Resolved Issues

Release 22.7R2.12

Kernel panic was observed on ICS versions 22.7R2.8 and above due to a kernel bug in the NFQUEUE reinjection path, which could result in an abrupt reboot of the ICS server. This issue has been fixed.

OCSP checks for certificates failed intermittently on ICS versions 22.7R2.10 and above, due to an issue in parsing the OCSP response in the ICS server. This parsing issue has now been resolved.

Release 22.7R2.11

The Active Directory (AD) join status occasionally appears as RED in the A/P (Active/Passive) cluster.

ACL checks fail because there is a mismatch between the client IP and the store IP in the PSAM DNS cache.

During a cluster upgrade, one node fails to upgrade and displays the GUI error message: "Upgrade failed.(-3)"

During the firmware upgrade from version 22.7R2.9 to 22.7R2.10, the console displays the error message: "Verifying package integrity ... failed."

The web process crashes on the active node of ICS running version 22.7R2.9 due to a buffer assertion failure.

After upgrading ICS from 22.7R2.9 to 22.7R2.10, ICS acting as an Identity Provider (IdP) no longer processes incoming SAML AuthnRequests.

REST API-based authentication does not work when the VPN hostname resolves to an IPv6 address.

IP addresses from "Korea, Republic Of" are blocked, even though they are explicitly allowed in the source IP restriction settings.

NTP configuration override does not function correctly when importing System.cfg that specifies a source interface for NTP traffic.

DNS resolution fails on the Active Directory (AD) troubleshooting page when multiple AD servers are configured.

Advanced HTML5 session recording to external storage does not function correctly after upgrading ICS.

Active Directory continues to run even when incorrect credentials are entered on a domain-joined IVE

Attempting to upload a file larger than the allowed size displays an error on the screen.

User-created HTML5 bookmarks do not function as expected on ISA6000v appliances.

The pre-authentication sign-in notification displays a long text message.

A blank screen is displayed when attempting to access a file browsing bookmark created by the user.

REST API authentication fails when the administrator password contains the special character “:”, even though the same password works via the admin Web GUI.

The dswsd and cgi-server services encounter failures during OCSP checks when deep OCSP responder certificate chains are used.

Audio playback continuously loops or repeats during HTML5 RDP sessions on MacOS Safari after upgrading ICS.

The web process crashes, which results in dsagentd dropping all active connections.

The hpproxy-server process crashes with a segmentation fault (segfault) when executing a Python API script.

Web Process Crash

The screen resolution does not auto-refresh during HTML5 RDP sessions from Mac to Windows after upgrading ICS.

Multi-Factor Authentication (MFA) fails when accessing a web bookmark through the Pass Through Proxy.

Attempting to launch an HTML5 RDP bookmark results in the error: "Unimplemented decrypt tag 3076."

NSA log forwarding fails due to the presence of duplicate JSON filters after importing configuration files.

After changing the RSA PIN on the ACE server, the old login user interface is displayed instead of the updated UI.

User login attempts fail with a "Max Sessions" error, even though there are sufficient available licenses on the ISA appliance.

Prevent VIP failover when External ICT scan is performed through REST API.

The Postgres program (database service) recently failed.

The Perl process intermittently crashes in an Active/Active cluster deployment on Azure.

After upgrading to Connect Secure version 22.7R2.10, users experience unexpected disconnections or are unable to establish new connections.

The LDAP unbind operation is taking an unusually long time to complete on the IPS server.

Users are unable to obtain an IP address during connection attempts and receive error 1319.

REST API calls fail with an execution error during Active Directory reset join and basic verification operations.

When Pulse One is enabled on the Connect Secure server, event logs do not display data regarding the results of External Integrity Check runs.

Release 22.7R2.10

REST API ACL Update Error for IP Range Format in ICS Configuration

ICS server running 22.7R2.8 code and the CGI-Server process crashed.

Post upgrade to 22.7R2.9, ISA 8000V servers exhibit a sustained 100% CPU usage.

Periodic snapshot feature fails to function in firmware version 22.7R2.8 (Build 4471).

Admini access logs display an older IP address for login failures.

Event logs do not display EICT scan results as expected.

VPN connections cannot be established from Holo Lens 2 devices.

HTML5 SSH Bookmark throws "Page Not Found" error when using framed toolbar.

