Adding an interface (either physical, or logical) on a cluster member is done in Operating System. Check Point kernel always attaches itself to the interface. As a result, Cluster Layer also detects a new interface, and by design, expect to receive and to send CCP packets through that interface. Since this new interface is not defined yet in cluster Topology, CCP packets will not be sent/received through that interface. As a result, Cluster Layer declares that interface as failed, which in turn causes fail-over.

Removing an interface (either physical, or logical) on a cluster member cause the Cluster Layer to detect less interfaces than on the other member. By design, fail-over occurs in such case.