•Feature parity with ICS release 22.7R2.10 and 22.7R2.9.

•After a node joins the cluster, it may take up to 60 seconds for the correct VIP owner to be reflected. This delay ensures accuracy in cluster state reporting.

•The External ICT package introduced with the ICS 22.8R2.1 release is not compatible with previous versions of ICS, due to changes made for SELinux inclusion. New releases after 22.8R2.1 will remain compatible with 22.8R2.1, but cannot be used with older ICS versions. For more info refer KB.

•The option to disable Web Application Firewall (WAF) and the Next Generation Web Server (Nginx) has been removed. WAF will now run continuously on ICS, ensuring protection. For more info refer KB.

•Upgrading from 22.8R2 to 22.8R2.1 on hardware appliances ensures that the factory reset partition is updated along with the active partition. For more information, see KB.

•A secure-by-default configuration change is introduced to enable the host header validations on fresh deployment/upgrade in this release. To ensure successful hostname-based requests, administrators must provision certificates with appropriate Subject Alternative Name (SAN) entries matching all intended host header values.

•This release includes important security enhancements as part of our ongoing commitment to secure-by-design. Ivanti encourages customers to upgrade to this latest version.

•Added validation checks to verify the file-type in /api/v1/system/maintenance/upgrade, when passing the file to the API. Modify your scripts to include the file-type as ‘application/octet-stream’.

Code snippet for python provided by Postman App.

import requests

url = "https://<ICS-IP>/api/v1/system/maintenance/upgrade"

payload = {}
files=[
  ('file',('package.pkg',open('/C:/Users/qa1/Downloads/<package.pkg>','rb'),'application/octet-stream'))
]
headers = {
  'Authorization': '••••••'
}

response = requests.request("POST", url, headers=headers, data=payload, files=files)

print(response.text)

•Security hardening features are not supported on IPS.

•The checkbox under the option Booting Options on Integrity Check Failure at System > Configuration > Security > Miscellaneous becomes irrelevant. Boot time integrity checks performed by SecureBoot will stop the system booting if failure is detected.

•Enable Prevent System Overload to proactively protect your Connect Secure infrastructure from heavy load or resource spikes. This is a best practice for mission-critical or high-utilization VPN environments.