topic Re: Not able to configure VSX cluster in Firewall and Security Management

Not able to configure VSX cluster

robertp — Mon, 10 Nov 2025 13:17:35 GMT

Hey. We bought 4 new devices (9400) and are trying to configure two new VSX clusters. I enabled clusterxl and vsls in cpconfig, configured ntp, default route, hostnames and pretty much that's it. When adding the cluster to a domain in MDS throws me an error (see attached). I am running r81.20 with jumbo 118. MDS is also r81.20 and take 113.

Any ideas, suggestions? There are no interface aliases so sk144832 is not valid.

Of course I raised a case with TAC but they refused to help saying I need to pay for professional services (which for me is absolutely absurd) as it's a new deployment.

Re: Not able to configure VSX cluster

Chris_Atkinson — Mon, 10 Nov 2025 13:50:25 GMT

Can you share the routing table and interface ip/netmask etc?

Re: Not able to configure VSX cluster

robertp — Mon, 10 Nov 2025 13:57:55 GMT

[Expert@redacted:0]# ifconfig
Mgmt Link encap:Ethernet HWaddr 00:1C:7F:C7:E2:EA
inet addr:10.43.16.24 Bcast:10.43.16.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:362753 errors:0 dropped:0 overruns:0 frame:0
TX packets:30189 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:22495554 (21.4 MiB) TX bytes:4468455 (4.2 MiB)

Sync Link encap:Ethernet HWaddr 00:1C:7F:C7:E2:E9
inet addr:100.100.100.1 Bcast:100.100.100.3 Mask:255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

eth5 Link encap:Ethernet HWaddr 00:1C:7F:C7:E2:E5
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9354 errors:0 dropped:0 overruns:0 frame:0
TX packets:5643 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2124930 (2.0 MiB) TX bytes:1929906 (1.8 MiB)

lo Link encap:Local Loopback Media:unknown(auto)
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK NOTRAILERS RUNNING PROMISC ALLMULTI DYNAMIC MTU:65536 Metric:1
RX packets:3303499 errors:0 dropped:0 overruns:0 frame:0
TX packets:3303499 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:639903185 (610.2 MiB) TX bytes:639903185 (610.2 MiB)

[Expert@redacted:0]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.43.16.1 0.0.0.0 UG 0 0 0 Mgmt
10.43.16.0 0.0.0.0 255.255.255.0 U 0 0 0 Mgmt
100.100.100.0 0.0.0.0 255.255.255.252 U 0 0 0 Sync
redacted 10.43.16.1 255.255.0.0 UG 0 0 0 Mgmt -- I added one of our mgmt networks to check if it will fix it, same result when it wasn't here

Re: Not able to configure VSX cluster

Lesley — Mon, 10 Nov 2025 19:32:31 GMT

clish -> set vsx off

make screenshots of the interface in gaia web interface and also routing table.

screenshot default route, check if there is no second ip configured as default ip.

after you done turn vsx on

route -n is from the linux OS. Would like to see the gaia config. alternative is clish -> show configuration

Re: Not able to configure VSX cluster

genisis__ — Mon, 10 Nov 2025 20:36:12 GMT

what version are you running? Do you actually have VSX licenses for all 4 nodes?

i normally build gateways as normal, ensure you have defined your sync networks and your layer setup is spot on.

The create a VSX cluster in the DMS you want to manage the cluster (normally I do it on the Main DMS), and let the process convert the gateways to VSX.

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 09:22:47 GMT

Hey, doesn't look suspicious:

redacted> set vsx off
redacted> show configuration static-route
set static-route default nexthop gateway address 10.43.16.1 on
set static-route 161.89.0.0/16 nexthop gateway address 10.43.16.1 on
redacted> show route
Codes: C - Connected, S - Static, R - RIP, B - BGP (D - Default),
O - OSPF IntraArea (IA - InterArea, E - External, N - NSSA),
IS - IS-IS (L1 - Level 1, L2 - Level 2, IA - InterArea, E - External),
A - Aggregate, K - Kernel Remnant, H - Hidden, P - Suppressed,
NP - NAT Pool, U - Unreachable, i - Inactive

S 0.0.0.0/0 via 10.43.16.1, Mgmt, cost 0, age 407222
C 10.43.16.0/24 is directly connected, Mgmt
C 100.100.100.0/30 is directly connected, Sync
Sync
C 127.0.0.0/8 is directly connected, lo
S redacted/16 via 10.43.16.1, Mgmt, cost 0, age 407222

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 09:29:48 GMT

Hi, 81.20. I don't have the licenses on yet but I'm still on the trial one for a few days so that should cover it. I know I won't be able to create the needed VS-es but I would expect to be able to add the cluster at least.

