topic Re: enable ipv6 on Maestro in Hyperscale Firewall (Maestro)

enable ipv6 on Maestro

Wolfgang — Mon, 05 Sep 2022 09:25:16 GMT

How to enable ipv6 on Maestro ?

In gclish "set ipv6-state on" save and reboot. Is it possible todo the reboot one by one appliance in the security group or must be done a reboot on the whole security group ?

Doing it with only one appliance at the time cause no traffic disruption.

Re: enable ipv6 on Maestro

_Val_ — Mon, 05 Sep 2022 10:05:38 GMT

Not sure it was tested, but you can reboot one-by-one by reboot -b command. Please note, you have to start your reboots from SMO. So, SMO should be first.

I suggest to test it before going live. Enabling IPv6 will change CoreXL instances on the appliance

Re: enable ipv6 on Maestro

Lari_Luoma — Tue, 06 Sep 2022 05:02:25 GMT

I agree with Val. I think you can enable it one by one, but better to verify first that everything works as planned.

Re: enable ipv6 on Maestro

Wolfgang — Thu, 13 Oct 2022 07:30:36 GMT

Yesterday we tried to enable IPv6 with no success. After enabling IPv6 via gclish => "set ipv6-state on" we did a restart with one of the appliances but these ends up in boot loop:

Oct 12 16:24:26 2022 Firewall-XXX-ch01-02 kernel: [fw4_0];Global param: operation failed: Unknown parameter (param name fwha_mbs_reboot_notify),

Oct 12 16:24:28 2022 Firewall-XXX-ch01-02 shutdown[77256]: shutting down for system reboot

We did not had any time for troubleshooting, switch to IPv6 off and everything was fine. At the moment we are investigating the logs. Has anyone enabled IPv6 in a Maestro environment ?

Re: enable ipv6 on Maestro

Wolfgang — Mon, 24 Oct 2022 08:59:47 GMT

@Lari_Luoma and @_Val_ and the community,

After enabling IPv6, reboot one security group member followed by a crash of the whole Maestro environment and a following discussion with TAC...

Following Gaia R81.10 Administration Guide (System Configuration) (After you enable or disable IPv6 on a Security Group in a Scalable Platform, you must reboot all the Security Group Members at the same time) we had to reboot the whole SecurityGroup to enable IPv6.

This indicates a complete downtime for the Maestro environment, meaning approximately 30min with no traffic flow. Very bad behaviour for a highly available scalable environment. We and our customer are not happy with that solution.

Yes, we could enable IPv6 before deployment, but we don't want to enable features from the beginning we don't need.

Re: enable ipv6 on Maestro

_Val_ — Mon, 24 Oct 2022 09:13:40 GMT

I am sorry to hear that. Could you please provide me your TAC case via PM?

Re: enable ipv6 on Maestro

Machine_Head — Fri, 03 Mar 2023 14:27:10 GMT

Hey, any idea if this is fixed or still the case?

Thanks
Juan

Re: enable ipv6 on Maestro

Wolfgang — Fri, 03 Mar 2023 14:33:36 GMT

@Machine_Head ther's still a need for a reboot of all appliances of the complete Maestro solution. And additional there are still limitations if you want to change something regarding the IPv6 configuration. See my post https://community.checkpoint.com/t5/Maestro/IPv6-on-Maestro-a-nightmare/m-p/169862#M1414

Re: enable ipv6 on Maestro

Machine_Head — Fri, 03 Mar 2023 14:42:57 GMT

Sounds like a non-goer for me

Thanks for the info