Resolved Issues





Fixed a Content Security Policy (CSP) violation that could cause user login failures in certain scenarios on ICS 25.1.1.0.

Fixed an issue where web-based certificate authentication could incorrectly display an "Invalid Username or Password" error during the first login attempt.

Added support for hyphens in RSA Client IDs to align with valid ICS hostnames and device certificate FQDNs.

Added support for additional special characters in usernames for Archiving Server settings.

End-User Localization setting 'Automatic (based on browser settings)' does not work on 25.1.x

EUP login lands in blank page in cluster



ICS 22.x / 25.x User Admin selection follows row position instead of user identity.

Fixed an issue that prevented editing or deleting role mapping expressions.



Fixed an issue that prevented users from modifying user-created bookmarks and resulted in a "Something Went Wrong" error.

The Home button displayed on HTML5 maximum connections warning page does not redirect users to the Home page.

There is no option to push HTML5 storage configuration through the configuration push mechanism.



Fixed an issue where WebSocket (WS/WSS) connections on Virtual Hostname resources failed with a 500 Internal Server Error.

Fixed a stability issue where the NGINX process could crash when usernames contained the & character during HTML5 access.

Fixed an issue where the rewriter emitted duplicate Content-Length headers for HEAD responses, causing browsers to reject the response.

Fixed an issue where a WAF error was encountered at /dana-admin/user/findTOTP.cgi on version 25.1.3.0.

Web Proxy use cases configured through the REST API are not handled correctly.



Fixed an issue where the DHCP load balancing secs field was not incrementing correctly.

Added support for user-defined iptables/nftables chains and interface-specific parameters.

End users can connect to the VIP, but backend resources become inaccessible. This occurs because network packets are no longer tagged after one of the VLAN interfaces goes missing.

Hostname resolution fails when a hostname is mapped to an IPv6 address.



Fixed an issue where administrators were unable to modify and save Host Checker policies due to the error message, "The request body could not be read successfully."



Fixed an issue that caused the ICS REST API VLAN edit operation to return HTTP 422 on ISA clusters with a default VLAN configured on the interface.



Improved handling and collection of daily PostgreSQL logs.

When an SNMP request is performed for Fan Status or Power Status on ISA6500 or ISA8500 hardware devices, the SNMP MIB browser displays the message"No such object".

External ICT incorrectly detects the file /data/runtime/tt/report_behavioral_analytics_user.thtml.ttc as an anomaly.

The message "generate_grub2_config: failed to stamp SB diagnostic version for system A" is displayed on the console.



Fixed an issue where TLS syslog forwarding configured with a custom port did not function correctly.

TLS Syslog forwarding fails when configured to use a custom port.



Fixed an issue that could cause OCSP validation failures for machine certificates when SELinux was running in enforcing mode.



Fixed an issue where custom Set-Cookie directives for the DSSIGNIN cookie, such as HttpOnly and SameSite, were not honored in 25.x releases.



Fixed an issue that could cause the dsagentd process to fail on ICS 22.7R2.12.



Fixed an issue where file share access was unavailable after migrating to ISA6500 on ICS 25.1.3.0.



SSH, RDP Remote file transfer, RDP print fail to work in cluster

Deleting a host entry at the cluster level displays the same host entry removal message twice.

The UEBA package is not synchronized to one of the nodes in a cluster.



The Push Config feature does not work when pushing configuration from an ICS 25.1.1.0 gateway to an ICS 25.1.3.0 gateway after HTTP/2 is enabled on the target 25.1.3.0 device.

Importing a user configuration fails when the configuration includes Web Proxy settings.

Upgrade from ICS 25.1.3.0 build to any 25.x build fails but the messages on Admin UI says: ICS Package scan completed successfully.

Bad Gateway error when using proxy configuration for nSA registration on 25.1.3.0

Fixed an issue where AD domain join reset operations failed when the container name contained a trailing slash.



JSAM fails to launch on macOS when accessed through the Safari browser.





Log improvement to Improve traceability of SML31064 user access log.

Improve admin logs for SAML SSO Policy configurations during resource policies creation/editing.

Max Sessions Log Entries Lack Username and Session ID

Fix the logging context for admin log generated during unlocking of locked TOTP users.

User Access log shows below message even before TOTP fallback prompt entered in Ivanti Client ( only noticed via Ivanti Client based Access

Connect Secure server running 22.7r2.11 code and faces an issue where host header validation failure logs are wrongly be logged as a Terminal Services user.

Bandwidth consumed field appears blank in user access logs

Incorrect details printed in user access logs for host header validation failures.



Fix ISAC behaviour when incorrect RADIUS challenge token is entered during user authentication.