Selective push config and XML import between nodes fail with "invalid IPv4 address" error.

ICS fails to process OCSP requests correctly when proxy is enabled (22.7R2.8).

System reboots unexpectedly during ICT scans initiated via REST API.

ICS security warnings link to outdated KBA references.

Active node displays persistent Watchdog errors post upgrade to 22.7R2.8.

User unable to log in after entering credentials when accessing backend resources via PTP.

REST-API responses for "logging-disk" show incorrect usage values.

Active/Active cluster stuck in leader/leader status following upgrade to ICS 22.7R2.6.

Nodes in A/A cluster report incorrect vpnACLCount in SNMP responses.

Error "The server had an internal error" occurs when saving changes to the "Validate Server Certificate" option if a backup LDAP server is configured.

Web Bookmark functionality is broken after migrating from 9.1 to 22.x.

Clip icon does not appear during file upload via FileShare bookmark.

Unexpected postgres program failure observed in ICS 22.7R2.6.

Login page displays copyright notice after UI setting to disable has been used.

Favorites functionality for Terminal Services is not operating as expected in specific scenarios.

ISA-6000 (22.7R2.6) shows inconsistencies in user access logs.

Access issues with SSH bookmarks observed after migration to ISA4000V.

Users experience mass tunnel drops on 2-node ISA 8000 cluster (22.7R2.6 build 3981).

Default role options welcome message popup fails to appear after updates.

ICS servers incorrectly lease AdvancedHTML5 user licenses from licensing server.

Admin/Event logs do not record updates to rewriting filters.

Admin log outputs contain incorrect logging information.

Admins cannot upload upgrade package when Google Cloud cluster is in Active/Active mode.

VIP failover is not functioning correctly on servers running 22.7R2X.

"User Summary Report" displays incorrect data in IPS.

LDAP authentication breaks after migrating from PSA to ISA 22.7R2.5.

ICS fails to handle special characters during configuration via NETCONF connection.

New ISA6000 cluster nodes struggle to route traffic through the appropriate node during failover.

Behavior check required for cluster formation when default VLAN ID is used.

Joining node taking the VIP ownership during join operation in cluster causing the establish VPN connection to disconnect and re-connect

System/User Binary import/XML import is failing with 22.7R2.9 gateway registered to 22.8R1.3.1 controller.

Release 22.7R2.9

Cluster Node Hang and Recovery during Active Sync with IKEv2 VPN after migrating to 22.7R2.

Uploading certs in Trusted Server CAs, it shows a message about duplication and the cert fails to add.

Events logs are not getting generated after a successful external ICT Scan when upgrade to 22.7R2.

VLS License is not getting activated after upgrade from 22.7R2.1 to 22.7R2.3 due to change in VM ID.

PSAM process crashes leading to user disconnection.

Could not delete user records through the UI on ICS 22.7R2.6.

Domain joined Windows machine causing dswsd, cgi-server process to crash for the AD authentication.

An error "Please wait while connecting" seen with Advanced HTML5 connections (SSH and RDP sessions).

File Share/Browsing issue on 22.7R2.6 - Errors when folder contains a shortcut to launch an application

Users are unable to access PSAM resource post upgrading to 22.7R2.6 due to PSAM policy user attribute name appended with : at the end and failing with ACL check.

X-Frame-Options response header is seen twice for welcome.cgi URL.

RESTAPI: Internal Server Error while using Non ASCII Character UTF-8.

ntpq command execution from ICS Troubleshooting page via selected interface fails.

Guest OS Restart/Shut Down Issue After Ivanti Connect Secure Upgrade 22.7R2.4.

Config publish fails even after disabling ActiveX parameters and process snapshots observed.

User created Adv HTML5 W/ NLA bookmarks overrides settings for the additional NLA bookmarks.

ICS version 22.7R2.6 unable to handle the shortcuts in certain conditions.

In end user page, user is unable use the drop down arrow to select the realm, when multiple realms are assigned.

On the admin UI sign in policies, admins are unable use the move down button to move the mapped realms when multiple realms are assigned. Move up button works.

Browse-server process consuming High CPU on ICS 22.7R2.6

ICS SNMP Unresponsive to ‘get’ queries.

Issue with special characters in Bookmark description field on ISA 22.7R2.8.

AD authentication not working and not able to create AD Auth with Domain name containing hypen in 22.7R2.8.

SCP Archiving is failing at times for config backups due to timer issue.

NTLM/KRB SSO Issue. After migrating from PSA to ISA, when accessing the bookmark it throws internal error after entering manual credentials.

GCP - Adding management port details of other in cluster is returning with invalid IPv6 gateway error message.

Need a interprocess lock to prevent race condition during remote TOTP invocation.

User with country based restriction (Virgin Island) is unable to connect to ISA VPN while using ISP, gets an error "Rejected by the server".

cgi-server crashes noticed on licensing server running on 22.7R2.8.

SMBCONF process crash after upgrading to 22.7R2.7.

Not able to access the Windows File shares links retrieved via User Attributes in certain cases.

Language translation issue in File Bookmark feature on ICS 22.7R2.5 / 2.6

User Session instability while logging In To ICS server via certificate based authentication In certain cases.

HTML5 external storage will not work when admin configures domain joined machines.

Kernel panic is observed in ICS in 22.7.x builds under multiple conditions (RIP:xfrm_state_delete, and RIP:ip_forward_finish).

Folder path truncation issue beyond 3 subfolder levels in File Resource Bookmarks on ISA platform 22.7R2.8.

Upload delays during IPS-V upgrade in Active/Active WAN Cluster. Applicable for ICS and IPS

Cluster Setup with ICS AD Server – "Save Credentials" Option Unchecked, may cause unexpected results in AD Auth Server in cluster ( A/P ) setup.

Release 22.7R2.8

Not able to edit a file bookmark name when the configured URL contains <USERNAME> syntax.

Improved ICS clock and NTP stability.

NTP timezone setting not handled correctly during upgrade or configuration import.

Problems getting certificate information via API.

Radius authentication fails when using the secondary server after the upgrade to 22.7R2.6.

Temporary unavailability of Ivanti Secure Access extension for Google Chrome.

Graph gaps appear when there is an NTP event restart with time corrections. NTP stability improvements will limit the impact.

dsradiusacct may crash when Radius accounting port is not reachable.

Server on 22.7R2.6, fails to assign clients an IPv6 address from a /64 pool.

Rewrite-server or proxy-server may crash under specific conditions

After upgrade to 22.7R2.6, Web bookmark shows error"The URL is invalid" when mask button is enabled.

Improved handling and logging of watchdog when it encounters high FD values.

Geolocation names have been updated to match current ISO-3166 values.

This may require manual adjustment of some Geolocation rules.

Bookmark created for downloading the installer file is not working in ICS 22.7R2.3 and above versions.

Offer Home/Reconnect prompt upon session end in Advanced HTML5.

SAML process crashes during internal ICT scans on ICS Versions 22.7R2.3 and 22.7R2.5.

AD authentication server gives troubleshooting error post-migration to ISA-6000-V.

Unable to save SSO policy on 22.x with user attribute values in file bookmarks.

After upgrading to 22.7R2.1 or later, the logs before upgrade gets deleted.

License Server shows newly created ICS licensing client's platform as ISA-V (Policy Secure) instead of Connect Secure.

ICS shows DNS server as responding even when it does not exist.

Custom Sign IN page not working for Android and IOS users on latest ISA - 22.7R2.3.

After upgrading to 22.7R2.3, the iveVPNTunnels SNMP data is displaying as zero.

Failing to configure "Attribute based bookmark " with Advance HTML5.

Upload Custom Page and XML failure on 22.7R2.3.

Archive setting is removed after server is upgrade from 22.7R2 to 22.7R2.2.

Issue with Custom Sign-In Page Unable to Modify Secondary Credential Labels.

System Time is drifting when the Time is set Manually from Browser

Validation is missing for Network Connect ACLs when modified through REST/XML.

Multiple login sessions are seen when using custom sign-in page.

"Enable IPv4 Address Assignment to Clients" option is Disabled upon upgrading to 22.7R2.3.

Not able to add file share path as user bookmark.

Unable to go back to previous folder.

VDI bookmark is not shown in the End user page and works fine in Admin UI page.

Release 22.7R2.7

Web Process stops randomly, generating crashes.

Smart Card authentication detection failure during advanced HTML5 RDP login.

One or more web processes get stuck in infinite loop during SSL handshake resulting in High CPU.

Web process crash leading the user disconnections in ICS 22.7R2.6.

SMBCONF process crash during AD reset join issue.

Web Radius EAP crash issues.

ESP falls back to SSL and after some time the node freezes completely causing all connections to drop.

Virtual VMWare server running 22.7R2.5 with multiple web process crashes and certain users get disconnected

Kernel panic is noticed on ICS Version 22.7R2.6 when ESP transport mode is used.

After upgrading to 22.7R2.6 many users are unable to establish their VPN connection.

After the upgrade to 22.7R2.6, users started getting error 1132.

Release 22.7R2.6

Unable to change background color on Sign-In Page 22.7R2.5.

Enable Setting view for Role showing unchecked option, when the features ( HTML5,VPN and other option ) for role is enabled.

Unable to change background color on Sign-In Page 22.7R2.3.

ICS kernel panic during upgrade.

With nSA license, few users are not reflecting in users page in the controller.

PSAM Ivanti Secure access client is not Launching automatically or connecting Automatically.

Advanced HTML5 Session Recording is Not Working From ICS 22.6R2.3 and Above.

FQDN based PSAM resources become inaccessible in ICS 22.7R2.4 due to PSAM DNS cache lacking the response for FQDN's.

PSAM issues in accessing FQDN resources with uppercase letters in ICS 22.7R2.4.

PSAM FQDN resource access denied despite IP Addresses being present in DNS cache in ICS 22.7R2.4.

Accessing the Sign-In URL redirects to PSAL helper page with upgrade helper installation prompt In ICS 22.7R2.4.

Inability to configure custom Radius login Page due to missing Defender.thtml file on 22.x versions.

Unable to Create Active Directory Server on ICS 22.7R2 and Above When Domain Field Contains '_' Character.

Issues with SSO and Credential Parsing for Adv HTML5 and unable to access RDP Connection.

Advanced HTML5 W/ NLA bookmarks overrides settings for the additional NLA bookmarks.

Special Characters are not allowing in 22.x for selective pushConfig/ ImportExport

Issue with SSH Access to HTML5 Resource on Debian 11: Scrollbar and Mouse Wheel Unresponsive.

RemoteDir paths containing spaces causing NullPointerException in 22.7R2.1 Advanced HTML5 Bookmark Access.

File upload in 22.x server allows users to submit more than 5 files but, they can add only 5. If the user adds the 5 files they should be prompted and not given the option to add more than 5.

Content-Length Header (HTTP) in Health check status full response on loadbalancer shows value as "Zero".

Unable to delete Staged package starting from 22.7R2 from the UI.

Unable To Browse the FileShare Resource When a Folder Name has Special Character "&" on ICS 22.7R2.3.

Kernel Panic is observed on the ICS deployed in Azure running on 22.7R2.

ICS server running 22.6R2.3 is seeing License Server Low Level Protocol Errors in the event logs.

REST API for resource throttling providing incorrect response in 22.7R2 and above.

Interacting with File Share Shortcuts Redirects to Downloading .lnk Files Instead of Folder Browsing on ICS Version 22.7R2.1.

Issues with SAML-Authentication Server config sync from nSA controller.

Application Access via Terminal Services Significantly Slower After Migration from PSA Server (9.1R17) to ISA Server (22.6r2.3) despite with same Configuration.

VPN ACL filtering by port is not working as expected.

Computer ICON is missing on the browser toolbar after upgrading to 22.7R2.3.

Cluster Node Hang and Recovery during Active Sync with IKEv2 VPN after migrating to 22.7R2.

Release 22.7R2.5

PSAM users experience intermittent disconnections in ICS 22.7R2.3 with the 22.7R3 client version.

Memory usage increases linearly over time to 100%, causing the device to become unresponsive until it is rebooted.

Release 22.7R2.4

Special characters are not permitted in version 22.x for selective pushConfig and ImportExport operations.

SPI count in debug logs and system snapshot to track memory issues.

Release 22.7R2.3

Upgrade of ICS from 22.7R2.1 or later is failing through REST API

Session Management( idle timeout, max session lifetime, session extension, etc) are not working.

AD domain join takes 15 mins to join.

Release 22.7R2.2

Improved handling of CA/intermediate certificates that do not have a CN value

Addressed issues when using two different CA/intermediate certificates that have the same CN and issuer.

