- CheckMates
- :
- Products
- :
- Quantum
- :
- Maestro Masters
- :
- Maestro Sync Question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maestro Sync Question
Hi Mates,
received two Maestro Sync questions I'm unsure with (maybe silly questions):
- In Dual room setup, if Sync goes down, only first MHO is processing traffic right?
- Is it possible to configure Sync redundancy (second link or bonding) in Dual Room single site with two MHO-175 (R81.10)?
Thank you very much!
Bye
Michael
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Sync interface between Dual MHO's is used for configuration sync operations only, so that if a configuration change is made on one of them it will also be made on the other. That is it, there is no state table sync or anything else going on that will immediately impact the operation of the MHOs if the Sync interface goes down. So if the Sync interface goes down both MHO's will continue to pass traffic normally, although if a config change is made on one MHO and not propagated to the other in this state it could definitely cause traffic handling issues.
Yes you can have redundant Sync interfaces, you'd just need to change the type of the second port from whatever it is to type "Sync". Depending on the Orchestrator model there may be restrictions about what physical ports can be reassigned to be for Sync. There’s no need to manually create a Bond interface as it will be created automatically by the Orchestrator when the second Sync interface is defined. The bond link aggregation will operate in XOR mode.
March 27th with sessions for both the EMEA and Americas time zones
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can also have two site_sync interfaces per MHO.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Sync interface between Dual MHO's is used for configuration sync operations only, so that if a configuration change is made on one of them it will also be made on the other. That is it, there is no state table sync or anything else going on that will immediately impact the operation of the MHOs if the Sync interface goes down. So if the Sync interface goes down both MHO's will continue to pass traffic normally, although if a config change is made on one MHO and not propagated to the other in this state it could definitely cause traffic handling issues.
Yes you can have redundant Sync interfaces, you'd just need to change the type of the second port from whatever it is to type "Sync". Depending on the Orchestrator model there may be restrictions about what physical ports can be reassigned to be for Sync. There’s no need to manually create a Bond interface as it will be created automatically by the Orchestrator when the second Sync interface is defined. The bond link aggregation will operate in XOR mode.
March 27th with sessions for both the EMEA and Americas time zones
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah yes, now that you mention it, indeed that was a topic in one of the workshops but I wasn't sure any more. Thank your very much for explaining!
Bye
Michael
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because we would like to use this at one installation, I would like to ask if this solution is approved by Check Point? I was not able to verify that by any Check Point official documentation and don't want to end with unsupported configuration.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dual 'ssm_sync' interfaces are 100% supported.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, does that mean that dual sync interfaces are supported even for external sync in dual site deployment?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can also have two site_sync interfaces per MHO.
