R80.30 VSX 3.10 IPS update failure on secondary member

[Alex-]

I've deployed new 26000T appliances running R80.30 3.10 and the latest hotfix in VSX mode (SMS).

Some VS have a variety of security blades enabled but all have at least IPS. I've noticed all secondary members VS are reporting an error on the IPS blade specifically with the following message:

Error: Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.

Other security blade like Anti-Virus and Anti-Bot are not complaining and are green in both members with a successful update status and versioning.

If I VSLS some VS to the second member, the issue remains for IPS only but with cluster members inverted.

Of course, this means I have all my VS in red in the Smart Console.

I've followed sk43807 but none of the solutions work. Everything runs on R80.30 with the latest GA Take (140).

As it's only happening with IPS updates, I believe it's linked to some specific configuration bits but for now I've been unable to solve this. Anyone else experienced this or should I go to TAC?