6.5.4 Appliance

Released November 26 2025

Updates

Device claim script execution in 6.6 clients requires the profile DNS name to be included in the license file. This version is compatible with the new license file and allows 6.6 clients to run device claim scripts. 6.6 clients that don't need to run device claim scripts are compatible with older 6.4 and 6.5 Controllers. Please contact AppGate support to get the new license file.
Multiple STIG warnings were resolved in the STIG customization.
The token life cycle logic was improved.

Fixed an issue where an excluded range in an IP pool made some of the Controllers stop giving out IPs. This applies only to multi-Controller collectives.
Fixed an issue where an upgrade would fail due to BDR failing to get a version while waiting for consensus.
Fixed an issue where the Admin UI setting “Proxy Protocol” was ignored.
Fixed an issue where services would fail to apply new configurations.

Fixed an issue where there was a risk that name resolving would stop working when configuration changes occurred rapidly.
Fixed an issue where name resolution would stop working when a DNS name attempted to be resolved and no matching match domain was present.

Added support for Elastic Cloud Serverless (https://www.elastic.co/docs/deploy-manage/deploy/elastic-cloud/serverless) LogForwarder destinations. An API Key authentication needs to be utilized when configuring this option in the UI.
Fixed an issue on source appliances where, after a long LogForwarder/LogServer outage, health status would show as Healthy and re-connection attempts would be too frequent.
Fixed an issue where the LogForwarder stopped forwarding logs on ZTP-enabled collectives.

Fixed an issue where the Secret Form was not following the user's privilege.
Fixed an issue where the identity provider with type OIDC had incorrect help texts for the Issuer and Audience / Client ID fields.
Fixed an issue where not all Entitlements were displayed in Conditions' Linked Entitlements modal.

Improved the AWS HA Connector failover such that routes in the VPC Route Table are automatically updated to point to the Master instance's network interface.