Unable to create AD Authentication server with Domain name containing Single character in 22.7R2.8 and above

In case of cert auth configured, Certificate Restriction causing failure even no cert restrictions are configured and fallback not triggered

ERR24617 is shown in the ICS user access logs, stating that the Kerberos TGT time validity is hardcoded to 5 minutes instead of 10 hours, and therefore fails with an error

CRLs Automatically Disabled Intermittently, Causing User Connection Issues

OCSP validation failure in 22.8R2.3 with SELinux enforcing mode

Missing Eye Icon in Web Browser TOTP Prompt

LDAP Auth Backup Admin Removal Shows ‘0’ and ‘*’ in ICS Device (Version 25.1.1.0)



iPad users are unable to establish VPN connections. The login process becomes stuck at"Host Checker Loading Components", and the VPN tunnel is never established.

Users are unable to connect to VPN after upgrading to 22.7R2.8 and above, with the error: "Removing the connection due to IP allocation failure."

Intermittent IP Allocation Failures Due to TUNSETIFF Error

IP Allocation Failure on ICS 22.7R2.12

L3 tunnel fail to establish after authentication over time

Source IP is disabled upon upgrading the server from 22.7R2.9 to 22.7R2.12



Duplicate IP Addresses on Management VLAN Interface While Creating Cluster on 22.8R2.1



HTML5 RDP Auto-Launch Fails When VPN Tunneling Is Disabled in User Role

HTML5 RDP session are failing on Connect Secure 22.7R2.12 when the camera is enabled in the bookmark

Users sessions face an idle timeout issue when the users is using HTML5 RDP on 22.8R2.2

Login Button in Session Warning Page is Not Clickable on Mobile Devices on 25.1.1.0



Internal Links for Alfresco bookmark are not working via rewriter

Server running 22.8x and is unable to access a site through web rewriter.

Issue in Editing fields while accessing a web resource after upgrading to 22.8R2.1

"The requested resource is not valid." Is seen when The Referer Header URL Contains BackSlash "\"

High CPU / SSL Loop Issues with SharePoint Bookmark on ISA4000-V



FileShare Access Issues Due to Incorrect FileShare AutoPolicy Created by ICS In Certain Condition

After migrating from 9.1rx PSA Connect Secure to 22.7x ISA Connect Secure, the browser ctrl f search for the file share feature cannot locate all files.



ICS is Providing Corrupted SAML Metadata While Downloading via the Connect Secure Entity ID URL Directly on 22.7R2.9 and Above



API and XML import not working properly for Mobile OS checks

Rest API Request to Import Large Number of Users Fails With Error "413 Request Entity Too Large" on ICS 22.8R2.2

REST API unable to fetch the MAC Address of the ICS interfaces for some devices and shows as blank

Unable to create syslog server with custom port failed through Rest API

ACL Validation Failure For Virtual Hostname Resources In Certain Condition on 25.1.1.1

Failure to Add Custom Expressions on 22.7R2.9 Due to Dictionary Memory Limit Exhaustion



Incorrect Interface is used by ICS when HostChecker uses OCSP Traffic Validation for machine cert

LDAPS Port Support and Port Range Behavior on ISA-6000 (22.8R2.1)

DMI/Netconf is not working in 22.7R2.11 onwards



Memory Utilization Gradually Increasing on Ivanti Connect Secure Nodes – Due to dstaillog Process

High Memory Usage on ICS 22.8R2.2 due to nginx Worker processes

NGINX Reload Causing User Disconnections in 22.8R2.3

Recurring “Program nginx recently failed” Events on ICS 22.8R2.3

High CPU Utilization and Server Freezes on System Running ICS 25.1.1.0

Manage Synchronous way of triggering rewriter processes on IP change to avoid duplicates and result in process exhausion

Facing internal server error intermittently while accessing admin UI pages after upgrade to nginx



The system is unable to connect to the local license server and displays the following error: License server low-level protocol error, server=127.0.0.1:5000, Code=[7]: Could not connect

License Leasing Failure on Client Node - 25.1.0.0



PSAL version build details displayed on Admin UI is incorrect-25.x

Config Archiving (Binary vs XML) with password shows a blank box.

NewUI Enforce Post Upgrading to ICS 22.7R2.12

Post upgrade to IPS 22.7R1.10 customer is observing web process snapshot and its changing the time on the snapshot page

500 internal CGI error message shown to users logging in to ICS via web browser after ICS upgraded to 22.7R2.11



Pop-Up Appears while connecting to JSAM - Error "Cannot find the hosts file. Please contact your Administrator"

JSAM displays a certificate expiration warning/error even though the application was signed with a valid certificate. The validation incorrectly uses the current system date instead of the certificate signing timestamp.



UEBA database appears to be out of date and classifying IP address as wrong country



22.7R2.10 Connect Secure server is unable to use SCP Archive to their Windows server that has a P drive set up.



