topic Re: maestro shared uplinks in Hyperscale Firewall (Maestro)

maestro shared uplinks

amoruck — Mon, 11 Sep 2023 22:06:52 GMT

Hello,

I have maestro security group (R81.10, one site, dual MHO) with shared uplink ports feature disabled; It is using two 4-port LACP bonds. Now I learned about shared uplinks and of course would like my uplinks to be shared - can I somehow convert existing interface configuration to shared one without breaking everything and starting from scratch?

Re: maestro shared uplinks

Dario_Perez — Mon, 11 Sep 2023 22:57:29 GMT

Check https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/Topics-Maestro-AG/Shared-Uplink-Ports.htm

Re: maestro shared uplinks

amoruck — Tue, 12 Sep 2023 07:18:02 GMT

I can't see my scenario there... There is very detailed description what to do if someone is just to create new bond interfaces and security groups, but what if I have my security group already operational and I only want to enable shared links?

Re: maestro shared uplinks

Dario_Perez — Tue, 12 Sep 2023 07:27:21 GMT

is basically the same

Re: maestro shared uplinks

amoruck — Tue, 12 Sep 2023 07:40:02 GMT

Not exactly, the difference is I already have my interfaces configured; Do I have to delete all my interfaces and virtual systems and create them again to enable this feature? it's kind of a nuisance to do in production environment

Re: maestro shared uplinks

Dario_Perez — Tue, 12 Sep 2023 15:38:44 GMT

the best practice is to have a bond, so you can add a new interface, remove the old, apply share to old and get it back.

But you can change the share to true on assigned interface,

As always create snapshot, export it and ask for maintenance window

Re: maestro shared uplinks

Wolfgang — Tue, 12 Sep 2023 18:42:40 GMT

Most problematic task will be result in an outage of the SG.

e. Reboot all Security Group Members in the Security Group:

reboot -b all

Re: maestro shared uplinks

amoruck — Tue, 12 Sep 2023 19:09:53 GMT

Yes, it is very unfortunate if there is no workaround for this.

Re: maestro shared uplinks

amoruck — Mon, 16 Oct 2023 20:32:31 GMT

I have tried this in lab (one mho-140 and two SGs, with R81.10 and old T79 jumbo, and it seems that you dont need to reboot all gateways at once. I have started with one SG with non-shared uplinks (two physical ports, bundled in LACP bond), than set shared-uplinks to enabled for this SG, (still alive!), rebooted one of two gateways, than the second, and everything worked fine, without any traffic interruption/link flap. Second SG was than able to use the same uplinks without any problem.

Of course, it was just my lab - your mileage may vary ; -). But it would be nice if Check Point remembered about the poor admins when writing docs, not like "reboot -b all, what's the problem, do you use our hardware for any serious purpose?"

Re: maestro shared uplinks

Zolo — Wed, 31 Jan 2024 18:22:32 GMT

Hi Wolfgang,

Could you share where you found this?

Because the Admin Guide does not include such a task.

Thanks in advance.

Re: maestro shared uplinks

Wolfgang — Fri, 02 Feb 2024 07:18:42 GMT

@Zolo information for shared uplinks was updated December 2023. Sounds like these limitation not more exist.

Re: maestro shared uplinks

Zolo — Sun, 04 Feb 2024 09:10:53 GMT

Thank you.