Maestro for Beginners: Core Concepts Explained

[israelfds95]

Today, we will discuss Maestro for beginners, explaining in a clear and simple way the fundamental concepts of this advanced and complex Check Point firewall architecture.

What Is Maestro?

Maestro is an orchestration platform designed to deliver hyperscale network security. It is the device responsible for coordinating firewall, the MHO distributes and forwards traffic to the Security Gateway Modules, which perform inspection and enforcement.

israelfds95_0-1771077628307.png

Source: Quantum Maestro 2026 datasheet

Maestro is also known as MHO, which stands for:

Maestro Hyperscale Orchestrator

What Is Hyperscale?

Hyperscale is a technology that provides organizations with the ability to scale their network architecture dynamically as system demand increases.

In simple terms, hyperscale means achieving massive scalability, allowing infrastructure growth without architectural redesign.

What Is the Other Function of the Maestro (MHO)?

MHO logically groups multiple Security Gateway Modules into a single Security Group that operates as one unified firewall. It creates a logical firewall cluster called a Security Group (SG).

What Is a Security Group?

A Security Group (SG) in a Maestro environment is a logical group of security appliances that provides Active/Active cluster functionality.

Security Groups operate separately and independently from each other within the same Maestro environment

The Security Group is created within the Gaia operating system of the MHO.

israelfds95_1-1771077652774.png

How Many Security Groups Can Be Created?

A maximum of 8 Security Groups can be created in a Maestro deployment.

How Are Firewalls Identified in a Maestro Environment?

In a Maestro environment, the individual firewall appliances are called:

SGM – Security Gateway Module

How Many SGMs Can Be Added to a Security Group?

The number of SGMs depends on:

• The MHO model being used
• The number of ports allocated for downlink connectivity

This allocation is adjustable based on design requirements.

Single Site Deployment

• Maximum of 31 SGMs in one Security Group.

Dual Site Deployment

• Maximum of 14 SGMs per Security Group per site.

What Is a Site?

In a Maestro deployment, a Site represents a physical location containing a complete Maestro infrastructure, including its own Orchestrators (MHOs) and Security Gateway Modules (SGMs).

A Single Site deployment operates entirely within one physical location.

What Is a Dual Site?

A Dual Site deployment consists of two geographically separated Maestro Sites.

Each Site contains its own pair of Orchestrators and SGMs, operating together to form a distributed Security Group across locations.

This architecture provides geographic redundancy and enhanced high availability.

israelfds95_2-1771077688878.png

Source: Quantum Maestro 2026 datasheet

What MHO Models Are Currently in Production?

• MHO-140
• MHO-175

Note: The MHO-170 model was previously available but has been replaced by the MHO-175.

What Is the Difference Between the MHO-140 and MHO-175?

MHO-140

• 48 × 10/25GbE ports
• 8 × 40/100GbE ports

israelfds95_3-1771077703560.png

Source: Quantum Maestro 2026 datasheet

MHO-175

• 32 × 40/100GbE ports

israelfds95_4-1771077703582.png

Source: Quantum Maestro 2026 datasheet

Does the Maestro (MHO) Perform Routing?

No.

The Orchestrator primarily operates at Layer 2, forwarding traffic to the Security Gateway Modules (SGMs).

Does the Maestro (MHO) Perform Security Inspection?

No.

The SGMs are responsible for processing and inspecting traffic. All security inspection is handled by the Security Gateway Modules.

Understanding Maestro (MHO) Ports

Uplink Ports

• Connect the MHO to the customer’s switches.
• Provide connectivity to the customer network.
• Function as the external interfaces of the Maestro Security Gateway.

Downlink Ports

• Connect the MHO to the SGMs.

Used for internal communication between the orchestrator and the firewall modules.

The image below shows the downlink connection between the Maestro and the SGM and the sync port connection between the MHO-140 appliances

downlink.jfif

Management Ports

• Used for connectivity between the Security Group and the Security Management Server (SMS) or other management systems.
  
