topic Re: Change ElasticXL/Maestro Sync Network? in Hyperscale Firewall (Maestro)

Change ElasticXL/Maestro Sync Network?

Bob_Zimmerman — Tue, 28 Jan 2025 15:38:21 GMT

Maestro and ElasticXL use, on their sync networks, a block of IPs reserved for documentation in RFC5737 (192.0.2.0/24, TEST-NET-1). RFC 6890 specifies that addresses in this block may not be used as the source or destination addresses of an IP datagram that transits two devices. To make our environment comply with the IP specifications, we obviously will need to change the sync network to use proper addresses.

I know I saw a process to change this, but my search-fu has failed me. Does anybody have that process handy?

Re: Change ElasticXL/Maestro Sync Network?

Lloyd_Braun — Tue, 28 Jan 2025 16:15:06 GMT

I'm seeing references to changing 198.51.10x.0/24, but not that TEST-NET-1 addressing.

Internal IP Addresses

sk179028 - Connectivity issues in Security Group X with hosts in the network of 198.51.10x.0 / 24

Re: Change ElasticXL/Maestro Sync Network?

Bob_Zimmerman — Tue, 28 Jan 2025 19:02:28 GMT

Wow. Pretty sure that's the process I was thinking of, but the situation is so much worse than I remembered. My goodness. 198.51.10X for X!=0 is public! People own those addresses!

Re: Change ElasticXL/Maestro Sync Network?

emmap — Wed, 29 Jan 2025 04:54:26 GMT

There is no supported process to change the sync addressing anymore as far as I know. Pretty sure the old chassis setup procedure gave you that option but no longer.