topic Re: Connecting to secondary member in Maestro pair in Hyperscale Firewall (Maestro)

Connecting to secondary member in Maestro pair

JaySon_2021 — Wed, 01 Sep 2021 17:29:46 GMT

I need to make a modification to the config (clish) on a Maestro unit. I made the change on the first unit but can't get connected to the second unit. The VIP always takes me to the primary. Is there a way to jump from the primary to the secondary?

Re: Connecting to secondary member in Maestro pair

mk1 — Wed, 01 Sep 2021 20:11:02 GMT

On the first place - why do you need to implement a change on both members separately? When you are in gclish your config will be implemented on all group members.

On your question - if your primary member is ch01-01 just type m 1_2 and you will be logged on the secondary. Here's the output of the m command:

[Expert@FW1-ch01-02:0]# m
Move to member

Usage:
member [<group_id>_]<member_id>
member ssm<ssm_id>
member cmm

Re: Connecting to secondary member in Maestro pair

Danny — Wed, 01 Sep 2021 22:12:30 GMT

Just run lldpneighbors to check the IP of your secondary members and directly SSH connect to them. As @mk1 mentioned, you could also use Check Point's SSH wrapper member (alias: m) for this.

Re: Connecting to secondary member in Maestro pair

JaySon_2021 — Thu, 02 Sep 2021 13:29:43 GMT

I inadvertently made the change on the primary (using clish, not glcish). If I run the commands again using gclish from the primary will that work even though the commands already exist on the primary?

Re: Connecting to secondary member in Maestro pair

mcatanzaro — Thu, 02 Sep 2021 22:56:38 GMT

Check out asg_blade_config. It is the surefire way to ensure your config matches. I would check /etc/xfer_files_list to see if pulling config on SGM 2 will force a reboot first.

Here is the admin guide for R80.30SP Maestro which explains these in more depth:

https://sc1.checkpoint.com/documents/R80.30SP/WebAdminGuides/EN/CP_R80.30SP_Maestro_AdminGuide/Content/Topics/Security-Appliance-Policy-Management.htm?Highlight=asg_blade

Re: Connecting to secondary member in Maestro pair

Simon_Macpherso — Fri, 03 Sep 2021 05:20:25 GMT

LLDP is disabled by default in Gaia.

Is it supported on Gaia pre-R81?

Re: Connecting to secondary member in Maestro pair

Simon_Macpherso — Fri, 03 Sep 2021 05:31:31 GMT

From SGM1, i.e. maestro-ch01-01, enter m 1_2 to move to member 2.

From SGM1, enter m 1_1 to move to member 1.

Enter m then enter to view the usage options.

Move to member

Usage:
member [<group_id>_]<member_id>
member ssm<ssm_id>
member cmm

From an Orchestrator (MHO),

Connect to SGM1 by running m 1 1, you will be prompted for the admin password.

Connect to SGM2 by running m 1 2, you will be prompted for the admin password.

Enter m then enter to view the usage options

Move to member

Usage:
member <security_group_id> <member_id>

What change are you making?

If you run the command again in gclish it should apply to both members.

Or run asg_blade_config pull_config command on the unit you haven't changed in gClish to pull configuration from the other SGM.

Re: Connecting to secondary member in Maestro pair

Danny — Fri, 03 Sep 2021 06:39:33 GMT

LLDP is a core functionality in Maestro and therefore enabled by default since Gaia R80.20SP. See sk175288.

Re: Connecting to secondary member in Maestro pair

Simon_Macpherso — Fri, 03 Sep 2021 06:46:36 GMT

R80.30SP Take 49

lldpneighbors couldn't connect to the OpenLLDP transport socket. Is lldpd running?