topic Maestro dual site with one MHO on each site ? in Hyperscale Firewall (Maestro)

Maestro dual site with one MHO on each site ?

Wolfgang — Mon, 23 May 2022 14:47:39 GMT

Is it supported to run dual site deployment with only one MHO and one appliance on each site ?

Re: Maestro dual site with

Norbert_Bohusch — Mon, 23 May 2022 14:03:44 GMT

Yes, it is.

We have/had multiple customers using this.

Some because the are having one multiple security groups and one has only one member per site.

Others because they have integrated standard clusters in their Maestro deployment to support future demands.

Re: Maestro dual site with

Wolfgang — Mon, 23 May 2022 14:36:53 GMT

This means, the appliance on site_A will be connected with both ports to the one MHO on site_A and the appliance on site_B will be connected with both ports to the one MHO on site_B ?

MHOs are connected for site sync with only one or dual connection ?

Re: Maestro dual site with

Norbert_Bohusch — Tue, 24 May 2022 05:28:06 GMT

Nearly correct.

Minimal setup would be:

one downlink from MHO A to GW A
one downlink from MHO B to GW B
one site-sync from MHO A to B

For downlinks on one MHO there can only be redundancy if using quad 1G card (using port 1 and 3). Other ports (2 and 4) are reserved for a second MHO per site.

For site-sync redundancy is possible just by adding other site-sync ports.

see https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk158652 for downlink configurations

Re: Maestro dual site with one MHO on each site ?

kobil — Wed, 22 Jun 2022 14:18:11 GMT

it is possible, yet if customer is not planning growth (adding appliances or even MHOs) then he will not enjoy the benefits of unicast sync and switch redundancy within the same site.

in other words this implementation is somehow similar to traditional cluster with 2 members (working in HA mode)