Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST

Garbo — Fri, 13 Aug 2021 13:57:01 GMT

Hello CheckMates,

We have a Maestro Dual Site / Dual Orchestrator (2 MHOs - 2 MHOs) new deployment with R80.20SP (MHO) and R80.30SP (SGM) software versions. Only 1 SG is configured and installed as VSX/VSLS.
Site1 looks fine, Chassis 1 ACTIVE and SGMs are both ACTIVE as well, but Site2 Chassis 2 DOWN and SGMs are both LOST 😞
The only one SG consists of the Site1 SGMs currently, but Site2 SGMs are not in the group and not even FTW ran on them. Cabling and port types and amounts and IDs and ssm_sync and site_sync and magg are okay in my opinion.

As a reference sk168092 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168092&partition=Basic&product=Quantum
Scenario #2 is the relevant deployment.

At the bottom of the website:
Testing Dual-Site infrastructure
Connectivity between Orchestrators at different sites:

From MHO1_1 ping MHO 2_1: ping 203.0.113.15
From MHO1_2 ping MHO 2_2: ping 203.0.113.16
If there is no ping, check VLANs 3951 and 3952 accordingly

Connectivity between Orchestrators at the same site:
From MHO1_1 ping MHO1_2: ping 192.0.2.2
From MHO2_1 ping MHO2_2: ping 192.0.2.16
If there is no ping, check the Sync cable between Orchestrators within the same site.

Connectivity between SGMs (appliances)
From SGM1_1 ping SGM2_1 on sync network: ping 192.0.2.15
If there is no ping, check VLANs 3600 and 3601.

All ICMP test are okay!

I detached all the Site2 SGMs from the SG and attached again, all appliances were restarted, but the issue is the same and I'm stucked at this point.
There is an open SR regarding this with more info shared, but no progress yet.

site_sync connected switch port config:
interface Ethernetx/xx
description site_sync
switchport
switchport mode dot1q-tunnel
switchport access vlan xx
spanning-tree bpdufilter enable
mtu 9216
storm-control broadcast level 2.00
storm-control action trap
no shutdown

Maestros, do you have any idea, good advice or what to check? 🙂

Thank you in advance!

Re: Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST

Fernando_Lopez — Wed, 26 Jan 2022 18:43:26 GMT

Hello Garbo, than you for share switch's configuration. Can you share also the Inter-site link configuration?

MHO 1 <---> SW1 <-------Inter-site link------->SW2<--->MHO2

My ICMP test isn´t OK

Thank you!

Re: Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST

Chris_Atkinson — Wed, 26 Jan 2022 23:07:20 GMT

Typically QinQ support is required on this link, which version are the MHO/SGMs in your deployment?

R81.10 provides some flexibility here that you may wish to discuss with TAC otherwise.

topic Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST in Hyperscale Firewall (Maestro)

Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST

Re: Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST

Re: Maestro Dual Site Dual Orchestrator Deployment - Site2 SGMs LOST