Maestro operates with predefined Internal IP Addresses.
In order to allow connections between SGMs and MHOs, like the member command, it's required to add these IPs to the Gaia Host Access list, in addition to monitoring probes and your Firewall Management DMZ that manages your Check Point security infrastructure.
A typical Gaia Host Access list on Maestro security groups would look like this:
| Type | IP / Netmask | Description |
| Host | 127.0.0.1 |
Localhost |
| Network | 192.0.2.0 /24 |
Maestro Internal Sync Network |
| Network | 198.51.101.0 /24 |
CIN ( |
| Network | 203.0.113.0 /24 |
Maestro Inter-Site Sync Network |
Depending on the number of security groups, there could also be additional Maestro CIN networks, such as:
198.51.102.0 / 24, 198.51.103.0 / 24 and so on, as described here.
Note: Check Point may hide some of these networks in Gaia WebUI, verify them in GClish via: show configuration allowed-client
Let's discuss how the Gaia Host Access list should be configured on Maestro HyperScale Orchestrators (MHO).
---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner
| User | Count |
|---|---|
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
