topic Re: regarding for VSXs in Firewall and Security Management

regarding for VSXs

Vishal8002 — Thu, 04 Dec 2025 07:28:03 GMT

Hi Everyone,

Good Afternoon,

Please help me regarding. i want to create a 6 VSX in checkpoint. i read most if thing but i cant understand how to create and is that compulsory if i create multiple VSX the we must create a Vertual router or verttual switch.
what command run on gateway for enable the VSX service.
and what must my management ip and what must my external Ip and internal IP.

and i also using a one ISP so how to connectivity and configuration done at the point when i create a VSXs.

Thanks, and Regards

Vishal Kumar

Re: regarding for VSXs

Martijn — Thu, 04 Dec 2025 10:29:51 GMT

Vishal,

When creating a VSX setup, you have two options.

Legacy VSX (R82 and below)
VSXNext (R82)

You have to investigate which option suits your requirements.

Best is to read all VSX documentation available on the Check Point website.

Martijn

Re: regarding for VSXs

Vincent_Bacher — Thu, 04 Dec 2025 10:46:14 GMT

In your case, I would recommend attending the CCVS training, as it is really valuable for VSX beginners.

Re: regarding for VSXs

Chris_Atkinson — Thu, 04 Dec 2025 10:53:19 GMT

This YouTube playlist may help you:

https://youtube.com/playlist?list=PL4Jm1LJEII4ZiVFkjtB1zMyOzn0LUVP21&si=00kTs2AWaENP5slo

Re: regarding for VSXs

Bob_Zimmerman — Thu, 04 Dec 2025 20:58:32 GMT

With VSX, a given VLAN on a given physical interface can only go to one VS. That is, you can't have six VSs all sharing one physical interface to a core transit VLAN. This is where you need a virtual switch. If your six VSs will all use different physical interfaces, or different VLANs on the same physical interfaces, you don't need a switch.

One thing the VSX documentation and introductions don't really cover: use bonds for all of your interfaces. Don't let VSX be aware of any physical interface which isn't in a bond. Stick the physical interface in a bond, then tell VSX to use the bond instead. This helps a LOT when you eventually want to replace the hardware. Bonds can have a single member, and non-LACP bonds with only one member don't need any special support on the switch side.

Re: regarding for VSXs

the_rock — Mon, 08 Dec 2025 03:19:14 GMT

To add to all guys have said.

https://www.youtube.com/watch?v=TDEvZ0zVLAY

https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix (just search for vsx)