  
• This port inside the Gaia Orchestrator config shows as eth1-Mgmt1 ...
• Firewall management traffic
• SIC (Secure Internal Communication)
• Policy installation
• Logs
  
  

The image below shows Management SG port, located on the front Panel of the MHO-140

israelfds95_5-1771077744611.png

The image below shows Management SG port, located on the front Panel of the MHO-175

israelfds95_6-1771077744629.png

MAGG

The MAGG (Management Aggregation) is essentially a bond (link aggregation). However, unlike a regular Linux bond, it is a dedicated interface type in Maestro specifically designed for Security Group management interfaces.

As described in the Administration Guide:

"Management Aggregation (MAGG) is a High Availability and Load Sharing solution for management interfaces on Scalable Platform Security Groups."

In other words, the MAGG provides both High Availability (HA) and Load Sharing for the management connectivity of the Security Group. It is not used for production traffic, but rather for management communication, such as access to the Security Group, SIC communication, and other management-related services.

Orchestrator Sync Ports

• Used for synchronization between two MHOs in a cluster.
• Both MHOs must be the same model.

Site Sync Ports

• Used for synchronization between Maestro systems located in geographically separated sites (Dual Site).

Mgmt Orchestrator Port

• Used for managing the Gaia operating system of the Maestro (MHO).

The image below shows the management ports located on the rear panel of the MHO-140. 

• Used for managing the Gaia operating system of the Maestro (MHO).

  israelfds95_7-1771077762645.png

  
  Port 0 (red): Mgmt1 – default management port for the Gaia operating system.

  Port 1 (green): Mgmt2 – secondary management port, optional.

  The image below shows the management ports located on the front panel of the MHO-175.

  • Used for managing the Gaia operating system of the Maestro (MHO).
• israelfds95_8-1771077782681.png

What Is the Operating Mode of the MHO and SGMs?

The Maestro architecture operates in Active/Active mode, enabling load distribution across all SGMs within a Security Group.

How Is Maestro Represented in SmartConsole?

Within Maestro, we create a Security Group (SG).

In SmartConsole, we create a Gateway object (Single Gateway) to represent the Maestro firewall.

This object is known in the Maestro environment as:

SMO – Single Management Object

The SMO allows administrators to manage the entire Active/Active Maestro cluster as if it were a single Security Gateway, even though it is composed of multiple SGMs operating together.

israelfds95_10-1771078755613.png

Complete topology example

Below is a complete topology example that I created. It illustrates how the MAGG, Uplink, downlinks and Sync is connected within a Maestro environment and makes it easier to understand its role in the overall architecture.
imagem (90).png

Author: @israelfds95 

[the_rock]

Man, this is GOLD. I dont know much about Maestro, but way you explained it here is truly outstanding!

[israelfds95]

That’s great, I’m glad it was useful. This year I’ll be implementing many Maestro projects. I’ll share more information along the way.

[the_rock]

I really want to learn more about it. I always try apply same philisophy when I teach someone things they dont know much about. I find patience and explaining things in most simple way is important...just my opinion.

[israelfds95]

I believe that as well, especially with these complex topics, the easier they are explained, the better the understanding. I recommend the Maestro course available in the partner portal e-learning; it’s very complete and explains things clearly. I watched it extensively and also studied the official CCME guide in depth. This year, I’m planning to earn this certification.

[the_rock]

I wish I could explain things like the guy in below video...GENIUS

https://www.youtube.com/watch?v=mpQZVYPuDGU

[israelfds95]

I even liked that video; I watched it a long time ago, and it explains the topic very well. I wish I could explain things that clearly too, haha.

[the_rock]

I have never heard anyone in my life explain dns better than that guy...my personal opinion.

[WiliRGasparetto]

Congratulations bro, as always a very well done job.

[israelfds95]

Thank you,  @twilight_z .I believe they turned out very well structured, detailed, and clearly explained.

[Andrii28072013]

i dont clearly get MAGG implementation. It's told to be for "management connectivity of the Security Group". We can see MAGG as physical links bw MO & upstream switches. BUT how does mgmt traffic get to arbitrary SG from MO considering it's interconnected to MO with its downlink ports?
Thank you

[israelfds95]

@Andrii28072013 

I hope this helps!

