The layer 7 rules you have are really layer 3 rules. You could configure them all in the layer 3 firewall.   Do you have a port forward configured for port 22? You can configure the list of allowed hosts there. ... View more

If your web traffic is going through the VPN service terminated on your device then the MX filtering will not apply to it (a side-effect which is arguably the whole point of the VPN service). ... View more

Follow the packets: take packet captures on your device and tthe MX and see if it's eating the packets. If it is, disable all security features and try again. ... View more

Have you tried configuring a manual VPN IP/port for your vMX? If there's issues like the other poster suggested it may be resolved by this.  Specifically, if the src port of outbound UDP connections at your broken sites are being remapped, the NAT punching logic likely breaks. Setting a static IP/port allows it to work without needing the NAT punching logic.   Follow up Q: your post doesn't mention anything about a Checkpoint firewall, but the title does. Why is that? ... View more

Your can do active-active in the data center, it's just not with warm spare mode.   You could additionally have warm spares for each of the active nodes for redundancy.   As I understand it, the argument against an active warm spar is that if you have two MXen worth of load, then you don't really have high availability. The moment one MX goes down, the other will choke and drop stuff.   It sounds like the feature you really want is clustering, where N MXen can act as a single logical one. Active-active is just a lazy version that only supports 2 nodes. ... View more