topic Maetro Hyperscale security group unassign interfaces in Hyperscale Firewall (Maestro)

Maetro Hyperscale security group unassign interfaces

Ali426 — Wed, 21 Dec 2022 11:36:35 GMT

Hi Folks!

New to Maestro concept, i was just going through some documents and videos. there was unassign interfaces column under security group, this unassign interfaces are from orchestrator or gateway ? Hope to get clarification

Cheers!

Re: Maetro Hyperscale security group unassign interfaces

PhoneBoy — Wed, 21 Dec 2022 13:35:08 GMT

This is done at the Orchestrator level, not the device/gateway level.

Re: Maetro Hyperscale security group unassign interfaces

Lari_Luoma — Thu, 22 Dec 2022 02:39:07 GMT

All interfaces in Maestro (except the downlinks) are housed on the orchestrators. When you create a security group, you assign gateways and interfaces into it (in orchestrator WebUI). The interfaces not assigned to any security group are "unassigned". You should only assign interfaces to each security group that you will need.

Re: Maetro Hyperscale security group unassign interfaces

Ali426 — Thu, 22 Dec 2022 03:17:30 GMT

Appreciate the response! my question was

1. Unassign interfaces - are this physical interfaces of gateways or are this physical interfaces of orchestrator itself ?

2. In the attach diagram - LAN connections from core switches and wan connections from internet are connected to orchestrator only, dont we have to connect lan and wan connections to gateways ?

3. Basically i am trying to understand real time best practise traffic flow

Re: Maetro Hyperscale security group unassign interfaces

_Val_ — Thu, 22 Dec 2022 08:06:03 GMT

@Ali426 It is best to actually consult the documentation.

Your questions were answered twice already here.

An orchestrator is connected to the GWs with uplinks and downlinks only. All production interfaces are connected to the orchestrator.

Re: Maetro Hyperscale security group unassign interfaces

Ali426 — Thu, 22 Dec 2022 08:20:29 GMT

@_Val_ thanks for the response! so as per my understanding

1. Traffic from source network comes to orchestrator

2. then orchestrator send the traffic to respective gateway of that security group

3. Gateway will process this traffic and send back to orchestrator over the downlink

4. Orchestrator then send this traffic to destination

Summary:

1.Gateways will just receive traffic from orchestrator, process the traffic and send back to orchestrator

2. Gateways will never have Internal or External connection connected to them physically

Re: Maetro Hyperscale security group unassign interfaces

_Val_ — Thu, 22 Dec 2022 11:06:53 GMT

Correct. MHO is a load balancer, as part of other operations. It breaks your traffic into flows, which are sent to GWs for processing via downlinks and returned filtered (policy applied and enforced) via uplinks. A Security Group with multiple physical appliances is acting as a single logical security GW.

Look into documentation and look up in the community, there are tons of info:

For example,

Maestro Jump Start Video Course: https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/Check-Point-Jump-Start-Course-Maestro/ba-p/153352?cat=10
Maestro Intoriductory session by @Lari_Luoma: https://community.checkpoint.com/t5/Maestro/Introduction-to-Maestro-EMEA-session/m-p/156237