In dsserver execution correct commit while iteration code usage



Intermittent Packet Loss On Internal Interface From Tunnels Leading to Resource Access Failures for All Tunnel Users, fix

Issues with access backend resources through Passthrough Proxy after upgrading to 25.1.1.0



PSAM issue persist in 22.7R211

Unable to Download DSRecord File From ICS When Username Contains the Characters "\" and "@"



Intermittent packet loss on the internal interface from tunnels causes resource access failures for all tunnel users.

Intermittent IP Allocation Failures in Active/Active Cluster.

OCSP validation failure in 22.8R2.3 with SELinux enforcing mode.

Client UI mode neux is enforced post upgrading to ICS 22.7R2.12

Source IP is disabled upon upgrading the server from 22.7R2.9 to 22.7R2.12

LDAPS Port Support and Port Range Behavior on ISA-6000.

Unable to Download License via Proxy.

Navigating through the Admin UI intermittently results in the error “The server had an internal error” on various pages in version 25.1.1.0.







Users are unable to access core resources because the rate limiting feature restricts connections in certain conditions.

RADIUS disconnect requests do not terminate the session.

Encountered an error "Invalid LDAP server IP address".

OAuth time skew is not functioning according to the configured values.

WAF issue observed when configuring CRL (Certificate Revocation List).

ICS allows SHA1 trusted client/server CA certificate to import.

Switching from TLS 1.2 to TLS 1.3, end users are not prompted to select a user certificate and instead see a "Missing certificate" error.

3-level hierarchy certificate authentication is not functioning.

REST API-based authentication fails when the administrator password contains the special character ":", while the same password works correctly via the admin Web GUI.

OAuth authentication fails when using PKCE (Proof Key for Code Exchange) on ICS

OCSP authentication fails as a result of an OpenSSL error.



Multiple monitors use case does not work when RDP bookmark created for Smart card VM.



Host Checker Component and PSAL is not launching for the remediation scenarios in Edge and Chrome browser.



Fixed an issue where small file downloads via a Web application failed over a PSAM-connected tunnel on 22.8R2.3, with the ICS device sending RST, ACK. This issue has been resolved in ICS 25.1.1.0.



RDP print functionality is not working when the print option is enabled in an RDP HTML5.

Unable to create HTML5 SSH resource profile via REST API.

File upload fails during an SSH session.

Advance HTML5 SSH session fails to login via private key.



In a cluster setup, UEBA (User and Entity Behavior Analytics) functionality does not work for the first user who accesses the system after an upgrade

Change Machine Password in Troubleshooting section of AD server configuration does not work.

On the AD troubleshooting page, DNS resolution checks fail for some AD servers when multiple AD servers are configured. DNS resolution is only successful for the AD server that is also configured as the DNS server.

AD server uses AES256 encryption type for Kerberos. Authentication protocol even when AES 256 encyption option is not enabled.

Node secret is not generated on the RSA server, resulting in the absence of the node verification file on the Ivanti Connect Secure (ICS) device.

Active Directory (AD) traffic segregation is not functioning as expected at both the global and server levels. Specifically, if DNS is configured on a non-internal port, domain join fails, and DNS traffic does not flow through the non-internal port.



Screen recording for an end-user session fails (recording cannot be saved or downloaded) when the “Screen Recording End User” option is enabled in a bookmark and an end user attempts to utilize session recording.

An invalid URL is accessed in the end-user login page, clicking the OK button does not redirect or navigate the user to the home page.

A bookmark is created, the description field automatically includes an extra "0" (zero).

HTML5 client copy-paste functioality does not work.

Blank spaces are appended to the NetBIOS name for macOS devices in Host Checker policy results.

The web login page does not load properly after enabling TLS 1.3.

Translation errors appears in File Upload and Save Options on End user page



An Admin attempts to delete more than 198 users at once, the Web Application Firewall (WAF) blocks the request.

No "Upload successful" message is displayed after uploading a WAF ruleset package.

WAF logs missing the source IP address.



File system check (fsck) related messages are seen in the console.

ICS console shows boot manager screen.



Android devices are unable to sync emails using ActiveSync.

iOS devices using ActiveSync are unable to send or receive emails with attachments after upgrading ICS to version 22.8R2.2.



Nginx process is crashing, resulting in inability to access the Connect Secure server.

The NGINX program recently failed, causing service disruption.

Restarting the Nginx process results in all user sessions being dropped on ICS.

The web page does not display or function as expected when accessed via a pass-through proxy.



The API PUT request for realm role-mappings fails when there are more than 249 role-mappings included in the request.

Users receive an ERR_EMPTY_RESPONSE error when attempting to connect directly to PTP (Point-to-Point) resources through the rewriter.



VPN sessions disconnect intermittently, displaying the error message "auth check failed, session has expired."

The Radius process crashes unexpectedly on ICS 22.8R2.1.

Traffic ceases on SSL VPN tunnels following an upgrade to version 22.8R2.1.



PSAL fails to launch or operate correctly when the browser language is set to any language other than English.