topic Re: cann't enable Maestro FastForward in Hyperscale Firewall (Maestro)

cann't enable Maestro FastForward

Wolfgang — Mon, 22 Dec 2025 07:29:55 GMT

We try to use Maestro FastForward. Setting the rule-prefix and enabling in virtual system was successfull.

Rule is created with the correct prefix and with correct objects, but policy install fails with

#####################################

Gateway: FWX

Policy: XXXXXXXXXX

Status: Failed

- Maestro acceleration (MXL) failed, reason: Policy Parser error due to policy routing validations. Please check /var/log/acl_cli.log on the security group SMO for more details.

#####################################

/var/log/acl_cli.log repeatly shows the following error:

2025-12-18 09:29:01,535 ERROR 54: main(): exception called:
2025-12-18 09:29:01,536 ERROR 55: main(): Traceback (most recent call last):
File "/usr/scripts/acl_cli/acl_cli", line 46, in main
rc = args.func(args)
File "/usr/scripts/acl_cli/package/utils/mxl_decorators.py", line 93, in _set_logging_level_wrapper
return function(self, *args)
File "/usr/scripts/acl_cli/package/utils/conf_file/conf_file.py", line 29, in _wrapper
return function(self,*args)
File "/usr/scripts/acl_cli/package/utils/mxl_decorators.py", line 22, in prepare_conf_wrapper
return function(self, *args)
File "/usr/scripts/acl_cli/package/utils/mxl_decorators.py", line 36, in _get_conf_wrapper
return function(self, *args)
File "/usr/scripts/acl_cli/package/utils/sgm_state.py", line 25, in _wrapper
return function(self,*args)
File "/usr/scripts/acl_cli/package/utils/mxl_decorators.py", line 106, in prepare_sgm_state_wrapper
return function(self, *args)
File "/usr/scripts/acl_cli/package/utils/mxl_decorators.py", line 120, in _get_sgm_state_wrapper
return function(self, *args)
File "/usr/scripts/acl_cli/package/features/policy_enforcement.py", line 997, in activation
latest_operation = app.getActivationOp(vsid)
File "/usr/scripts/acl_cli/package/features/fastforward/fastforward.py", line 87, in getActivationOp
return self._conf_file.getFastforwardActivation(vsid)
File "/usr/scripts/acl_cli/package/utils/conf_file/mxl_conf_file.py", line 36, in _wrapper
return function(self ,vsid ,*args)
File "/usr/scripts/acl_cli/package/features/fastforward/fastforward_conf.py", line 130, in getFastforwardActivation
return self._state_dict[vsid][FastforwardConf.FASTFORWARD_FEATURE_NAME][FastforwardConf._ACTIVATION_OPERATION]
KeyError: 'FASTFORWARD'

TAC case is open but maybe someone knows the problem?

Re: cann't enable Maestro FastForward

Gennady — Mon, 22 Dec 2025 11:16:13 GMT

Good day!

Please, check that the rule doesn't contain any IP-addresses/networks which are directly connected to the Security Group?

FastForward doesn't support traffic acceleration between directly connected networks.

You can check your routing topology on MHO at /etc/orch_fastforward_routing_data
There may be many files for each iteration of routing topology calculation. It is better to check the lates one generated.

Re: cann't enable Maestro FastForward

Wolfgang — Mon, 22 Dec 2025 20:47:36 GMT

We followed the guidelines for FastForward. Involved networks are not directly attached to the gateway.
/etc/orch_fastforward_routing_data does not exist, I believe it‘s only available if policy install was successfully and the matching rules are pushed to the MHOs.

Re: cann't enable Maestro FastForward

Gennady — Tue, 23 Dec 2025 07:23:57 GMT

Good day!

The error in the acl_cli.log sure looks strange. KeyError: 'FASTFORWARD' refers to a wrong key name in python dictionary structure. The catch is that the Key name is a constant in the script! It should not be at fault because it is defined unconditionally.

self._state_dict[vsid][FastforwardConf.FASTFORWARD_FEATURE_NAME][FastforwardConf._ACTIVATION_OPERATION]
KeyError: 'FASTFORWARD'

turns to

self._state_dict[vsid][FastforwardConf.FASTFORWARD][FastforwardConf._ACTIVATION_OPERATION]

and that returnes a KeyError.

It may be a limitation for VSX or a general bug in the activation process. The thing is that we have tested FastForward in a Lab not so long ago on R81.20 JHF take 118 (Maestro Dual-Site non VSX) and hadn't seen such issues.

Re: cann't enable Maestro FastForward

Gennady — Fri, 26 Dec 2025 07:58:13 GMT

Good day!

Any chance Checkpoint TAC has sorted this problem out? It would be great to know what the problem was.