Maestro Host Access - Best Practice

[Danny]

Maestro operates with predefined Internal IP Addresses.

In order to allow connections between SGMs and MHOs, like the member command, it's required to add these IPs to the Gaia Host Access list, in addition to monitoring probes and your Firewall Management DMZ that manages your Check Point security infrastructure.

A typical Gaia Host Access list on Maestro security groups would look like this:

Type	IP / Netmask	Description
Host	127.0.0.1	Localhost
Network	192.0.2.0 /24	Maestro Internal Sync Network
Network	198.51.101.0 /24	CIN (Chassis Maestro Internal Network)
Network	203.0.113.0 /24	Maestro Inter-Site Sync Network

Depending on the number of security groups, there could also be additional Maestro CIN networks, such as:
198.51.102.0 / 24, 198.51.103.0 / 24 and so on, as described here.

Note: Check Point may hide some of these networks in Gaia WebUI, verify them in GClish via: show configuration allowed-client

Let's discuss how the Gaia Host Access list should be configured on Maestro HyperScale Orchestrators (MHO).

---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner