https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256125#M3598 <P>As title says, the plan is to go from a single MHO per site to two. MHO-175 in this case.</P> <P>Uplinks and downlinks will be spread between the two MHO's.</P> <P>Is it recommended to use one management port from the first MHO or connect both port and create a aggregation for management?</P> <P>We're OK to rebuild the SG if needed, but since there are 2 MHO in both sites, each with management uplink for now, there is also the question of whether it's best practice and recommended from experience.</P> Thu, 28 Aug 2025 11:49:26 GMT Alex- 2025-08-28T11:49:26Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256125#M3598 <P>As title says, the plan is to go from a single MHO per site to two. MHO-175 in this case.</P> <P>Uplinks and downlinks will be spread between the two MHO's.</P> <P>Is it recommended to use one management port from the first MHO or connect both port and create a aggregation for management?</P> <P>We're OK to rebuild the SG if needed, but since there are 2 MHO in both sites, each with management uplink for now, there is also the question of whether it's best practice and recommended from experience.</P> Thu, 28 Aug 2025 11:49:26 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256125#M3598 Alex- 2025-08-28T11:49:26Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256126#M3599 <P>When working with two MHO's per site (the recommended deployment) each port , data or management, is bonded with at least two ports from each MHO.</P> <P>This way you have full HA between them.</P> <P>Regarding the move from 1 MHO to 2 MHO's . This procedure is a bit complicated and involves a lot of manual changes in configuration files.</P> <P>I would recommend working with our Professional Services to do such a change.</P> Thu, 28 Aug 2025 11:51:39 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256126#M3599 Nir_Shamir 2025-08-28T11:51:39Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256264#M3600 <P>Thank you for the quick reply.</P> <P>We are OK with recreating the SG from scratch, as the project is on the launchpad and the current cluster still manages traffic.</P> <P>Since there are external parties in charge of the network infrastructure to which we will need to make demands, we'd like to clarify the following points to explore all options:</P> <UL> <LI>Can we work with dual uplinks/downlinks but keep only one Management port (1) on the MHO-175? Current tests show the policy installs and failovers work</LI> <LI>Can we delete the SG, create a MAGG with just one port on the first MHO, recreate the SG and in the future connect the port 1 of the second MHO which will then join the MAGG?</LI> </UL> <P>&nbsp;</P> Sun, 31 Aug 2025 17:15:58 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256264#M3600 Alex- 2025-08-31T17:15:58Z https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256342#M3604 <P>Yes and yes.&nbsp;</P> Tue, 02 Sep 2025 01:13:20 GMT https://community.checkpoint.com/t5/Hyperscale-Firewall-Maestro/Maestro-Dual-Site-From-one-to-two-orchestrator-per-site/m-p/256342#M3604 emmap 2025-09-02T01:13:20Z