topic Re: Maestro Orchestrator MHO-140 in Hyperscale Firewall (Maestro)

Maestro Orchestrator MHO-140

Simon_Macpherso — Fri, 09 Dec 2022 06:12:30 GMT

In single-site, duel MHOs, are both MHOs active?

Is SGM considered DOWN if one of its links to MHO is severed?

Re: Maestro Orchestrator MHO-140

Wolfgang — Fri, 09 Dec 2022 06:55:18 GMT

@Simon_Macpherso SGM will be not down if one of the links goes down. An SGM is connected to both MHOs. If one connection will be lost, no problem the other connected MHO will handle this path. If both links a re lost, you lost this SGM.

Re: Maestro Orchestrator MHO-140

Chris_Atkinson — Fri, 09 Dec 2022 12:43:31 GMT

Yes both MHOs are active, typically uplink connectivity is configured as bonds for redundancy.

Additionally multiple downlinks are also supported (sk158652) if you feel that level of resilience is necessary or need it for bandwidth reasons.

Re: Maestro Orchestrator MHO-140

Dario_Perez — Fri, 09 Dec 2022 14:42:38 GMT

MHO are always active in Single and/or dual Site

SGM are always active in Single and/or dual Site

What is not Active/Active is the security group, it can be active only on one site, the other side is Standby

MHO should be bond and in the bond you can configure if are A/A or A/B

You can connect a SGM to both orchestrator using dual DAC/Backplane it does mean 2 downlinks from SGM to same orchestrator for redundancy

MHO for Security Group works as a bond, then if you lost 1 MHO. for Security Group is link lost 1 interface of the bond, but remain as Active on that side

Re: Maestro Orchestrator MHO-140

Lari_Luoma — Thu, 22 Dec 2022 02:43:49 GMT

Actually an SGM needs to have downlinks active to both orchestrators all the time. If you unplug only one downlink, the gateway will go down. This is by design. To overcome this, we recommend of having dual downlinks between each SGM and MHO. If the entire MHO reboots, the second one takes over and there are no problems.