topic Re: Maestro R81.10 - Interface Distribution Issue in Hyperscale Firewall (Maestro)

Traffice passing through one SGM not second SGM under Maestro Setup

Satya2021 — Mon, 24 Apr 2023 06:09:56 GMT

We have implemented Maestro Setup with R81.10 jhf take 94 and put in production and checked that everything was working fine and after 4 hours we have rebooted both SGM (Module 6600) after came Active/Active internet was very slow as not able to browser properly after troubleshooting i found that I get cpstop or clusterXL_admin -b 1_01 down then internet is working properly as expected.

it means internet and all application are working excellent with one SGM if both SGM comes Actove/Active then everything slow.

please provide any solution

Re: Traffice passing through one SGM not second SGM under Maestro Setup

Yair_Shahar — Mon, 24 Apr 2023 06:38:37 GMT

Hi,

Do you see any drops?

Do you have high traffic volume?

Do you have NAT?

Traffic Distribution is set by policy (default config)?

Yair

Re: Traffice passing through one SGM not second SGM under Maestro Setup

Satya2021 — Mon, 24 Apr 2023 06:51:25 GMT

Hi Yair,

No high traffic volume...very less traffic

Only Hide behind NAT using to go on internet

[Global] HO-GW-ch01-02> show distribution interface bond2 configuration
1_01:
Member 192.0.2.1 is down. See "/var/log/messages".

1_02:
policy-external

[Global] HO-GW-ch01-02>

Re: Maestro R81.10 - Interface Distribution Issue

Satya2021 — Mon, 24 Apr 2023 07:08:28 GMT

[Global] HO-GW-ch01-02> show distribution status
distribution:
l4_mode: 'on'
mode: per-port
matrix:
actual_size: '512'
ports:
eth1-06: policy-external
eth1-07: policy-external
eth2-06: policy-external
eth2-07: policy-external

Re: Maestro R81.10 - Interface Distribution Issue

Chris_Atkinson — Mon, 24 Apr 2023 09:51:14 GMT

Have you tested without L4 distribution?

https://community.checkpoint.com/t5/Maestro/Layer-4-Distribution-Yes-or-No/m-p/154974

Re: Maestro R81.10 - Interface Distribution Issue

Yair_Shahar — Mon, 24 Apr 2023 09:51:16 GMT

No internal interfaces set in topology?

Re: Maestro R81.10 - Interface Distribution Issue

Satya2021 — Mon, 24 Apr 2023 10:01:59 GMT

No internal interfaces set in topology because we have only three interfaces( 2 ISP(External), one Management) interface) and it took automatically external distribution

[Global] HO-GW-ch01-02> show distribution l4-mode
1_01:
Member 192.0.2.1 is down. See "/var/log/messages".

1_02:
L4 Distribution: Enabled

[Global] HO-GW-ch01-02> show distribution interface bond2 configuration
1_01:
Member 192.0.2.1 is down. See "/var/log/messages".

1_02:
policy-external

[Global] HO-GW-ch01-02> show distribution configuration
Distribution Mode: auto-topology (per-port)

Re: Maestro R81.10 - Interface Distribution Issue

Yair_Shahar — Thu, 17 Aug 2023 13:55:11 GMT

Was this one resolved?

Re: Maestro R81.10 - Interface Distribution Issue

Satya2021 — Thu, 17 Aug 2023 16:00:55 GMT

Yes, issue was resolved.

We have created 3 interface Magg1(User are sitting- for going internet), bond2(ISP-External) and Bond3(ISP-External)

now if user sitting on Magg interface on Maestro then Internet traffic will not distribute between both SGM and if we want to forward data traffic on Magg1so we have to follow below sk179005

g_fw -a ctl set int fwha_data_mgmt_connection 1

Re: Traffice passing through one SGM not second SGM under Maestro Setup

KeonNg — Thu, 31 Jul 2025 08:07:07 GMT

Hi Guys,

We are facing the similar issue which we have total 4 SGM in the security group, whenever we bring up over 3 chassis and above become ACTIVE, users experienced slowness and inconsistence to the Internet Traffic, some certain website domain is loading slowly or not even able to browse and ping, nslookup not able to get the result as well. However when there's only 2 chassis is ACTIVE in the security group no matter which SGM then everything is running good. We had disabled the L4 mode but still the same.

Any advice ?

Best Regards,

Keon