As for creating the cluster - that's what I did at start. Also tried enabling VSX first - no difference.

Re: Not able to configure VSX cluster

AkosBakos — Tue, 11 Nov 2025 09:51:32 GMT

I am not 100% sure about that, the trial license contains the VSX feaute or not?

can you paste the #cplic print -p output?

Re: Not able to configure VSX cluster

genisis__ — Tue, 11 Nov 2025 09:53:27 GMT

I believe it does - I did a lab in Proxmox and used a trial license and that seemed to work fine.

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 09:58:04 GMT

redacted> cplic print -p
Host Expiration Primitive-Features

======================================================================
Check Point product trial period will expire in 10 days.
Until then, you will be able to use the complete Check Point Product Suite.
Please obtain a permanent license from Check Point User Center at:
https://usercenter.checkpoint.com/pub/usercenter/get_started.html
======================================================================

But as genisis__ mentioned - it should work fine. This is also what I did the last time I set up a VSX. The only thing missing is the VS license (I even remember reading that 2 VS (root+1 production) are always available)

Re: Not able to configure VSX cluster

genisis__ — Tue, 11 Nov 2025 10:05:35 GMT

On my trial license (when it was active) It listed all the features.

How did you generate the trial license? Did you you select all-in-one? So everything is included? (Would do a screen shot but Checkpoint site is down again).

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 10:09:02 GMT

Hi, It's the one that comes in with the box, I didn't generate a new one. I think that one always showed like this.

In the meanwhile, I tried adding a single VSX gateway instead of the cluster and it still doesn't work, but the error is different. Maybe that will be a better clue.

Re: Not able to configure VSX cluster

AkosBakos — Tue, 11 Nov 2025 10:10:37 GMT

The trial licence created when you install the component.

The EVAL license that what what are you talking about 🙂

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 10:17:24 GMT

Eval, right 😉 Still I think it should work. I'll add the proper licenses just for the sake of it but I doubt that will fix it (still it will be funny if it does).

Re: Not able to configure VSX cluster

AkosBakos — Tue, 11 Nov 2025 10:31:16 GMT

Have you checked this SK?

"Failed to resolve Management Virtual System NIC" error

https://support.checkpoint.com/results/sk/sk92556

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 10:35:08 GMT

Hi, saw it but neither the platform nor the version match. The naming convention of the Mgmt interface also.

Re: Not able to configure VSX cluster

genisis__ — Tue, 11 Nov 2025 10:41:06 GMT

Got into the support site, finally.

The 'Eval' I generated was "All In One Security Bundle"

Re: Not able to configure VSX cluster

AkosBakos — Tue, 11 Nov 2025 10:44:56 GMT

You told that, this method worked in your ALB environment. I suppose tht, you install a brand new MGMT for testing.

We ran into not the same error, but a little bit similar. The root cause was thatm the implied rules were not allowed.

Compare the Global parameters between you LAB and PROD environment. Maythe turns out something.

Re: Not able to configure VSX cluster

genisis__ — Tue, 11 Nov 2025 10:48:54 GMT

I've had the problem as well - the Implied rules defo need to be enabled prior to VSX cluster setup

Re: Not able to configure VSX cluster

robertp — Tue, 11 Nov 2025 11:11:55 GMT

I deployed a new CMA for this and left everything default. Implied rules are definitely enabled, unless I am missing something obvious.

I also attached the license to one of the boxes I am testing on right now:

[Expert@redacted:0]# cplic print
Host Expiration Features
10.43.16.24 never CPAP-SG940X CPSB-FW CPSG-C-16-U CPSG-C-4-U CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSG-VSX-3S CPSB-IPS CPSB-URLF CPSB-APCL CPSB-AV CPSB-ABOT-L CPSB-ASPM CPSB-CTNT redacted