Maestro Dual Site - different SGM per site

[FenZ45]

Hello.

We have the following scenario for a maestro deployment.

One single site with two mho-140 and two 28600HS appliances, working as vsx gateway.

Another single site with two mho-140 and two 16600HS appliances, working as vsx gateway.

It's posible to configure a dual site (only one security group) with this mix of applainces?

SITE 1:

two 28600HS appliances

SITE 2

two 16600HS appliances

If it's posible, how does the diference in capacity affects the traffic, vsx, and distribution? 

Could be posible that if we buy another 16600HS for the site 2, this one can work with 3 appliances?

Regards!

[emmap · Accepted solution]

Hi

There's a long answer to this question that is best discussed with your local CP office Maestro expert, but the short version is:

Dual site security groups should mirror each other in terms of hardware, as this ensures proper HA as both sites have the same capability. If you do want to mix different hardware in a security group we can do that, but there are limits as to what's supported. Details are in this SK. Even if you mix models, the two sites should mirror each other in terms of SGM makeup. Details on how mix and match work are in the admin guides.

In short, it's not supported to do a dual-site security group with 28600HSs on one side and 16600HSs on the other side, even if you add more smaller appliances. More small appliances do not scale the same as fewer large appliances, especially when it comes to VSX due to the nature of the scaling - all VSs are active across all SGMs, and will share the same CoreXL per VS config. Hence, if you have a VS with 4CXLs configured, they will have 4CXLs per SGM - so if one site has 2 SGMs and the other 3, the VS will have more instances running on the site with more (smaller in this example) appliances. 

[FenZ45]

Hi @emmap .

Thanks for your answer. This is just an intellectual curiosity for a maestro deployment.

My plan is not to install something like this, i just wanted to know if it's posible or not. Also, my local checkpoint representatives have told to me that this is not recommended.

Regards.

[Sven_Glock]

Hi,

as described from @emmap it is not supported to run sites with different sgm hardware like described above.

I tried it for a specific szenario where it worked for me flawless.
In my szenario I wanted to migrate a security group from 7000 appliances to 16200 appliances.
I removed all 7000er appliances from backup chassis, added 16200 appliances to security group and installed everything manually without imagecloning. The failover to to backup chassis was possible without any impact even under load.
After failover I exchanged 7000 appliances from second chassis with 16200 and installed them with image cloning.

Of course - the hardware difference between sites was only a short period of time. 
For a longer time period I would always choose to have the same haredware.

Regards
Sven