I strongly recommend against giving the firewalls an interface on a management network. By default, all the interfaces on a Check Point firewall are in the same routing table. Putting multiple firewalls on a given network for management traffic means there are multiple gateways into and out of that network. That's a surefire way to get asymmetric routing, which will lead to weird anti spoofing and stateful inspection drops.
VSX changes this, as it lets you run multiple routing tables on the firewall. It's the same thing as VRF, Fortigate vdom, Palo Alto vsys, and so on.
Another feature, Management Data Plane Separation (MDPS) can also separate management routing from through-traffic routing, though its name is a bit misleading. The management "plane" and the data "plane" are still the same OS running on the same processor. It does not provide true separation like big-iron routers with physically separate cards for management and for passing data. It uses the same underlying technology as VSX, though it is managed differently.
