https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228321#M2886 <P>What cabling and transceivers are used, this usually points to a physical layer issue?</P> Sat, 28 Sep 2024 01:25:44 GMT Chris_Atkinson 2024-09-28T01:25:44Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227633#M2869 <P>Is there any standard documents for&nbsp;Configuring Cisco ACI/Nexus Switch Ports for Maestro R81.20 Running in VSX .</P><P>&nbsp;</P><P>For each Bond, there are total 4x10G ports ( 2 connection goes to 1st MHO &amp;&nbsp;2 connection goes to 2nd MHO) configured in&nbsp;LACP 802.3ad |Load Sharing . How ever, traffic can be seen in only in&nbsp;2 connection goes to 1st MHO.&nbsp;</P><P>&nbsp;</P><P>How does the traffic load balancing is happening . What changes we need to do both at CISCO &amp; CHECKPOINT side so that we will get 40G output.&nbsp;</P><P>Are all 4 MHO Ports acts as ACTIVE-ACTIVE ? we are using MHO140&nbsp;</P><P>&nbsp;</P> Mon, 23 Sep 2024 20:17:20 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227633#M2869 PrasannaRout 2024-09-23T20:17:20Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227652#M2870 <P>All ports in the bond are active, it is a single LACP bond with all four ports in it. The switches should be configured as such too.</P> Tue, 24 Sep 2024 01:29:24 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227652#M2870 emmap 2024-09-24T01:29:24Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227667#M2876 <P>Further to the advise from Emma setting the correct hashing for your environment may also be a factor.</P> Tue, 24 Sep 2024 06:17:29 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/227667#M2876 Chris_Atkinson 2024-09-24T06:17:29Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228305#M2884 <P>Do you have any supported documentation to Cisco Catalyst Switch Side configuration in order to support Maestro VSX.</P><P>changed hash-policy to L3,4 for all bonds. auto-negotiation enabled for BOND .</P><P><SPAN>We can see traffic in all 4 ports.&nbsp;</SPAN><STRONG>However we see FCS &amp; Receive errors in Uplink switch Ports&nbsp;</STRONG></P><P>switch#show interfaces counters errors</P><P><STRONG>Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Align-Err&nbsp;&nbsp;&nbsp;&nbsp; FCS-Err&nbsp;&nbsp;&nbsp; Xmit-Err&nbsp;&nbsp;&nbsp;&nbsp; Rcv-Err&nbsp; UnderSize&nbsp; OutDiscards</STRONG></P><P>Te1/0/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 93&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>Te1/0/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 138&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P><STRONG>Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Align-Err&nbsp;&nbsp;&nbsp;&nbsp; FCS-Err&nbsp;&nbsp;&nbsp; Xmit-Err&nbsp;&nbsp;&nbsp;&nbsp; Rcv-Err&nbsp; UnderSize&nbsp; OutDiscards</STRONG></P><P>Te2/0/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 186&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 613&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>Te2/0/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 113&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> Fri, 27 Sep 2024 20:51:27 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228305#M2884 PrasannaRout 2024-09-27T20:51:27Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228306#M2885 <P>changed hash-policy to L3,4 for all bonds. auto-negotiation enabled for BOND .</P><P><SPAN>We can see traffic in all 4 ports.&nbsp;</SPAN><STRONG>However we see FCS &amp; Receive errors in Uplink switch Ports&nbsp;</STRONG></P><P>switch#show interfaces counters errors</P><P><STRONG>Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Align-Err&nbsp;&nbsp;&nbsp;&nbsp; FCS-Err&nbsp;&nbsp;&nbsp; Xmit-Err&nbsp;&nbsp;&nbsp;&nbsp; Rcv-Err&nbsp; UnderSize&nbsp; OutDiscards</STRONG></P><P>Te1/0/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 93&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>Te1/0/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 138&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P><STRONG>Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Align-Err&nbsp;&nbsp;&nbsp;&nbsp; FCS-Err&nbsp;&nbsp;&nbsp; Xmit-Err&nbsp;&nbsp;&nbsp;&nbsp; Rcv-Err&nbsp; UnderSize&nbsp; OutDiscards</STRONG></P><P>Te2/0/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 186&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 613&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P><P>Te2/0/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 113&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> Fri, 27 Sep 2024 20:52:02 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228306#M2885 PrasannaRout 2024-09-27T20:52:02Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228321#M2886 <P>What cabling and transceivers are used, this usually points to a physical layer issue?</P> Sat, 28 Sep 2024 01:25:44 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/228321#M2886 Chris_Atkinson 2024-09-28T01:25:44Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/231433#M2927 <P>This is fixed by changing MTU setting.&nbsp;</P><P>MTU at Orchestrator Ports - 10236(Default )</P><P>MTU at SMO/Firewall Bond - 1500 ( Default)</P><P>&nbsp;</P> Thu, 31 Oct 2024 17:55:47 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/231433#M2927 PrasannaRout 2024-10-31T17:55:47Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/272306#M4034 <P>Hi&nbsp;<SPAN>PrasannaRout:<BR /></SPAN></P><P>My customer is currently reporting a similar issue. The environment is based on a VSX architecture, using MHO-175 and SG16600 appliances.</P><P>Should we adjust the MTU value on the MHO or on the Security Gateway (SG)?</P><P><SPAN>&nbsp;</SPAN></P> Tue, 03 Mar 2026 02:23:34 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/272306#M4034 Vanness_Chen 2026-03-03T02:23:34Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/272313#M4035 <P>You should always leave the MTU at the MHO level at its default setting.</P> Tue, 03 Mar 2026 03:52:57 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Configuring-Cisco-ACI-Nexus-Switch-Ports-for-Maestro-R81-20/m-p/272313#M4035 emmap 2026-03-03T03:52:57Z