topic Re: Issue adding security gateway to security group in Hyperscale Firewall (Maestro)

Issue adding security gateway to security group

gemechis — Wed, 15 Apr 2026 15:06:34 GMT

Hello All,

I am facing an issue in one of my environments. I have a Maestro environment with one Security Group containing two devices. I encountered an issue with one SGM and detached it from the Security Group.

After that, I performed a complete reset of the problematic gateway and installed Check_Point_R81.20_T634_ScalablePlatform_Upgrade.

The gateway is now shown as an unassigned device. I then attempted to add it back to the existing Security Group by enabling SMO image auto-cloning on the Security Group. However, it has been stuck in the JOINING state for almost five hours when checked from the Maestro.

At the same time, the SGM appears as DETACHED in the asg monitor output on the Security Gateway.

I am not sure what I might be missing. Could you please assist?

Re: Issue adding security gateway to security group

Vanness_Chen — Thu, 16 Apr 2026 02:18:09 GMT

Please use the show version all command to verify the OS version of the SMO.
The versions must match in order for synchronization to function properly.

Re: Issue adding security gateway to security group

emmap — Thu, 16 Apr 2026 03:37:11 GMT

On top of the versions, please also confirm the downlinks are cabled correctly - did you take the screenshot there from MHO 2?

Re: Issue adding security gateway to security group

gemechis — Thu, 16 Apr 2026 04:07:03 GMT

Do I need to install hotfix take 127 on it?

The exusting SGM has take 127 installed, But how could I install it since it doesn't have management IP?

Re: Issue adding security gateway to security group

gemechis — Thu, 16 Apr 2026 04:08:06 GMT

@emmap

The downlinks are correctly configured.

Re: Issue adding security gateway to security group

gemechis — Fri, 17 Apr 2026 06:00:24 GMT

The Jumbo Hotfix was successfully transferred and prepared through the USB flash drive, not via the management interface (SCP/WinSCP). That was the right approach since the Mgmt interface was down and had no reliable IP at the start.