topic Maestro NAT validation error after upgrade in Hyperscale Firewall (Maestro)

Maestro NAT validation error after upgrade

Danny — Fri, 25 Sep 2026 19:21:45 GMT

After performing a supported upgrade of our Management from R81.20 → R82 (latest JHF), we are unable to create a new NAT rule. This is because the upgraded Maestro objects instantly cause a validation error as soon as we add them to the 'Install On' field:

Overview:

Location	Type	Result
NAT rule 'Install On'	`Newly created Maestro object`	No issue
NAT rule 'Install On'	`Upgraded Maestro object`	Validation error

We opened a service request (SR#: 6-0004502699) at the beginning of 2026 and escalated it several times, but the only answer we got is to delete all affected Maestro objects and to recreate them, which would cause a huge impact (SIC & topology reset and more) and put our production to a high risk and longer outages.

Did anyone experience the same or knows of a solution?

---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner @Tom_Hartig

Re: Maestro NAT validation error after upgrade

PhoneBoy — Fri, 25 Sep 2026 19:08:17 GMT

Is this a regular gateway object to represent the SMO or is this something else?
We'd likely be getting into guidbedit territory here.

Re: Maestro NAT validation error after upgrade

Danny — Fri, 25 Sep 2026 19:17:51 GMT

It's a normal Maestro SMO object. I hope the error can be fixed via GuiDBEdit.
Neither TAC nor R&D didn't look into this direction ever since we opened the SR.

Re: Maestro NAT validation error after upgrade

Lari_Luoma — Sat, 26 Sep 2026 01:37:00 GMT

I haven't seen this issue. If the object is normal SGW object, opening a TAC case (which you did) is the correct next step.