topic Re: Network settings on Security Group members in Maestro in Hyperscale Firewall (Maestro)

Network settings on Security Group members in Maestro

Oliver_222 — Tue, 28 May 2024 13:46:54 GMT

Good afternoon!
Could you please tell me how to configure network settings on Security Group members in Maestro?
It is not planned to create VSX in Security Group.

I am interested in interfaces, ARP proxies, routes, policy based routing and route redistribution in OSPF.

I understand correctly that on Security group you can't configure all this in Gaia Portal and will have to do it in CLI? Or am I wrong?
I would be grateful if there are any links to articles or documentation as I have not been able to find any information on this issue.

Thanks in advance

Re: Network settings on Security Group members in Maestro

Lesley — Tue, 28 May 2024 18:22:33 GMT

Most changes you do with gclish (global clish).

In this way you change all the relevant gateways.

More info here:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/Topics-Maestro-AG/Global-Commands.htm?tocpath=Managing%20Security%20Groups%7CGlobal%20Commands%7C_____0#Global_Commands

Also check: Gaia OS (Global Shell / Commands) in SK: https://support.checkpoint.com/results/sk/sk148074

Here are the 'specials' listed regarding Maestro and the GAIA OS

Re: Network settings on Security Group members in Maestro

emmap — Tue, 28 May 2024 21:52:05 GMT

You can do it in portal but we generally recommend doing it in gclish as you will get feedback from each SGM that the configuration has been accepted and implemented. If you do it in portal you won't know if it's not been taken by one of the SGMs and you will have uneven configuration.

One way around this is to do all this configuration before adding more SGMs to the security group. Set up the group with one SGM, do all the config and SIC and policy install, then once it's all working on one SGM, add the others in.