Maestro Distribution Mode

[valter_esjunior]

Hi, all. 

As Distribution Mode is a Security Group configuration, how should I combine User Mode and Network Mode in the same SG? How it works together? There are 3 possible combinations: 

• User Mode and User Mode

• User Mode and Network Mode

• Network Mode and Network Mode

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_AdminGuide/Topics-Maestro-...

Could you help me?

Regards. 

[Lari_Luoma]

Two options.

Option A:
Configure interface manually to either user or network mode (in gclish)
Example:
set distribution interface bond0.910 configuration network

Option 2:
When the distribution configuration is auto-topology you can also change the topology in your gateway object in SmartConsole to external or internal. This will change the distribution mode accordingly (internal=user, external=network). However, be cautious  with this method as it changes your anti-spoofing settings.

[valter_esjunior]

Hi, Lari. Thank you for your support. 

Basically, when the documentation says that is is possible to combine 2 modes together, is it related to using auto-topology? When each port is going to be configured in a different mode? Could you give me an example? 

With best regards. 

[Lari_Luoma · Accepted solution]

Yes, distribution mode can only be configured through auto-topology. The general distribution mode is a system-wide setting and cannot be configured on a per-interface basis.

Below is an example of how interface-level distribution can be used to optimize east-west traffic.

In this scenario, auto-topology is enabled and works well for north-south (Internet-bound) traffic. However, you also have east-west traffic between users and servers. Both interfaces are currently classified as Internal, which results in User mode (destination-based distribution) being applied on both sides. This can lead to excessive traffic correction and unnecessary performance overhead.

Assume:

• The east side contains user networks with hundreds or thousands of clients.
• The west side contains a server segment with only a handful of IP-addresses.
• Both interfaces are currently marked as Internal and therefore use User mode.

In this case, change the distribution mode on the user-facing interface from User to Network.

This eliminates correction because the same host address is used for distribution decisions in both directions:

1. A client initiates a connection to a server.
2. The packet enters through the user-facing interface, which is configured for Network mode.
3. Distribution is based on the source IP address (the client IP).
4. The packet reaches the server.
5. The return traffic enters through the server-facing interface, which remains in User mode.
6. Distribution is based on the destination IP address, which is again the client IP.

Because both directions hash on the same client address, the traffic is distributed to the same Security Group Member, eliminating correction traffic and improving east-west traffic efficiency.

This is a common optimization when a large user population communicates with a relatively small number of servers.

[valter_esjunior]

Perfect! It's clear now!

Thank you!