topic Determine which MHO is handling particular connection in Hyperscale Firewall (Maestro)

Determine which MHO is handling particular connection

andrej_kascak3 — Fri, 25 Sep 2026 10:59:20 GMT

Hi guys,

We have 2 MHOs 140 on site and would like to ask if there is a way to find out which MHO orchestrator is handling particular traffic flow.

Reason I ask is, that during the testing, we observed connected Nexus N9K switches have different path for same flow - one is pointing to MHO1 and second one is pointing to MHO2 attached are details.

I'm able to demine which SGM module is handling the flow, but not sure if there is way to check for MHOs, maybe something similar to Cisco commands?

Our setup:

- 2 MHO 140 connected to 2 N9K switches in VPC, using 2 ports each (4 ports in total), all in one Bond (bond11) on Checkpoint side, and in one PortChannel (Po106), VPC on Cisco side.

-> Sw1 - Port 1/37 - MHO1 5, Port 1/38 - MHO2 5

-> Sw2 - Port 1/37 - MHO1 6, Port 1/38 - MHO2 6

Re: Determine which MHO is handling particular connection

Chris_Atkinson — Fri, 25 Sep 2026 12:50:22 GMT

Which MHO receives the traffic would be determined by your Nexus hashing algorithm.

Is it Layer 2 or Layer-3+4 etc?

Re: Determine which MHO is handling particular connection

Timothy_Hall — Sat, 26 Sep 2026 14:28:25 GMT

To my knowledge, the Orchestrators don't maintain a connection state table, which would be the logical place to look for this information. However if a specific connection was set up for FastForward, the FastForward rule would show hit counts that you can view with tor_util fastforward show rules on both orchestrators to infer which one is handling that connection. The only other option I can think of is to run a live tcpdump on both Orchestrators to see which one is handling the connection.