Maestro Masters 2025: Maestro Migration and Upgrade Best Practices

[the_rock]

Excellent, as always.

[Arthur_DENIS1]

Thanks for sharing !

One question regarding migrating to new appliances.

In my scenario, I have single site running dual orchestrator.
As I understand, I can add new appliance inside my security group even if it's not supported for production based sk162373.

Let's say I have 2 SGM 15600 on my single site, and I want to migrate to 9000 series.
If I put 1x 9000 inside my SG, production traffic is supposed to be handled by this 9000s without impact ? Correct ?

But at the end of the migration, I still need to reboot all in the same time to be able to allocated correct SND core number, still correct ?


If yes, smooth indeed, but not totally transparent and still need a maintenance windows as we have a real cut at a moment 

Thanks 

[CKing]

I've recently tested a similar scenario, dual site each with dual orchestrators, but the same 15600 to 9000 series appliances.

Once all SGMs were swapped to the 9000 series "asg diag verify" fails the Core Distribution tests with "Ppak cores inconsistency" and "CoresXL + ppak exceed physical"

Had to reboot all SGMs after reconfiguring the CoreXL instance counts with cpconfig. I did find the new 9000 series appliances rebooted much faster than the 15600s. Was approx 6min in my lab.

Also interested to know if there is a smoother way for migration purposes to sort the CoreXL config, or if we just have to take the full outage.

[RPawar]

Hello PhoneBoy,

Really appreciate for the PDF and the video that you have shared, its very insight full in regards to upgrading of and migrating to maestro devices.

However i have few questions or rather doubts that i would like to share with the experts here.

1) In the document under migration troubleshooting it is mentioned that LACP should be configured and there should be no VPC between the connected switches - Question : we have a migration going on and we have 3 switches in uplink WAN, Core, DMZ all the switches have VPC on them, although we tested the LACP functionality by enabling the interfaces and it was working as expected, just wanted to clarify that can the VPC part on switch cause any future hurdle during cutover?

2) We have 95 Ipsec communities along with their respective routes VPNT (Route Based Ipsec tunnels) in our live setup which has standard HA cluster of two 5600 gateways. We will be performing a direct migration and full cutover in one go to Maestro - Question: Wanted to know if there are any hidden settings or configuration that is specific to maestro environment which we need to follow before the direct cutover for IPsec?

note : we will be using the same Ip-schema as that of live setup and all the configurations or policy package will be replicated and pushed on the maestro.

Would be great help if anyone can assist on these queries.

[_Val_]

@Lari_Luoma can you answer, please?

[Lari_Luoma]

Hi!

1. VpC is needed if you want to connect LACP members to different switches

2. Seems like you would need to migrate to SASE. 😉 Typically when VPNs are migrated there are no special settings and they come up fine. Make sure the new GW object is in every community as expected and other settings are cloned correctly from the old setup. For this kind of complex migration I would recommend hiring Check Point PS.