Solution
### This article lists all enhancements and issues resolved in the R82.20 Release.
* The R82.20 Release accumulates all fixes from previous releases, including fixes from
* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm)**Take 36**
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm)**Take 118**
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm)**Take 158**
* For more information about R82.20, see the [R82.20 Release Notes](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_RN/Default.htm), [R82.20 Home Page](https://support.checkpoint.com/results/sk/sk185039), and [R82.20 Known Limitations](https://support.checkpoint.com/results/sk/sk185040).
* Visit the [Check Point CheckMates Community](https://community.checkpoint.com) to ask questions, start a discussion, or get assistance from our experts.
*** ** * ** ***
**Installation and Upgrade \|
Licensing \|
Security Management \|
SmartConsole \|
Logging \|
SmartProvisioning
Check Point Firewall \|
Gaia OS \|
Threat Prevention \|
ClusterXL \|
SecureXL \|
SD-WAN \|
VPN \|
ElasticXL and Maestro \|
Cloud Firewall**
List of Resolved Issues and Enhancements in R82.20 Release
----------------------------------------------------------
Enter the string to filter the table below:
{#Installation and Upgrade}{#Licensing}{#Security Management}{#SmartConsole}{#Logging}{#SmartProvisioning}{#Check Point Firewall}{#Gaia OS}{#Threat Prevention}{#ClusterXL}{#SecureXL}{#SD-WAN}{#VPN}{#ElasticXL and Maestro}{#Cloud Firewall}
|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ID | Symptoms |
| **Installation and Upgrade** ||
| PMTR-59345 | Central Deployment in SmartConsole now supports: * VRRP Cluster * On Multi-Domain Servers: Global Domain, or the MDS context * Standby Security Management Server * Check Point Spark Appliances |
| PMTR-124684 | In certain scenarios, upgrading to R82 and higher that includes SMB objects may fail with the *"Unexpected exception during isValid call"* message in the upgrade report. |
| **Licensing** ||
| PMTR-47087 | Added support for new licensing visibility features to: * Network Security: Advanced Networking and Clustering * Security Management: Endpoint Policy Management, User Directory (LDAP). * Multi-Domain Management: Security Domain * Remote Access \& Endpoint Security |
| PMTR-47532 | When loaded for the first time, web components such as the licensing or monitoring view can take up to thirty seconds to show |
| **Security Management** ||
| PMTR-125194, PRHF-44188 | In some scenarios, Multi-Domain Security Management HA synchronization may fail after Infinity AI Copilot permissions are updated, until a manual synchronization is performed. Refer to [sk185124](https://support.checkpoint.com/results/sk/sk185124). |
| PMTR-116108 | Wildcard objects do not appear in the search results when searching by IP address. |
| PMTR-41764 | The "URL" field shows "*\*\*\* Confidential \*\*\*"* in HTTPS Inspection logs on 3rd-party LEA OPSEC client. |
| **SmartConsole / Management Console** ||
| PMTR-122685 | SmartConsole fails to retrieve topology information for interfaces configured with /31 subnet masks. |
| PMTR-120942 | The Management API commands "`add/set data-type-weighted-keywords`" and "`add data-type-file-attributes`" do not save the "description" field in the object. |
| PMTR-121954 | In the "Network Management" tab of the Security Gateway Editor, after clicking "Get Interfaces" to retrieve the interface information, selecting an interface and clicking "Edit" may open the wrong interface object. |
| PMTR-115014, PRHF-39412 | In some scenarios, when attempting to view a revision in SmartConsole, it unexpectedly crashes after several minutes with the error message: `"SmartConsole has experienced a serious problem and needs to relaunch."` |
| PMTR-128419, PRHF-45724 | Gateways created via the Management API or SmartConsole may be assigned duplicate Dynamic Assigned IP (DAIP) addresses. Refer to [sk185077](https://support.checkpoint.com/results/sk/sk185077). |
| PMTR-128389 | Deletion of the gateway, used in QoS policy, is not blocked by a validation. If this gateway is the last in the cell in the QoS policy, it changes the cell value to "Any". |
| PMTR-121999 | When executing a SmartTask configured to send an email notification, it pulls the Submitter Email from the Contact Details rather than the Email field. |
| PMTR-50263 | No warning is displayed if an empty Network Group object appears in the "Source", "Destination", or "Protected Scope" column of a Threat Prevention policy rule. |
| PMTR-38804 | The "Import Node" action (accessible from the SmartConsole Network Object tree \> Nodes \> Import) can fail with an "*Internal Error*" message. |
| PMTR-121600 | Sync interfaces may not be fetched in the Maestro Security Group Member. |
| PMTR-122000 | When updating the time object for an Access Control rule, the summary tab does not update. |
| PMTR-121843 | Best Practices might be missing or show incorrect results in the Security Best Practices view of the Compliance blade. |
| PMTR-60830 | A link named " *#.name* " appears in a policy (above the Shared Policies section) in this scenario: 1. From the left navigation panel, click the Security Policies view 2. Open a policy with the HTTPS Inspection 3. Click Access Control \> HTTPS Inspection 4. In the Certificate column, right-click a certificate and select Where Used 5. In the Where Used window, click the Policies tab 6. Double-click a policy that does not contain the Access Control (contains only Threat Prevention or QoS) 7. The policy opens, but instead of HTTPS Inspection section, a link named "*#.name*" appears |
| **Logging** ||
| PMTR-118511 | When searching the logs by source or destination and using URL Filtering, the screen goes blank when certain logs should appear. |
