Enhanced Link Selection cannot select interface with “Cluster IP Addresses on Different Subnets”

[Vanness_Chen]

Hi Experts:

We are currently using a Check Point ClusterXL deployment with “Cluster IP Addresses on Different Subnets”.
According to the ClusterXL Administration Guide, for this type of deployment, the cluster interface topology should be manually configured as:
This Network (Internal) → Specific

and the specific network/group should include both the member physical subnet and the Cluster VIP subnet.
Reference:
https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ClusterXL_AdminGuide/Topics-...

Now we are trying to configure a Site-to-Site VPN using Enhanced Link Selection.
The problem is that the interface used for the VPN cannot be selected in the VPN Community because it is currently defined as Internal / Specific, while Enhanced Link Selection only allows us to select an External Interface.

So the current situation is:
Cluster IP Addresses on Different Subnets
↓
ClusterXL Guide requires:
This Network (Internal) → Specific
↓
Enhanced Link Selection
requires/selects External Interfaces
↓
The VPN interface cannot be selected

We found a CheckMates discussion where an Internet-facing interface in a similar “Cluster IP Addresses on Different Subnets” deployment was changed to:
Internet (External)

and the configuration worked:
https://community.checkpoint.com/t5/General-Topics/Antispoofing-in-external-interfaces-when-Cluster-...

However, this seems to conflict with the ClusterXL Administration Guide, which explicitly recommends This Network (Internal) → Specific for this architecture.

Our questions are:
1. Is it officially supported to configure the Internet-facing cluster interface as Internet (External) when using Cluster IP Addresses on Different Subnets?

2. If yes, does this override or replace the Internal / Specific topology configuration described in the ClusterXL guide?

3. What is the recommended configuration when combining:
- Cluster IP Addresses on Different Subnets
- Site-to-Site VPN
- Enhanced Link Selection

4. Is there any known limitation, SK article, or documented example for this combination?
We would like to avoid changing the interface topology to External unless this is confirmed to be a supported configuration, since topology may also affect Anti-Spoofing and other gateway behavior.

Thanks in advance.

[emmap]

I'm not sure how anti-spoofing would work on an external interface if it's set to internal like that but I haven't tried this sort of setup. Makes sense to me that 'External' would be a valid configuration for it but I can't say for sure.