Maestro Host Access - Best Practice

[Danny]

Maestro operates with predefined Internal IP Addresses.

In order to allow connections between SGMs and MHOs, like the member command, it's required to add these IPs to the Gaia Host Access list, in addition to the specific Firewall Management DMZ that manages the Check Point security infrastructure.

A typical Gaia Host Access list on Maestro security groups would look like this:

Type	IP / Netmask	Description
Host	127.0.0.1	Localhost
Network	192.0.2.0 /24	Maestro Internal Sync Network
Network	198.51.101.0 /24	CIN (Chassis Maestro Internal Network)
Network	203.0.113.0 /24	Maestro Inter-Site Sync Network

Depending on the number of security groups, there could also be additional Maestro CIN networks, such as:
198.51.102.0 / 24, 198.51.103.0 / 24 and so on, as described here.

Let's discuss how the Gaia Host Access list should be configured on Maestro HyperScale Orchestrators (MHO).

---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner