- Products
- Learn
- Local User Groups
- Partners
- More
Maestro Masters
Round Table session with Maestro experts
Hi Mates,
received two Maestro Sync questions I'm unsure with (maybe silly questions):
Thank you very much!
Bye
Michael
The Sync interface between Dual MHO's is used for configuration sync operations only, so that if a configuration change is made on one of them it will also be made on the other. That is it, there is no state table sync or anything else going on that will immediately impact the operation of the MHOs if the Sync interface goes down. So if the Sync interface goes down both MHO's will continue to pass traffic normally, although if a config change is made on one MHO and not propagated to the other in this state it could definitely cause traffic handling issues.
Yes you can have redundant Sync interfaces, you'd just need to change the type of the second port from whatever it is to type "Sync". Depending on the Orchestrator model there may be restrictions about what physical ports can be reassigned to be for Sync. There’s no need to manually create a Bond interface as it will be created automatically by the Orchestrator when the second Sync interface is defined. The bond link aggregation will operate in XOR mode.
Yes you can also have two site_sync interfaces per MHO.
The Sync interface between Dual MHO's is used for configuration sync operations only, so that if a configuration change is made on one of them it will also be made on the other. That is it, there is no state table sync or anything else going on that will immediately impact the operation of the MHOs if the Sync interface goes down. So if the Sync interface goes down both MHO's will continue to pass traffic normally, although if a config change is made on one MHO and not propagated to the other in this state it could definitely cause traffic handling issues.
Yes you can have redundant Sync interfaces, you'd just need to change the type of the second port from whatever it is to type "Sync". Depending on the Orchestrator model there may be restrictions about what physical ports can be reassigned to be for Sync. There’s no need to manually create a Bond interface as it will be created automatically by the Orchestrator when the second Sync interface is defined. The bond link aggregation will operate in XOR mode.
Ah yes, now that you mention it, indeed that was a topic in one of the workshops but I wasn't sure any more. Thank your very much for explaining!
Bye
Michael
Because we would like to use this at one installation, I would like to ask if this solution is approved by Check Point? I was not able to verify that by any Check Point official documentation and don't want to end with unsupported configuration.
Thanks
Dual 'ssm_sync' interfaces are 100% supported.
Hi, does that mean that dual sync interfaces are supported even for external sync in dual site deployment?
Thanks
Yes you can also have two site_sync interfaces per MHO.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
User | Count |
---|---|
18 | |
3 | |
2 | |
2 | |
2 | |
1 | |
1 | |
1 | |
1 | |
1 |
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY