Check Point logout events and identity removal due to NSX-T API response error

Products

• VMware NSX

Issue/Introduction

• Check Point users experience intermittent logout or authentication failures.
• Security policy rules fail and deny legitimate traffic.
• NSX-T Manager logs show HTTP 4xx or HTTP 5xx API errors frequently.
• The Check Point Controller logs indicate the removal of identities after five consecutive API retrieval failures.

Environment

VMware NSX

Cause

This issue occurs when the Check Point appliance performs high-frequency API polling for NSX group memberships (e.g., GET /policy/api/v1/infra/domains/default/groups/<uuid>/members/ip-addresses).

When these requests target a single NSX Manager node or burst above the per-client rate limit (default 100 requests per second), NSX-T throttles the requests. The Check Point Controller interprets these failed API responses as an "empty group" and removes the associated identities from the security policy.

Resolution

To resolve this issue, the API load must be distributed and the management plane capacity increased:

1. Implement External Load Balancing: Deploy an external L4 load balancer in front of the NSX Manager cluster. Configure the Check Point integration to target the Load Balancer VIP. This ensures API requests are distributed via round-robin across all three nodes, preventing any single node from reaching the rate limit.
2. Increase NSX Manager Form Factor: Upgrade the NSX Manager appliances from the "Medium" form factor to "Large." This provides the necessary CPU and memory resources to handle high-frequency API polling more efficiently.