> Source: [sk92425](https://support.checkpoint.com/results/sk/sk92425)

# sk92425 - How to change the Management IP addresses assigned to VSX cluster and VSX cluster members in Gaia CLISH

| Property | Value |
|----------|-------|
| Solution ID | sk92425 |
| Date Created | 2013-03-08 |
| Last Modified | 2021-06-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Solution

This article describes how to change the management IP addresses assigned to the VSX cluster and VSX cluster members. It also describes relevant routes in Gaia CLISH.

Follow this procedure:

1.

   Perform the relevant changes on Security Management Server / Main Domain Security Management.
   ---------------------------------------------------------------------------------------------

   Run these commands on Security Management Server / Main Domain Security Management (where the VSX cluster object was defined):
   1. *vsx_util change_mgmt_ip* - to change gateway or cluster member management IP address ***within the same subnet*** .

      Comments:
      * Backup the management database before using this command.
      * Execute the command and follow the instructions on the screen.

      <br />

      <br />

   2. *vsx_util change_mgmt_subnet* - to change the gateway / cluster member management IP address ***to a different subnet*** .

      Comments:
      * Back up the management database before you use this command.
      * Execute the command and follow the instructions on the screen.
      * The *'vsx_util*' command only changes routes that were generated automatically. You must remove and/or change all manually-created routes using the previous management subnet.
      * Reboot the VSX Gateway / cluster members after the 'vsx_util' command finishes.
      * Note: For the new management subnet mask, use the actual subnet mask (e.g. 255.255.255.240) and not the CIDR notation.

      <br />

      For more information, see the "Command Line Reference" chapter of the VSX Administration Guide for the relevant version. All VSX product documentation is on the [VSX Homepage](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=documents&product=359).

   <br />

   1. If the VSX policy contains any rules to allow or deny access to the VSX object, do this:  

      1. Create a dummy object representing the new IP address.
      2. Add the dummy object to the relevant rule.
      3. After you finish the procedure, remove the dummy object.
   2. Restart the Security Management server. This causes it to use the new IP for health check connections, and in addition prevents the status from flapping to disconnected state.   

2.

   Perform the relevant changes on VSX gateway / VSX cluster members running on Gaia OS.
   -------------------------------------------------------------------------------------

   **Note:** To complete this procedure, the user must be connected to each VSX machine directly. The user can connect through console (serial cable), or through a Lights Out Management (LOM) card's Keyboard Video Mouse (KVM) feature.

   **Important Note::** The user must get anew license. If the user is not using central licenses then the licenses must be updated.
   1. Enter these commands to disable the VSX mode (from context of Virtual System 0):

      *HostName:0\> set virtual-system 0
      HostName:0\> set vsx off
      HostName\> show vsx*   
      **Note:** If the VSX mode (protection for the interfaces and routes) is not disabled on the VSX machine, it is not possible to change the IP addresses in CLISH on a VSX machine.
   2. From CLISH, change the management IP address(es) and relevant routes.

      For more information, see the "Network Management" chapter of the VSX Administration Guide for the relevant version. All VSX product documentation is on the [VSX Homepage](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=documents&product=359).  

   3. Enter these commands to enable the VSX mode:

      *HostName\> set vsx on*   
      *HostName:0\> show vsx* **Important Note:** If you do not enable VSX mode (protection for the interfaces and routes) on the VSX appliance, you can experience configuration issues. These issues can cause a discrepancy between the databases on VSX Gateway and on the Security Management Server. In addition, the user loses access from CLISH to the context of Virtual Systems.  

   4. Enter this command to save the Gaia configuration:

      *HostName:0\> save config*   

   5. Update the license. Contact [Account Services](http://www.checkpoint.com/form/contact_account.html) for assistance.
   6. Manually reinstall the VSX policy.

   Example (changing gateway's management IP address to 192.168.0.1):
   ------------------------------------------------------------------

   ```
   HostName:0> set virtual-system 0
   Context is set to vsid 0
   HostName:0> set vsx off
   HostName> show vsx 
   VSX Disabled
   
   HostName> set static-route default off
   HostName> delete interface eth0 ipv4-address
   HostName> set interface eth0 ipv4-address 192.168.0.1 mask-length 24
   HostName> set static-route default nexthop gateway address 192.168.0.4 on
   
   HostName> set vsx on
   HostName:0> show vsx
   VSX Enabled 
   
   HostName:0> save config
   ```

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content