topic Re: dual MHO(140) in Hyperscale Firewall (Maestro)

dual MHO(140)

cyberfinder — Mon, 18 Jul 2022 19:51:29 GMT

could you please guide me the right configuration for single site dual MHOs(140), as i have completed the first time config .but ,observed in the orchestrators, connected gateways(16600SP) are not visible and only local interfaces are visible.

also, lldpctl is showing the all the connected gateways and orchestrator info.

orchestrators version- R81.10 ,HF 55

gateways version - R81.10 scalable platform , HF55

below are the config which i have completed :-

MHO-01

configured mgmt interface IP.

set maestro configuration orchestrator-amount 1, then cabled gateways into downlink ports and SYNC port 48.

connected MHO-02, configured mgmt interface IP, and executed below command.

set maestro configuration orchestrator-amount 2

Re: dual MHO(140)

Chris_Atkinson — Tue, 19 Jul 2022 00:46:43 GMT

Are the cables connected consistently across both MHO?

What do you see if you execute:

[Expert@My-Orchestrator01:0]# orch_stat -L

Re: dual MHO(140)

Yasushi_Kono1 — Fri, 29 Jul 2022 11:41:07 GMT

On both MHOs, you have to configure

set maestro configuration orchestrator-amount 2

Re: dual MHO(140)

cyberfinder — Mon, 01 Aug 2022 15:58:10 GMT

[Expert@MHO-02:0]# orch_stat -L

LLDP Status
+---------------+--------------+------------+------+-------------------+---------+-------------+
| Physical Port | Logical Port | Hostname | Type | HW Type | Version | IP |
+---------------+--------------+------------+------+-------------------+---------+-------------+
| 2/27/1 | 27 | gw-45f271. | GW | Check Point 16200 | R81.10 | 0.0.0.0 |
+---------------+--------------+------------+------+-------------------+---------+-------------+
| 2/48/1 | 48 | MHO-01 | --- | --- | --- | 192.168.1.2 |

Re: dual MHO(140)

cyberfinder — Mon, 01 Aug 2022 16:00:20 GMT

yes i did and restarted orchestrators ,but still in secondary MHO not showing gateways

Re: dual MHO(140)

Yasushi_Kono1 — Mon, 01 Aug 2022 16:22:02 GMT

So, one suspect is that the SYNC port is not working properly or you haven't connected both of the MHOs through the SYNC interface. What, if you would only use the secondary MHO and connect the appliances only to that one?

Re: dual MHO(140)

cyberfinder — Mon, 01 Aug 2022 16:29:46 GMT

sync port is connected back-back over port 48, let me try connecting GW only to MHO2 and update you the result.

below value should be same on both unit ?

" maestro configuration orchestrator-member-id 1

Re: dual MHO(140)

Yasushi_Kono1 — Mon, 01 Aug 2022 16:31:57 GMT

Just to make sure that MHO2 runs in a single MHO configuration. So, the above command is not quite right.

Should read: maestro configuration orchestrator-amount 1

Re: dual MHO(140)

cyberfinder — Mon, 01 Aug 2022 16:56:30 GMT

appreciate if you could list down the commands from the beginning which should I run on the both MHOs.

Re: dual MHO(140)

Yasushi_Kono1 — Tue, 02 Aug 2022 19:54:24 GMT

Just shutdown the first MHO. Then specify the amount of orchestrator to one:

MHO2> set maestro configuration orchestrator-amount 1

MHO2> save config

If you launch the WebUI and click the „orchestrator“ option in the left pane, can you see the gateways under „Unassigned Gateways“? And what can you see under „Unassigned Interfaces“?

Re: dual MHO(140)

Yasushi_Kono1 — Thu, 11 Aug 2022 08:30:53 GMT

In the meanwhile, I configured two MHO175 with six 16600HS. No problems at all. The MHOs were shipped with R80.20SP, so I did an inplace-upgrade to R81.10SP. Do not forget to upgrade the Deployment Agent as well.

Even though the MHOs were running R80.20SP, I could have a look at the attached appliances with the "lldpctl" command.

You have to make sure that both of your MHOs are running the same CP version.

Re: dual MHO(140)

cyberfinder — Thu, 11 Aug 2022 09:12:37 GMT

both CP are running the same version and , i could see the both gateway units on primary MHO but not in secondary MHO. could you please send me the the maestro configuration of primary and secondary MHO

Re: dual MHO(140)

Yasushi_Kono1 — Thu, 11 Aug 2022 09:41:16 GMT

Usually, you do not have to configure the second MHO explicitly. You just connect both MHOs via SYNC interface. There are two different sync ports: SSM and Site_Sync.

If you connect to the SMO and type the following command:

[Global] SG01-ch01-01> set maestro port [TAB], can you also see interfaces starting with "2" instead of "1"? The first number correspond to the MHO member id.