After playing around with R80.20GA gateway for a few hours, the following things caught my eye:
1) Gaia is now required to be 64-bit.
2) Geo Protection can now be directly configured in a whitelist configuration (allow some countries and deny all others).
3) R80.20 gateway ClusterXL does not support Load Sharing (Active/Active) yet? Not a huge fan of load sharing to begin with but this is taking it to another level... 🙂
4) R80.20 gateways cannot be managed by an R80.20M1 SMS.
5) cphaprob state command now reports *far* more detail about ClusterXL state, including why the current member is active, last state transition & failover count, and active pnote problems. This extra information appears to be available separately via the new cphaprob show_failover command.
6) cphaconf set_ccp has two new options: auto and unicast (the latter only works with a 2-member cluster); used to just be broadcast and multicast.
7) Syn Attack (Syn Flood) protection is now implemented in SecureXL and will not cause all traffic handled by it to go F2F. Just mentioned this limitation in my TechTalk this week, quite ironic...
😎 The undocumented ability for certain ports to be bypassed in the Dynamic Dispatcher mentioned on p. 245 of my book appears to be officially supported via the fw ctl multik add_bypass_port command among others.
9) The new fw ctl multik get_instance command can be used to identify which Firewall Worker core is handling a connection with the matching attributes specified on the command line.
10) The new fw ctl multik print_heavy _conn command will show the attributes of all "heavy" (elephant flow) connections currently pounding the Firewall Worker cores.
11) The new fw ctl multik utilize command will show the size & utilization of the Firewall Worker packet queues.
12) Many new screens added to cpview including Dynamic Routing Stats (routed), Hardware Health & Sensors, Disk I/O utilization, and Advanced...CPAQ.
13) Apparently fw monitor can now capture all traffic traversing the firewall regardless of whether it is accelerated by SecureXL. Haven't had a chance to verify this myself yet.
14) The long-awaited Network defined by routes antispoofing topology option checks the gateway routing table every second for any route changes that might impact antispoofing enforcement, the timer controlling this interval is located in the SmartConsole under Manage & Settings...Preferences.
15) I don't see the option to define VPN domains per VPN Community, at least not in the SmartConsole.
16) Ensuring that "Font Smoothing" is enabled in your RDP client substantially improves the graphical performance of the SmartConsole inside an RDP Session.
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com