As explained in article 3577. the base circuit used in group-interface assumes non-visible logical-all statement. So, in case of VSX it will be the template circuit that needs to be configured within
mode multi-link circuit <circuit-name> statement in the group-interface context.
Also, in DBHA setup, the template circuits should be configured within VRRP section before pushing the configuration to the chassis via the Check Point GUI, otherwise the IP address will be assigned at the circuit level instead of the VRRP level.
Here are the best practice steps for using group-interface with VSX application:
1. Configure a VSX template circuit.
Here is an example to create the template circuit inside for vap-group vsx
configure circuit inside
device-name ins
vap-group vsx
ip-forwarding2. Configure the group interface:
Here is an example to create group interface mlt1 for interfaces 1/1 and 1/2
configure group-interface mlt1
interface-type Ethernet
mode multi-link circuit inside
interface 1/1
interface 1/23. Create a virtual-router vrrp-id for template circuit mlt1
Here is an example for creating vrrp-id 51 for circuit mlt1 defined above and assigning the priority delta of 10. We will assume VRRP failover-group fgvsx with failover-group-id 1 has already been created.
configure vrrp failover-group fgvsx failover-group-id 1
virtual-router vrrp-id 51 circuit inside
priority-delta 10
mac-usage vrrp-mac
backup-stay-up
vap-group vsx4. Perform the steps 1-3 on the second chassis as well while ensuring to use the same vrrp-id.
5. Once the above configuration is completed, you may use the template circuit (interface
ins in the example above) via Check Point management GUI to create vlan interfaces as needed and push the configuration to the chassis.