•This release resolves an issue that caused some configuration saves to fail to take effect on XTM 21 – 23 devices. 
•A problem that caused the XTM 1050 10 Gigabit Fiber ports to fail has been resolved. 
•This release resolves a problem that caused a kernel crash when a reset packet is sent out through the 10 Gigabit Fiber ports on the XTM 1050 and XTM 2050. [70384, 70296]
•RSS feeds no longer try to download RSS updates every six minutes. RSS updates are now queried every 24 hours. 
•A memory leak related to the OSS-Config process has been resolved. 
Proxies and Subscription Services
•The SIP ALG now supports REFER method for call transfers. 
•File downloads no longer stall when you use an HTTP packet filter policy with IPS. 
•The scand process has been improved to restart more quickly in the event of a crash.
Logging and Reporting
•This release resolves an issue that caused the logging processes on the XTM device to use a high percentage of CPU. [59979, 66060]
•The SNMP process is now automatically restarted if it becomes stuck in a dormant state. [66491, 70975]
•The IGMP_Max_Membership setting for OSPF has been increased to support a large number of VLANs with dynamic routing. 
•The Terminal Services TO Agent now works correctly when used in an active/passive FireCluster. [70098, 69944]
•This release resolves a problem that caused the master in an XTM 2050 FireCluster to go into an idle state when you added a new interface. 
•This release resolves an issue that caused a low memory condition when an active/passive FireCluster was configured. 
•The Virtual MAC address is no longer sent from the backup master when you use an active/passive FireCluster with DHCP relay enabled. 
•The amount of time it takes to fail over from a leased line to a branch office VPN with OSPF or BGP has been reduced. 
•This release improves Branch Office VPN stability for XTM devices behind a network device that applies NAT. [70394, 59859]
•This release resolves a problem that caused the IKED process to crash under certain conditions. 
•Frequent Mobile VPN client connect/disconnect sequences no longer cause a low memory condition for the XTM device. 
•The Mobile VPN client for iOS no longer disconnects after three minutes of idle time. 
You can download 11.6.5 Update 1 Build # 415678 from Watchguard Support Portal by logging in to your account.
Watchguard XTM Firewall and UTM Appliance – High CPU Usage in scand process causes lag and typing delay in Remote Desktop Sessions (RDP). You may find that remote users report a lag with Remote Desktop Sessions, freezing sessions, black screen and random disconnections. At around the same time users report these issues you may find that the CPU usage of the scand process on your Watchguard has increased to 100% and the majority of the activity is attributed to the scand process. You may be able to recreate this issue by browsing websites that utilise lots of Adobe Flash or Media Content as GAV will need to scan all these elements of the web page. Login to the Watchguard System Manager and then open Firebox System Manager click on Status Report and scroll down the report until you find the Process List (Screenshot Below). This information will automatically update every 30 seconds so you can see the %CPU column will change and update every 30 seconds. The top value system shows the overall CPU utilisation and if you look further down you can see which sub processes are actually occupying the CPU time and making up the overall system usage. In the screenshot below we can see that system is showing 100 % CPU Usage and then further down we can see that the scand process is accounting for 90.99% of this. When the CPU Usage reaches 100% on the Watchguard unit it may stop forwarding other traffic and this accounts for the lag and jitter we see within the Remote Desktop Session. Other time sensitive traffic such as VoIP or SIP traffic may also be affected by this issue as the packets are delayed whilst the Firewall recovers from the resource exhaustion. Users may also report that web pages are slow to load at the time these issues occur where the GAV process is still dealing with the other requests.
You can try disabling the GAV (gateway antivirus) for the HTTP and FTP Proxy to ensure that this is the actual cause of your issues, if the problem subsides then you may need to consider updating the XTM OS to the latest release i.e. 11.5.2 and/or adjusting the GAV policy so that it does not scan some content i.e. Images/Text within websites. You may also need to consider opening a support case with Watchguard to make them aware of this issue, if you have a large number of users then you may even need to consider upgrading your XTM appliance to a larger unit i.e. XTM 23 to XTM 505 or XTM 22 to XTM330 to provide additional processing power (CPU) and system resources to cope with the additional anti-virus scanning requirements.
Cannot browse some sites and logs report GAV job open failed (failed to connect to scand at scand)
You may find that you cannot access or browse some websites when you are using a Watchguard XTM Firewall or UTM device and the GAV (gateway antivirus) is enabled. When you review the appliance logs you see the following event logged GAV job open failed (failed to connect to scand at scand). In this instance the anti-virus proces or component of the XTM device has probably crashed or stopped responding.
You might be able to permantently resolve this issue by upgrading to a newer XTM OS i.e. 11.4.2 to 11.5.2 or you may simply need to apply the latest CSP release for the XTM OS build you are using i.e. 11.4.2 CSP9 (Service Pack). Newer OS releases and Service Packs often included fixes for these sorts of GAV issue.
A workaround would be to schedule a reboot of your Watchguard XTM appliance, this will reset the GAV (gateway antivirus) and should allow pages to load correctly again.