topic Re: Downlink failure behavior in Hyperscale Firewall (Maestro)

Downlink failure behavior

Srdjan_B — Fri, 12 Jul 2024 12:10:22 GMT

Hello,

There is single site, dual MHO deployment, where each SGM is connected with one cable to each MHO. What is expected behavior in case one downlink cable or port fails? Is it expected that SGM goes down (as if interface is down), or detached/lost, or it will continue working (as if just one bond member is down)?

Thanks

Re: Downlink failure behavior

Dario_Perez — Fri, 12 Jul 2024 13:26:35 GMT

If SGM 1 have DAC 1 up, DAC 2 up then SGM1 is up

if SGM 2 have DAC 1 up, DAC 2 down, then SGM is down

if SGM1 and SGM2 lost same DAC, let say MHO1, then both SGM state as up.

Re: Downlink failure behavior

Srdjan_B — Fri, 12 Jul 2024 13:33:45 GMT

Thank you, that sounds logical. If SGM 2 have DAC 1 up, DAC 2 down, then MHO2 has no means of sending traffic to SGM2, since it has no link to SGM2 and cannot use MHO Sync to send data traffic.

Just wanted confirmation to share with customer.

Thank you

Re: Downlink failure behavior

the_rock — Fri, 12 Jul 2024 13:58:22 GMT

I dont know much about maestro, but its super interesting concept, so always trying to learn as much as I can. I built elastic xl gateway in the R82 lab, so bunch of commands can be tested there. I remember few years ago when Lari Luoma from PS team did huge engagement for maestro for one of our customers, client was so impressed with his knowledge and understanding of it. I always refer to documents he gave us. I cant sadly share them here, as its restricted content, but great learning reference.

Have a nice weekend!

Andy

Re: Downlink failure behavior

emmap — Tue, 16 Jul 2024 05:16:18 GMT

We have recently published an SK explaining this scenario, it may help with your customer. But yes you have it right.

https://support.checkpoint.com/results/sk/sk182458