Maestro Host Access - Best Practice

Danny — Thu, 13 Nov 2025 09:31:28 GMT

Maestro operates with predefined Internal IP Addresses.

In order to allow connections between SGMs and MHOs, like the member command, it's required to add these IPs to the Gaia Host Access list, in addition to monitoring probes and your Firewall Management DMZ that manages your Check Point security infrastructure.

A typical Gaia Host Access list on Maestro security groups would look like this:

Type	IP / Netmask	Description
Host	`127.0.0.1`	Localhost
Network	`192.0.2.0 /24`	Maestro Internal Sync Network
Network	`198.51.101.0 /24`	CIN (~~Chassis~~ Maestro Internal Network)
Network	`203.0.113.0 /24`	Maestro Inter-Site Sync Network

Depending on the number of security groups, there could also be additional Maestro CIN networks, such as:
198.51.102.0 / 24, 198.51.103.0 / 24 and so on, as described here.

Note: Check Point may hide some of these networks in Gaia WebUI, verify them in GClish via: show configuration allowed-client

Let's discuss how the Gaia Host Access list should be configured on Maestro HyperScale Orchestrators (MHO).

---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner

topic Maestro Host Access - Best Practice in Hyperscale Firewall (Maestro)

Maestro Host Access - Best Practice