VSX design help

[#1]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#2]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#3]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#4]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#5]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#6]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#7]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#8]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#9]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#10]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#11]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#12]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#13]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#14]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#15]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#16]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#17]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#18]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#19]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#20]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#21]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#22]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#23]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#24]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#25]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#26]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#27]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#28]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#29]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#30]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#31]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#32]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[#33]

Hi CheckMates,

1. Architecture

• Platform: R81.20 VSX cluster (two appliances).
• Upstream edge: Cisco CSR owned by the carrier.
• Public block: public_IP/26. The carrier will send the whole /26 to one next-hop; they do not want to create a second sub-interface / VLAN.
• Management: out-of-band eth0 on a physical switch → Smart MDSM.

2. Two design options

  Our proposal  Customer request

CSR↔VSX hand-off	Two VLANs • VLAN 100 → VR (routes /26 to VS1-VSn) • VLAN 101 → VS0 (/32 for admin VPN)	One VLAN only • VR owns the whole /26, including the /32 for admin VPN
Admin remote-access	Terminates on VS0 over VLAN 101	Has to terminate on VS0, but through VR over same VLAN
Status	Works fine	Warp link created between VR and VS0, but traffic never reaches VS0; cannot pick VS0 as next-hop for the /32 route

The two diagrams are attached for clarity.

3. What we have tested

• Created VR → assigned the /26 to its external interface.
• Added VS1…VS6, each gets a /32 (or /29) from the /26 — those routes are built automatically via warp links, OK.
• Added a warp link to connect VS0 to the VR (unnumbered).
• Tried to add a static host route <VS0-public>/32 → VS0 inside the VR.
  Problem: VS0 never appears in the drop-down list; CLI (set static-route) complains it is an “invalid next hop”.
• Result: admin VPN can’t establish, SmartConsole can’t reach VS0.

4. Questions for the community

1. Is there a supported way to make VS0 reachable through the same VR, without asking the carrier for a second VLAN?
2. If not, can each Virtual System expose its own “management interface” that SmartConsole could use directly (so the admin VPN could land on the customer’s VS instead of VS0)?
3. Any hidden trick (e.g. numbered warp, PBR, loopback) that would let me route that single /32 back to VS0 while the rest of the /26 stays in the VR?

5. Why we hesitate

• Check Point docs say only VS0 should communicate with the Management Server, and that traffic must not traverse another VS.
• The customer is pushing hard to keep one interconnect on the CSR.

Has anyone solved a similar “single /26 – need admin VPN on VS0” constraint before?
Appreciate any pointers, even if the answer is “you really do need the second VLAN”.

Thanks!

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[Duane_Toler]

As others here have already noted, you don't give access to VS0 in "Legacy VSX".  If they have access to the VSX cluster/gateways, they can manage anyone else's VSX instances, too.  You can enable per-VS SNMP and they can do some monitoring of their own VS.  They can still have SmartConsole access to their own management domain (this is the intent of MDS), but you will want to configure specific administrator profiles to limit certain administrators from being able to manage VSX items; not everyone of their people should be able to edit and accidentally break their VS by clicking random things in SmartConsole.

You can NAT their MDS domain with static NAT at whichever VS handles your default route traffic.  You'll configure the NAT in that VS yourself.  This NAT doesn't matter for your customer's SmartConsole connection.  Just get the traffic to the MDS server; it doesn't have to pass through "their" VS.

If you require them to connect with Endpoint VPN instead, you can use access roles tied to their user account (AD, local/internal, SAML for MFA, whatever you use) and configure the access role with a rule to allow that to access the MDS/CMA internal IP.

For the VPN VS, this assumes all of your VPN client users, for all purposes, are using the same VS since Office Mode is configured on the gateway itself.  In which case, your internal LAN L3 switches will route traffic back to the VPN VS, unless you do "routing tricks" and advertise it from the VS [I do this for some customers; it works via route-map].  From that VS, your MDS should be reachable via VPN clients; it's just internal routing to get the return packets back to the VPN VS for the Office Mode network.

Your last comment said the MDS is on the LAN segment as the VS0 management interface.  Does your MDS have its default gateway set to the VSX cluster VIP on that DMI network?  If so, this may be your primary issue.  One of your diagrams shows VS0 having a direct IP on VLAN 10 from the ISP's CSR.  You won't really need that, because the VS0 cluster VIP should be on its own LAN segment; the MDS is not required to be on this LAN segment, too, but it's ok if it is.

For this LAN segment, put an L3 SVI on the switches add it to your internal LAN routing VRF, then make that SVI your default gateway for the MDS. You will also make it the gateway for the VSX gateways (VS0) so VS0 has outbound access, but not necessarily inbound.  VS0 doesn't need to have a publicly-reachable interface, either.  If your customer is pushing for this, then they are misunderstanding how VSX works (it really is unique).

With these edits, you can achieve exactly what you want:  Customers connect from the outside to their CMA (with or without VPN, or both, your choice), VS0 remains privately internal, MDS on VS0's LAN segment, Virtual Switch for the /26 and each VS gets its own IP from the virtual L2 segment, no mainline traffic passing through VS0 (as Check Point states).  Each VS can handle its own routing requirements.  Via Endpoint VPN client, VSX administrators can SSH into VS0 gateways to do work (because VSX gateways default route will be the new L3 SVI in that VRF which can route office mode back to the VPN VS).

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.

[oli139405 · Accepted solution]

After reviewing the design with Check Point Support, the recommended solution is:

• Keep one public link only for tenant/public traffic, connected to the Virtual Router (VR) in the VSX cluster.

• Do not use VS0 as the Internet-facing VPN gateway for customer administrators.

• Add a separate firewall dedicated to remote administrative access.

• Terminate the admins’ Remote Access VPN on that separate firewall.

• Connect that firewall to the OOB / management network where Smart-1 MDS and VS0 management reside.

• From there, customer administrators connect with SmartConsole to their own Domain/CMA, with proper MDS administrator permissions so they can manage only their own domain and their own VS.

• Access to Gaia/SSH on VS0 should remain blocked for customer users.

So the final separation is:

1. Public / tenant traffic path
   Internet → CSR/Carrier Router → Public block → VSX Virtual Router → Tenant VSs

2. Administrative access path
   Internet → Dedicated VPN firewall → OOB / Management network → Smart-1 / Domain management

This avoids exposing VS0 directly to the Internet, keeps the management plane separated from the data plane, and provides a cleaner and more supportable design for multi-tenant administration.

This was the main point we were missing at the beginning: customer admins do not need to VPN to VS0 itself. They only need a secure path to the management network so they can open SmartConsole to their own domain.

Hope this helps anyone facing the same VSX multi-tenant design question.