topic Re: VTI - VSNext in Firewall and Security Management

VTI - VSNext

Aniceto10 — Thu, 06 Nov 2025 17:02:18 GMT

Hi !

I'm trying to test some features of VSNext - Elastic.

I've followed the proc (Solved: VLAN trunk in vsnext - Check Point CheckMates) to use Vlans in the VS (attaching and detaching from VS0) but now I'm having an issue using VTI, and I didn't find any topics/docs about it.

Basically, I created a vpnt1 as VTI in VS0, and edited the VS context to move this VTI to it. The task was completed, but when I try to get topology for this object in SmartConsole, I cannot see the Virtual Tunnel Interface.

I'm attaching screenshots with the Interfaces tab and the get topology info of this VS context.

Does anyone have a way to make VTI work in VSNext?

Regards.

Re: VTI - VSNext

Wolfgang — Thu, 06 Nov 2025 19:18:46 GMT

@Aniceto10 have a look at the VTI limitations..

VSNext / VSX supported features

Blade / Feature	R82 VSNext	R82 Traditional VSX	R81.20	R81.10	R81
VPN Site-to-Site - VTI - Numbered	Yes After creating the VTI, you must reboot the Security Group (PMTR-119289)	Yes	Yes	Yes	Yes
VPN Site-to-Site - VTI - Unnumbered	No (PMTR-60112)	No (by design)	No (by design)	No (by design)	No (by design)

Re: VTI - VSNext

the_rock — Thu, 06 Nov 2025 19:21:38 GMT

Im fairly sure thats a limitation, specially if its unnumbered VTI, which seems it is in your case.

https://support.checkpoint.com/results/sk/sk79700

Re: VTI - VSNext

the_rock — Thu, 06 Nov 2025 19:24:21 GMT

Thats exactly what I was looking at Wolfgang...seems one way to get around it is use numbered VTIs. I will say, though this is just my personal experience, unnumbered ones work way better for BGP / express route.

Re: VTI - VSNext

Aniceto10 — Thu, 06 Nov 2025 20:34:52 GMT

Thank you Wolfgang.

After reboot, I can see the VTI when run get topology now.

Probably this issue will be fixed soon (next JHF or R82.10).

Regards.

Re: VTI - VSNext

the_rock — Thu, 06 Nov 2025 20:37:23 GMT

Excellent!