Hi,
I think the key point is that the Security Group behaves as one logical firewall, not as individual gateways tied to a specific orchestrator.
In your example:
- SERVER-A sends traffic toward its default gateway.
- The packet reaches one of the uplinks on the Maestro system (for example MHO-1).
- MHO-1 performs the distribution calculation and forwards the packet to SGM-1 for inspection.
- SGM-1 processes the packet and returns it to the Maestro fabric.
- The packet is then forwarded toward SERVER-B.
The important thing is that the SGM is not deciding whether to use MHO-1 or MHO-2. The Security Group sees the network as a single logical system.
The actual egress path depends primarily on the uplink and bond configuration. If the uplinks are part of an LACP bond, the connected switches will apply their hashing algorithm and determine which physical link carries the traffic. As a result, traffic may leave through either orchestrator depending on how the bond is built and how the switch calculates the outbound path.
In other words, it is not:
Packet entered MHO-1 → therefore packet must leave through MHO-1.
Instead, it is:
Packet enters through an orchestrator, is distributed to the appropriate SGM for inspection, and after processing is forwarded toward the destination network. The actual physical egress link is determined by the uplink design, bonding configuration, and switching infrastructure.
A useful way to think about Maestro is that the orchestrators form a forwarding fabric in front of a single logical firewall. Your focus should be on how traffic is distributed to the correct SGM and how the uplink bonds are designed, rather than which specific orchestrator received the original packet.
If your goal is to predict the exact egress interface, then the answer is: look at the LACP/bond hashing algorithm and switch configuration, because that ultimately determines which physical uplink carries the packet toward SERVER-B.
