topic Re: MAESTRO Dual Single Site Configuration - bonding of interface and management ip address in Hyperscale Firewall (Maestro)

MAESTRO Dual Single Site Configuration - bonding of interface and management ip address

leangf_leangf1 — Tue, 01 Jul 2025 02:44:23 GMT

Hi Checkmates.

Good day. I just wanted to clarify on the configuraiton settings of maestro (dual maestro in a single site);

-For the bonding of interfaces, Maestro-1 and Maestro-2 are already connected and can be adminitered via its management port ip (located at the back), what interfaces should be bonded;

Any sample interface assignments bonding?

Also, for the management interface ip, e.g for MNGT1- 10.10.10.10/24, can i assign same subnet to the Maestro -eth1-Mgmt1

thank you.

Leangf

Re: MAESTRO Dual Single Site Configuration - bonding of interface and management ip address

Dario_Perez — Tue, 01 Jul 2025 13:58:20 GMT

First of all, maestro is a solution composed by orchestrador and Security Gateway Modules SGM, so you have dual orchestrator, you manage each orchestrator via Mgmt1 and Mgmt2 rear panel. each orchestrator have their own ip-address it does mean orchestrator 1 IP 10.10.10.1/24 orchestrator 2 10.10.10.2/24.
Now for Security group, when you create the security Group you have add management interfaces eth1-Mgmt1 (orchestator1) and eth2-Mgmt1(ochestrator2) both should be in management bond no traffic bond. we recommend to bond them for redundancy. And yes you can use the same subnet like 10.10.10.3/24

If you have dual site, site 2 must be a mirror of site 1.

I recommend to check Jump Start videos Check Point Jump Start Course: Maestro - Check Point CheckMates

and engage check Point IGS (Professional Services) contact your local SE

Re: MAESTRO Dual Single Site Configuration - bonding of interface and management ip address

leangf_leangf1 — Tue, 01 Jul 2025 14:37:56 GMT

Hi Dario, thank you for the information. Since the SGs were connected and detected by the Orchestrator1 and 2 via their downlink ports. This have to be bonded also as recommended?

Thank you.

Leangf

Re: MAESTRO Dual Single Site Configuration - bonding of interface and management ip address

Dario_Perez — Tue, 01 Jul 2025 18:21:02 GMT

donwlink is bonded by default, don't need configure it. just cabling.

Re: MAESTRO Dual Single Site Configuration - bonding of interface and management ip address

leangf_leangf1 — Wed, 02 Jul 2025 01:58:59 GMT

Hello Dario,

Noted on this. For the revenue ports with corresponding ip addresses who will configured. eg. on orchestrator-1 (1/5/1] and on orchestrator-2 [2/5/1] needs to be bonded and assigned ip address (e.g: zone: Trust). and so on for the remaining interfaces that will participate in the network .

Thank you.