NGX R65 Release Notes - Check Point

Firewall
Authentication
19. Client Authentication will fail if VPN-1 Power/UTM machine name is configured with a wrong
IP address in the hosts file.
20. Clientless VPN with the Action Client Auth is not supported if the web server object is in the
destination cell. The workaround is to add the gateway to the destination cell.
21. When using SmartDirectory server for internal password authentication, if the account lockout
feature is disabled the Firewall will not attempt to modify the user's login failed count and last
login failed attributes on the SmartDirectory server. This improves overall performance and
eliminates unnecessary SmartDirectory modify errors when using SmartDirectory servers that do
not have these attributes defined because they did not apply the Check Point SmartDirectory
schema extension on the SmartDirectory server.
22. Issues may arise when using automatic or partially automatic client authentication for HTTP on
Load Sharing clusters (both ClusterXL and OPSEC clusters). A workaround is to define a
decision function based only on IP addresses in order for connections to open. For ClusterXL,
go to the ClusterXL tab > Load Sharing > Advanced, and select IPs only. For OPSEC clusters,
refer to the product documentation for more information.
23. Definition of nested RADIUS Server groups is not supported.
Security Servers
24. When a field in a URI specification file is too long, the Security server exits when trying to load
the file. Under load, the Firewall daemon (FWD) reloads the security server, which then exits.
After a certain time cores are dumped.
25. Client authentication with agent automatic sign on is supported with all rules, with two
exceptions:
• The rule must not use an HTTP resource.
• Rules where the destination is a web server.
26. When using SOAP filtering in the HTTP Security Server, the SOAP scheme file supports all
forms of namespaces and methods, however, the feature is not supported if a method has no
namespace at all.
Security
27. When using a URI resource to allow or restrict access to specific paths (by filling the path
field), it is recommended to use the regular expression [/\] instead of / - this expression
provides protection against Windows style paths.
For example: instead of defining a path: /home/mydir/, define it as [/\]home[/\]mydir[/\].
Services
28. A service using the FTP_BASIC protocol type cannot be used with the FTP Security Server.
29. When using T.120 connections, make sure to manually add a rule that allows T.120
connections.
Stateful Inspection
30. Changing the "match for any" option in the MSNP service to "false" it causes connectivity
problems after an upgrade in the following scenario:
Service X other than Microsoft Messenger protocol was running on port 1863. No special rule
was defined for this service (for example, the service was permitted by a rule with "Any" in
service column).
To resolve this issue, define a rule permitting the service with X in the "service" column.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 18