topic Re: Gateway doesn't show up on MHO GaiaPortal in Hyperscale Firewall (Maestro)

Gateway doesn't show up on MHO GaiaPortal

kamilazat — Thu, 21 Nov 2024 09:19:43 GMT

Hello all.

We are trying to add a new gateway to an existing Maestro environment. Currently each security group has 3 gateways with licenses and work perfectly fine, but when trying to add a new gateway doesn't work.

- We installed R81.20SP

- lldpctl on MHO shows the device, but it doesn't show up in the Unassigned Gateways section.

- We already checked the cables and other functionality.

- auto-clone is enabled on the SMO Master.

We are trying to add new gateways to both security groups and the same issue appears for both sides. No error messages in /var/log/messages on MHO.

Where else shuld we look?

Cheers!

Re: Gateway doesn't show up on MHO GaiaPortal

Daniel_Szydelko — Thu, 21 Nov 2024 10:29:20 GMT

Hello,

At this stage you need to be sure that:

- new SGM has properly installed correct SP software version

- downlinks are connected according to sk158652

- particular ports on MHO's are configured as downlink (orch_stat -p -v)

Daniel.

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Thu, 21 Nov 2024 12:59:50 GMT

@Daniel_Szydelko Thank you for the suggestions.

We have double checked that R81.20SP installed on the GW. I am attaching a screenshot of orch_stat -p -v.

The same steps were followed on a different maestro environment with the same MHO model, same ISO and same model (16600) and it worked there.

Additionally, we found sk173410 that talks about exactly the same situation, except web ssl-port is not touched.

Maybe we should open a TAC ticket, what do you think?

Edit: Noticed that I uploaded the wrong image. Corrected.

Re: Gateway doesn't show up on MHO GaiaPortal

emmap — Fri, 22 Nov 2024 02:28:25 GMT

What DAC/QSFPs/cables are used for the downlink? If you do a 'show maestro port x/x/x optic-info' for the downlink port what do you get?

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Fri, 22 Nov 2024 06:58:49 GMT

@emmap Here's the output:

mho> show maestro port 1/23/1 optic-info

Physical Port: 1/23/1

Vendor Name: PROLABS

Serial Number: CPT186AC2608A

Part Number: NA

Check Point Part Number: 1368NIY4463

Enforcement: Supported

Check Point SKU: CPAC-DAC-100G-3M-B

Material ID: 321296

Product Type: 100GBASE-CR4-3M

Speed: 100G

Re: Gateway doesn't show up on MHO GaiaPortal

emmap — Fri, 22 Nov 2024 07:35:42 GMT

OK so that's detected properly, that's good. The MHO is reporting that the link is physically down, can you see if the SGM on the other end is showing the same? Do you have out of band access to it?

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Fri, 22 Nov 2024 08:07:36 GMT

We can take outputs from the SGM, yes. Would ethtool be enough or some other information needed?

Edit: I'm thinking about running the script mentioned here.

Re: Gateway doesn't show up on MHO GaiaPortal

AkosBakos — Fri, 22 Nov 2024 09:29:47 GMT

Hi,

Did you install any kind of jumbo onto the pure R81.20 SP? Or did you plan after the enrollment?

For sure, make an FCD, and start the process again.

Did you use Check_Point_R81.20_T634_ScalablePlatform.iso ?

Do you have an another 100G DAC cable? Only for a test, to be 100% sure, not the cable wrong.

Akos

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Fri, 22 Nov 2024 12:57:58 GMT

@emmap I'm attaching the output of the script mentioned here.

What do you think, is the "Invalid numeric literal at line 2, column 0 related to the one-liner or the line card?

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Fri, 22 Nov 2024 12:59:29 GMT

No JHF was installed onto the pure image. We did fcd couple of times, triple checked that that is the correct .iso, and tried other cables.

Re: Gateway doesn't show up on MHO GaiaPortal

AkosBakos — Fri, 22 Nov 2024 13:04:25 GMT

I wish the best 🙂

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Fri, 22 Nov 2024 14:04:45 GMT

That's relieving :)))

Re: Gateway doesn't show up on MHO GaiaPortal

Daniel_Szydelko — Fri, 22 Nov 2024 14:26:14 GMT

Hello,

If it's possible then create new SR and ask for remote session with maestro TAC engineer. It will be faster way to resolve it.

You can also go through some log files on MHO (/var/log/messages, /var/log/smartd.log) to see if something valuable can be found regarding this situation.

It's strange that we have link state DOWN. You can try to check from similar SGM with ethtool how it looks like from this side.

Daniel.

Re: Gateway doesn't show up on MHO GaiaPortal

emmap — Mon, 25 Nov 2024 02:03:34 GMT

Not sure, but it seems like it's detecting the cable. Have you tried a different downlink port on the MHO?

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Mon, 25 Nov 2024 09:50:16 GMT

Hi again everyone.

I wanted to update the post. TAC decided that RMA will be the best solution.

Thank you all for your time!

Cheers!

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Wed, 27 Nov 2024 08:50:19 GMT

Yes, we tried that as well. Currently, it looks like the correct ISO is installed and the cable looks functioning. We have taken a cpinfo from the gateway but didn't see any apparent errors in it. The only repeating error message is this on MHO:

error: smo_rest_api_request_url: smo_rest_api_request_with_url: ERROR! Failed to Handle request. smo_rest_api_type = -1

But web ssl-port is 443 already, so sk171592 does not really help.

Where else can we look, any ideas?

Re: Gateway doesn't show up on MHO GaiaPortal

AkosBakos — Wed, 27 Nov 2024 08:57:24 GMT

Hi,

The RMA has been arrived?

Akos

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Wed, 27 Nov 2024 09:22:47 GMT

The RMA is in progress. It was for an appliance where we didn't have console access. But the problem remains for another Maestro deployment as well. I posted to troubleshoot multiple similar issues. We have this gateway where we have access to console, but still doesn't show up.

Re: Gateway doesn't show up on MHO GaiaPortal

emmap — Wed, 27 Nov 2024 09:48:44 GMT

What does 'ethtool [ifname] from the SGM say? I think the ifname is ethsBP1-01 but double check with 'ifconfig'.

We're still talking about a 16600HS SGM, yes?

Re: Gateway doesn't show up on MHO GaiaPortal

kamilazat — Wed, 27 Nov 2024 10:13:13 GMT

Yes, the model is the same, 16600HS.

I attached the ethtool info from both BP interfaces (two of them appear).