topic Re: Disabling interface on VS in Firewall and Security Management

Disabling interface on VS

_Daniel_ — Mon, 22 Jan 2024 02:44:39 GMT

Hi All,

We're aware on how to remove an interface on a VS by using the vsx_provisioning_tool; but what would be the best way to just disable a bond "sub-interface" on a VS -in a VSX cluster.

Is it by using the below commands:

On VSX member 1 (where our VS is active)

set vsx off

set interface bond2.15 state off

set vsx on

And repeat the above on VSX member 2 (where our VS is standby)

Re: Disabling interface on VS

the_rock — Sun, 07 Jan 2024 23:27:10 GMT

That sounds logical, based on below as well

Best,

Andy

https://community.checkpoint.com/t5/Security-Gateways/Remove-interface-from-VSX-systems/td-p/65004

Re: Disabling interface on VS

JozkoMrkvicka — Mon, 08 Jan 2024 06:48:15 GMT

You want to delete only VLAN 15 configured on bond2, or delete complete bond2 logical interface ?

Re: Disabling interface on VS

_Daniel_ — Tue, 09 Jan 2024 00:48:22 GMT

Hi Jozko,

Not delete, rather disable vlan15 on bond2, i.e. bond2.15 -we need to re-enable back in some time.

Re: Disabling interface on VS

Lari_Luoma — Tue, 09 Jan 2024 00:36:52 GMT

I have tested setting vsx wrp-interface down simply with ifconfig. It won't survive reboot though, but will work.

Re: Disabling interface on VS

JozkoMrkvicka — Tue, 09 Jan 2024 06:47:16 GMT

The correct way is to delete VLAN from Topology tab within affected VS in SmartConsole. Do not forget to install policy afterwards.

Once the VLAN is needed again, just add it back.

Re: Disabling interface on VS

_Daniel_ — Wed, 10 Jan 2024 02:49:43 GMT

To get you right:
1- disable the interface from clish
2- delete it from the Topology tab for the affected VS in SmartConsole
3- push the policy

To reactivate it, just reverse the above steps

Re: Disabling interface on VS

JozkoMrkvicka — Wed, 10 Jan 2024 08:30:40 GMT

Disable interface from CLI within VS is not needed. SmartConsole will remove it during provisioning proccess (once you click OK with deleted VLAN on VS object).

Re: Disabling interface on VS

Matlu — Wed, 21 May 2025 15:04:18 GMT

Hello

Is it possible to disable an interface that is part of a VSX Cluster?

I have a lab environment, where the Eth2 interface is the SYNC interface between my VSX1 and VSX2 box

My Cluster does not “wake up”, and emphasizes that the problem is the Eth2 interface

I have done everything at VMWARE level but I still can't fix it

I want to logically shut down the Eth2 interface from each box

Is this possible?

Could you guide me with the steps to follow?

Thanks

Re: Disabling interface on VS

the_rock — Wed, 21 May 2025 15:07:57 GMT

I believe generic linux command would be if eth2 down

Andy