topic Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex in Hyperscale Firewall (Maestro)

Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Expert

Anatoly — Tue, 13 Jul 2021 09:03:14 GMT

Interview with Check Point’s security platforms expert.

Take a look at the new Maestro Hyperscale Orchestrator Automated and scalable data center operations with Maestro - world’s #1 Hyperscale security solution, presented my Michael Greenberg and myself.

Maestro combines the performance of 52 gateways on demand delivering up to 1.5 Tbps of threat prevention performance.

Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Expert

Ricki_Juntak — Tue, 22 Aug 2023 06:06:51 GMT

Hi Anatoly,

can you share to me, how can I make sure some traffic processing by SGM1 or SGM2.

for example we have 2 SGM's in one Security Group, the distribute traffic to SGM's is used one active SGM to inspect traffic and another one is for backup right?

and how flow log can go to SMS cause the only one member will be SMO (this is SGM1) but traffic inspect by SGM2, any delay for log send to SMS?

Regards,

Ricki

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

Wolfgang — Tue, 22 Aug 2023 06:27:35 GMT

@Ricki_Juntak Maestro does not work like ClusterXL. All SGMs are active and proccesing traffic. Have a look at this nice presentation to understand how it works.

Maestro Under The Hood with Lari Luoma

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

Ricki_Juntak — Tue, 22 Aug 2023 07:04:25 GMT

Hi Wolfgang, I mean like on this table below:

SGM1	SGM2	SGM3
Active 1.1.1.1:234->2.2.2.1:80	Backup 1.1.1.1:234->2.2.2.1:80
Backup 1.1.1.10:2211->2.2.2.20:22		Active 1.1.1.10:2211->2.2.2.20:22

the Hypersync, so how we know the traffic inspect active by SGM1 or SGM2 or SGM3

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

delToro1 — Tue, 22 Aug 2023 07:19:27 GMT

Hi @Ricki_Juntak , if you use g_tcpdump , you can check what SGM into the SG is processing the traffic.

Regards!

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

Wolfgang — Tue, 22 Aug 2023 07:46:55 GMT

additional to @Ricki_Juntak comment you can see in the logs which SGM is proccessing the traffic.

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

Sven_Glock — Tue, 22 Aug 2023 19:25:28 GMT

Additionally a nice tool to understand which packet arrives on with sgm is dxl calc:

dxl calc
Usage: dxl calc <src ip> <dst ip> <Distribution Mode/Interface Name>

Distribution Mode:
0 - General, a source and destination IP based distribution.
1 - User, a destination IP based distribution.
2 - Network, a source IP based distribution.

[Expert@maestro-ch01-01:0]# dxl calc 1.1.1.1 2.2.2.2 2
<1.1.1.1,2.2.2.2,src_based,181>
Chassis 1: Blade(s):1_05,1_07

Re: Automated and scalable data center operations with Maestro -Interview with Scalable Platforms Ex

Ricki_Juntak — Wed, 23 Aug 2023 02:56:31 GMT

Thank you Wolfgang, delToro1, Sven_Glock

another my question is about any delay send log from SGM active (inspect the traffic) to the SMS?

in my experience filter log from SMS (log monitor) log not show from some traffic (need more time to see log on SMS), there is cause traffic not inspect by the SMO?