topic Re: Maestro dual site basic topology in Hyperscale Firewall (Maestro)

Maestro dual site basic topology

Alex- — Sun, 20 Nov 2022 20:53:46 GMT

Mates,

I've been tasked with a Maestro analysis based on the attached and would like to confirm my assumptions are correct.

- The MHO are in different DC and will communicate through SFP for long distance between them

- The 4 6200 are full meshed with the 2 MHO to form a security group, locally DAC and remotely SFP long distance

- The 2 MHO have a full mesh with the internal and external L3 switches to form LACP bonds

- Since everything is full mesh to the MHO, the 4 6200 can form a single security group with all capacity used

- Internal Router and External router have a lot of VLAN and each will do BGP with the MHO systems

Any remarks are welcome and regards.

Re: Maestro dual site basic topology

Chris_Atkinson — Mon, 21 Nov 2022 00:34:03 GMT

Note the MHO doesn't host the BGP sessions, the SGM with the SMO role does - likely you will need to configure graceful restart.

Per sk168814 section "7. Maestro supported and recommended deployment examples" sounds like you are describing the "Multi Room" topology? e.g.

Refer also:

sk92755: Compatibility of transceivers for Check Point appliances

Re: Maestro dual site basic topology

Danny — Mon, 21 Nov 2022 00:30:13 GMT

Your cabling doesn't seem to be correct. Please refer to this guide and my CPX presentation.

Also a dual-site active/active full-mesh topology is currently not supported.

See sk168814 and Maestro Intro & Best Practices 2022.

In order to form a full mesh active/active solution you'll need to switch to a single site (dual/multi room) topology.

Re: Maestro dual site basic topology

Alex- — Mon, 21 Nov 2022 17:49:30 GMT

Thank you both for the advice and references. I will follow-up with the requester and local SE. Actually the PDF was misleading, the cabling is indeed meant to be full-mesh but there it looks like it's running through the local MHO to reach the second site which isn't the case.

Re: Maestro dual site basic topology

Gil_Lim — Wed, 08 Oct 2025 19:07:26 GMT

Hi Danny,

Is this dual-site active/active full-mesh topology supported now ?

Thanks

Re: Maestro dual site basic topology

Chris_Atkinson — Wed, 08 Oct 2025 23:09:01 GMT

Most recent update I saw on it in the community was here:

https://community.checkpoint.com/t5/Maestro/Check-Point-integration-with-Cisco-ACI-Multi-Pod-Maestro-and/m-p/259453#M3674

Re: Maestro dual site basic topology

Danny — Fri, 10 Oct 2025 07:06:49 GMT

@Gil_Lim : It's not supported yet.