The layer 7 rules you have are really layer 3 rules. You could configure them all in the layer 3 firewall.   Do you have a port forward configured for port 22? You can configure the list of allowed hosts there. ... View more

If your web traffic is going through the VPN service terminated on your device then the MX filtering will not apply to it (a side-effect which is arguably the whole point of the VPN service). ... View more

Follow the packets: take packet captures on your device and tthe MX and see if it's eating the packets. If it is, disable all security features and try again. ... View more

Have you tried configuring a manual VPN IP/port for your vMX? If there's issues like the other poster suggested it may be resolved by this.  Specifically, if the src port of outbound UDP connections at your broken sites are being remapped, the NAT punching logic likely breaks. Setting a static IP/port allows it to work without needing the NAT punching logic.   Follow up Q: your post doesn't mention anything about a Checkpoint firewall, but the title does. Why is that? ... View more

Your can do active-active in the data center, it's just not with warm spare mode.   You could additionally have warm spares for each of the active nodes for redundancy.   As I understand it, the argument against an active warm spar is that if you have two MXen worth of load, then you don't really have high availability. The moment one MX goes down, the other will choke and drop stuff.   It sounds like the feature you really want is clustering, where N MXen can act as a single logical one. Active-active is just a lazy version that only supports 2 nodes. ... View more

I bet you could but in that mode it's basically an l2 bridge from WAN to LAN.   If you attach the WAN and LAN ports of two bridge mode MXes to the same respective segments you will have created a loop. You then have STP block one of the ports so only one link is effective.   Notably warm spare mode doesn't add any value as you get the same effect by just hooking up two different MXen. The stats are aggregated together, I suppose. ... View more

I think the tricky thing is that the MX does not participate in STP and it forwards the STP frames across its LAN links. This will result in some subset of the MX-attached switch ports getting blocked.   in theory this is okay since the blocked connections are redundant but there may be other implications. ... View more