> Source: [sk111786](https://support.checkpoint.com/results/sk/sk111786)

# sk111786 - Outgoing connections from Virtual System in VSX cluster are sent with source IP address that belongs to cluster Internal Communication Network instead of cluster Virtual IP address

| Property | Value |
|----------|-------|
| Solution ID | sk111786 |
| Date Created | 2016-06-01 |
| Last Modified | 2022-10-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
| Platform | 15000, 3000, 5000 |

## Symptoms

- * Traffic capture on Virtual System in VSX cluster shows that outgoing connections are sent with source IP address that belongs to cluster Internal Communication Network (SmartDashboard - open VSX cluster object - go to "Cluster Members" pane - refer to section "Cluster members internal communication network") instead of cluster Virtual IP address.

* Kernel debug ('`fw ctl debug -m fw + conn vm nat xlate xltrc`') on Virtual System in VSX cluster shows for the affected connections:

  ```
  
  ;fw_xlate_find_all_matches: Found no matching rules for conn < dir 1, Internal_Source_IP:Source_Port -> Dest_IP:Dest_Port IPP N>:; 
  ;fw_xlate_ha_match_epilog: ha NAT not enabled. not performing cluster hide;
  ;fw_xlate_match_epilog: no special NAT;
  ;fw_xlate_match: no match found;
  ;fwx_get_xlation: no translation: flags: 8;
  ;fw_xlate_new_conn: no conn translation buffer for conn < dir 1, Internal_Source_IP:Source_Port -> Dest_IP:Dest_Port IPP N>;
  ```

* Kernel debug on VSX cluster members during a policy installation ('`fw ctl debug -m fw + filter`') shows that value of attribute *perform_cluster_hide_fold* is set to "0" - i.e., "false" (refer to [sk34180](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34180)).

## Cause

Value of attribute "*perform_cluster_hide_fold* " in the object of involved Virtual System is set to "*false*".

Value of attribute *perform_cluster_hide_fold* in Cluster Object controls the following:

* Whether *outgoing* connections from cluster members will be hidden behind Cluster Cluster Virtual IP address - i.e., sent with Source IP address of Cluster Virtual IP address, or sent with Source IP address of member's Physical IP address
* Whether *incoming* connections sent to Cluster Virtual IP address will be folded to member's Physical IP address, or the Destination IP Address will remain as Cluster Virtual IP address.

|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Value of attribute     | How connections are Hidden / Folded by Cluster                                                                                                                                                                                                                                                                                                                                                              |
| *true* ("1") (default) | * Outgoing connections from cluster members will be sent with Source IP address of Cluster Virtual IP address (hidden behind Cluster VIP) * Incoming connections sent to Cluster Virtual IP address will be folded to member's Physical IP address (in case of VSX cluster, with Destination IP address that belongs to cluster Internal Communication Network)                                             |
| *false* ("0")          | * Outgoing connections from cluster members will be sent with Source IP address of member's Physical IP address (in case of VSX cluster, with Source IP address that belongs to cluster Internal Communication Network) * Incoming connections sent to Cluster Virtual IP address will not be folded to member's Physical IP address (the Destination IP Address will remain as Cluster Virtual IP address) |

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content