Addressed an issue with swap memory management on ISA8k

Addressed an issue with swap memory management on VM devices

UAL license not working for EU region

Release 22.7R2.1

Users are having failed realm restrictions even when the location is allowed.

User access logs displays the wrong Username, when ending a Terminal Session

Traffic Segregation in Hyper-V is not saving the VLAN ID under available Interface.

Users session gets disconnected on Windows 10 systems due to the Host Checker time out. For more see KB.

IPTable rules default policy set to "ACCEPT" allowing all ports.

User access logs provides 127.0.0.1 address for source IP when an attempt with wrong credentials fails.

Session ID is not displayed in the "Closed connection" logs consistently.

Staging user summary table entries are being appended

JSAM Certificate is expired in 22.7R2

External Integrity Scan is Failing on the 22.7R2 server showing 85 mismatched files this occurred in Azure deployment only

iveConcurrentUsers count is 0 in SNMP Traps.

Sometimes, Advanced HTML5 session does not respond to mouse clicks.

Cluster creation with IPV6 and default VLAN Id is not supported.

Release 22.7R2

Refer to Security Advisory and Patch Release section to see CVEs fixed.

Sending iveMaxConcurrentUsersSignedIn SNMP alert for Leased licenses from License Server.

Keyboard input is printed twice when host and PC language is Chinese.

Geolocation based realm restriction failing for user login.

User access logs Shows wrong Username ,when ending a Terminal Session.

System State storage size has reached max limit.

Automatic detection with "unknown Keyboard" as keyboard layout does not work in Advance HTML5 pre-Login

Wildcard Device certificate deletion with REST API is not working Properly.

Difficulty in Joining Device to Domain Using Only Reset Join option with AD Authentication.

VPN users dropped suddenly on gateway due to reboot.

Avoid False Positives in ICT

High CPU usage is noticed in all of the 12 nodes deployed.

Import of System config/XML config related to bandwidth Management fails on ICS

Certificate Auth failing is due to Missing Authority Key Identifier.

Mitigating login issues through reboot or failover.

Certificate Host checker is failing after upgrading to 22.6R2.

Unable to authenticate user using certificate with "Wrong Certificate::unsupported name constraint type".

“Dropping the duplicate tunnel session from client” is seen in User Access Logs.

SNMP Traps are not being generated when the redundant power supply is turned off.

Singpass (SAML) Authentication fails when Load balancer URL is configured under the "Host FQDN for SAML".

Not able to update ICS server appliance from 22.4R2 to 22.6R2.

SSO stoped working for the FileShare Bookmarks after upgrading ICS to 22.6R2 version.

Rewrite getting blank page via Host-based PTP.

MDM Setup Issues with Microsoft Intune with Authentication and Authorization Challenges.

AD join fails with ISA when Domain name has a special character '&'

SID is not being displayed completely.

iOS 17 has introduced a change in the IKE code, to make it stricter in compliance with RFC7296

Ikev2 error messages seen in the User Access logs.

High CPU usage at 100 % for ICS due to 64K size DNS response.

Scrolling Bar Accessibility Issue on welcome page in Multiple Browsers.

Upgrade to 9.1 R18.1 fails due to SSH/Telnet deprecation check.

Inactivity reminder timeout, when users are using web session post migrating to 22.3R1.

Failing to get Intune MDM Attribute Intermittently.

Chinese characters in file share bookmarks are garbled.

After migration to ICS the Disk Space is showing as full on the active node in A/P cluster.

Website loading slow after the upgrade with PassThroughProxy.

Unable to connect to VPN, SAML authentication fails after upgrading the appliance to 22.4R2.

Unexplained reboots on ISA 8000c A/A Cluster.

DFS Share access is not working with 22.5R2.1.

Web process crash on PSA 7000c due to memory leak.

ICS Azure VM Virtual Wagent showing status not ready and impacting in taking Azure level VM backup in 22.x.

Database percentage = 99, shard 3 operation above threshold.

ICS Realm limits are not honored when nSA Named User Licensing mode is used.

REST-based configuration updates may fail with an HTTP 500 error.

SNMP trap messages under Event log to be removed.

Config sync rule on the nSA shows Failed and Pending status.

Readiness failures observed in Gateway.

Single node cluster to support config sync and Report generation.

Event logs are filled with certificate expired error message.