| PMTR-120903 | In some scenarios when trying to export logs, operation fails and the `log_indexer` process crashes. |
| **SmartProvisioning** ||
| PMTR-127071, PRHF-45066 | When running the `LSMcli AddROBO` command with the `-S` (SubstitutedNamePart) parameter, the cluster profile name suffix may not be substituted correctly. |
| **Check Point Firewall** ||
| PMTR-123092 | TAB completion does not work for the "set backup-scheduled settings notification-level" command. Refer to [sk184545](https://support.checkpoint.com/results/sk/sk184545). |
| **Gaia OS** ||
| PMTR-119590 | In this release, when adding an already existing role with the same name, the "role already exists" error will be printed. |
| PMTR-122146 | If there are multiple snapshots stored on the Gateway server, new snapshot creation fails with the error `"Cannot create snapshot, insufficient space in /boot"`, although there is enough unpartitioned space. |
| PMTR-120025 | The Ansible Playbook role `check_point.gaia.cp_gaia_role` may fail on several attempts. |
| PMTR-116563, PMTR-117575 | The 3600 and 3800 appliances continue to send the SNMP Trap `"powerSupplyFailure"` even after disabling the alarm LED activation as described in [sk166000](https://support.checkpoint.com/results/sk/sk166000). |
| PMTR-108457 | When a scheduled backup with a retention policy failed during the retention enforcement phase (e.g., due to permission or network issues), the system incorrectly reported the backup as successful. This prevented users and monitoring systems from detecting the failure. After the fix: If the retention policy fails, the backup is correctly reported as failed. The error is logged and propagated to monitoring and alerting systems, giving clear visibility into the issue. |
| **Threat Prevention** ||
| PMTR-59837 | SSH Deep Packet Inspection enhancements: * Added support for inspection of IPv6 connections. * Added support for inspection of SSH traffic generated by clients that do not support the "Diffie-Hellman group exchange" algorithm. * Added support for these SSH clients: * PuTTY versions 0.64 and lower. * OpenSSH versions 2.5.2 and lower. * WinSCP versions 5.7.4 and lower. * SecureCRT versions 5.2 and lower. |
| PMTR-107712 | In some scenarios, DNS Trap may fail to replace DNS replies with bogus IP addresses on certain connections, resulting in dropped connections. This prevents affected hosts from receiving the intended IP address, but also limits the visibility into which host IPs are impacted. |
| PMTR-107710 | The "DNS Mismatched replies" IPS protection does not work after the upgrade. |
| PMTR-107493 | DNS NAT does not work on Security Gateways. |
| **ClusterXL** ||
| PMTR-130311 | In some scenarios, data synchronization in MVC fails and causes unexpected errors. |
| PMTR-48477 | ICAP Client and ICAP Server are now supported with ClusterXL Load Sharing mode. |
| **SecureXL** ||
| PMTR-121673 | Appliances with one of the following line cards: CPAC-2-40F-B, CPAC-2-40F-C, CPAC-2-100/25F-B, may not upgrade properly. |
| PMTR-120253 | In some scenarios, the Traditional VSX Gateway may experience significant latency when passing traffic between Virtual Systems through a Virtual Router. |
| **SD-WAN** ||
| PMTR-105542 | SD-WAN now supports Geo Cluster in Amazon Web Services (AWS). |
| PMTR-105208 | SD-WAN Overlay VPN now support Route Based VPN with ECMP. |
| PMTR-104977 | Traditional VSX Gateways and Traditional VSX Clusters now support SD-WAN configuration. |
| PMTR-108010 | For inbound connections from the Internet to the Security Gateway itself, SD-WAN does not support symmetric return packets through the same interface on which the connection was originally received when multiple ISPs are present. |
| PMTR-105210 | SD-WAN Local Breakout does not apply to connections that originate on the Security Gateway itself (for example, when an administrator connects from the Security Gateway to an FTP server). |
| PMTR-124907, PMTR-125831 | Dynamic objects "My VPN Domain" and "Peer VPN Domain" do not include VTI IP addresses or OS routes toward VTI IP addresses in Route-Based VPN configurations. |
| **VPN** ||
| PMTR-130478 | When using Multi-Factor Authentication as part of Remote Access,Check Point Firewall now records "Failed Log In" logs when the user is timed out of the additional factor or enters the wrong OTP. |
| PMTR-130016 | In some scenarios, Site-to-Site VPN tunnel against 3rd-party flaps every 2 minutes. |
| PMTR-127464 | No "Failed Log-in" log for MFA when the second factor is not completed in Remote Access VPN. |
| PMTR-121455 | Traffic passing through a route-based VPN tunnel may cause high CPU usage if the traffic is fragmented. |
| PMTR-104094 | If Perfect Forward Secrecy is enabled, the Remote Access VPN client may disconnect from the Security Gateway within 1 hour. |
| **ElasticXL and Maestro Hyperscalle Firewall** ||
| PMTR-104980 | Added support for SD-WAN configuration. |
| PMTR-111445 | Maestro now supports RIPng (IPv6). |
| PMTR-60874, ACCHA-736 | VxLAN interfaces are now supported on Maestro. |
| PMTR-111441 | Maestro now support BGP over VXLAN tunnels. |
| PMTR-119680 | On a Scalable Platform Security Group, the Gaia gClish command "`add user username uid homedir `" does not stop if a home directory with the specified path already exists. |
| PMTR-123442 | Maestro Security Group in the Traditional VSX mode does not detect link-down events for uplink ports eth1-65 and higher on the Maestro Orchestrator. Refer to [sk184763](https://support.checkpoint.com/results/sk/sk184763). |
| PMTR-122489 | A sensor on MHO175 may raise false alerts. |
| PMTR-111361, PMTR-128480 | The Active-Backup bond now can sync between all Security Group Members. |
| **Cloud Firewall** ||
| PMTR-117752 | Added support for the Microsoft Azure Gateway Load Balancer solution. |
{#resolvedTable}
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content