A MAGG is an aggregation of the MHO front-panel management ports used to provide management connectivity between the Security Group (SGMs) and the customer network/SMS.

Think of a regular firewall: you need a management interface and an IP address to establish SIC and communicate with the Management Server. In Maestro, especially with two MHOs, the MAGG provides this function for the Security Group.

First, you configure the MHO front-panel management ports assigned to the Security Group. Then, from the Security Group itself, you create the MAGG by aggregating those management ports. This becomes the Security Group's management interface for SIC, policy installation, logs, and other management traffic. The MHO intermediates this communication.

Below are some screenshots from a Maestro environment I built, with a few annotations.

When working with Maestro, it is important to understand the purpose of each interface type: Uplink, Downlink, Sync, Maestro Management, and Security Group Management (MAGG).

MHO VIEW: 

imagem - 2026-08-19T100038.615.png

imagem - 2026-08-19T100033.228.png

SECURITY GROUP VIEW

imagem - 2026-08-19T100043.367.png

[Andrii28072013]

Hi Israel
thanks for above details. But i seemingly formulated my Q in unclear manner. So let me to explain my concern.
on the diagram we can see only downlinks toward SGMs & MAGG toward LAN. MO is in the middle. so how mgmt traffic gets delivered bw both via MO?
i'd assume it can be done in-band via downlinks via dedicated VLAN also present on MAGG. But in the screenshot we can see ethX-Mgmt1 interfaces belonging to SIGs. Are those SIG's OoB-mgmt used for aforementioned purpose & diagrams lack this part? I'm just trying to get SIGs mgmt traffic treatment clear from network pov.
Thank you

[Lari_Luoma]

Thanks for sharing this. It's very useful.

I want to clarify a few things

Magg

Magg is not mandatory, but definitely recommended. You can manage Maestro system via a production uplink as well, but that can cause challenges especially during migrations. If you manage Maestro via Smart-1 Cloud, uplink management is typically your only option.

MHO

MHO is used to create and edit Security Groups, that's it. You don't configure any bond interfaces or add firewall configurations at the MHO. All those configs are done at the security group level (or in case of a VSX, at a VS level).

MHO-140 management port
Two management ports in the back panel are really labelled 0 and 1 (as shown in the picture) even though Gaia refers to them as 1 and 2. I'm not sure where the discrepancy has originated from...

[israelfds95]

@Andrii28072013 

Yes, exactly. Going back to the MHO port images: you’ll see the management ports I used for the MAGG (LACP) only access-mode VLANs were passed to the switches there. For the uplinks, I set up a Bond (LACP) and assigned the data VLANs to them; these were configured as trunk Port Channels. The MHO acts as the intermediary and bridge between the SGMs and the network (or the SMS). The downlinks are strictly for communication between the MHO and the SGMs; the network won't see the firewalls via the downlinks. At the end of the post above, there’s a real-world topology from a project I worked on; it shows the physical connections for the MAGG, uplink, and downlink ports...

[Andrii28072013]

Hi Israel
honestly it didnt make mgmt topic more clear for me. Look, on the imagem (90).png we can only see SGMs (aka SIGs) connected to MO's downlinks (f.e. SGM#1@Eth1-01 connects to MO@Eth1-27 & SGM#1@Eth1-02 connects to MO@Eth2-27  & that's it.
Then if downlinks are not exposed to LAN in any manner (i read it as mgmt is not switched via downlinks) Then how mgmt is bridged to MAGG on MO?
Thank you

[israelfds95]

@Andrii28072013 

Refer back to the information I posted, as well as the documentation and courses on the E-Learning Maestro, to gain a full understanding; if you have a project to execute, you will be able to solidify that knowledge. To put it simply: the MHO mediates communication between the network (via Uplink) and the MAGG ports; it receives network traffic and forwards it to the SGMs via the downlink, that’s all there is to it.