Maestro Dual Site with only one SGM in a SG ?

[Wolfgang]

We have a Maestro Dual Site deployment with 6 appliances in one SecurityGroup (three at each site). Now we want to add another SecurityGroup with only one member, at only one site. We will benefit from the interfaces of the MHO and we know the SG will be lost if the site fails, that's ok.

I remember this is supported but I can't find an official document. Maybe someone can help ?

[Alex-]

We run a dual-site with 2 SG, each with one SGM, and it works.

EDIT: never mind, I read too fast.

[Dario_Perez]

maestro architecture is designed for 3 members on SG or DC, having 2 is like cluster A/A. 

now for DRP we recommended have full power on DC1 and if not all services works on DC2 you can use less appliance there. Like 3 on DC1 and 1 on DC2. but is not mandatory. 

if you have 1 on DC1 since traffic is low you can have 1 on each DC, just keep in mind is no as maestro design is more like regular gw, the only difference here is you have cloned setup and synced connections. 

[Wolfgang]

@Dario_Perez thanks for the explanation. The design concepts are clear and understandable for us and normally we use them. But for a special use case we don‘t need any redundancy but for easy network connectivity we want to use the MHO for the connectivity to the production network.

We know from a technical perspective it‘s working but is it a supported environment ?

[Nir_Shamir · Accepted solution]

Yes , it will work and is supported.

it's a Single Site Security Group with 1 SGM.