i get the solution.
1)i tried to new cluster member, replace add exist gateway.
2)cancel anti-bot & advanced dns, anti-virus
3)in all gateway interfaces, cancel perform anti-spoofing based on interface topology.
4)publish these changes, although i got the error.
(because install policy needs the cluster object)
and then as screenshot, create a policy & install.
i'm successful!
however, happen something let me confused...
first, i'm very sure my success includes create the policy, but when i disable or delete the policy and install, i think i will lose the cluster.
in fact, the cluster and members are still health.
anyway, very thankful all support!