Maetro Hyperscale security group unassign interfaces

[Ali426]

Hi Folks!

 New to Maestro concept, i was just going through some documents and videos. there was unassign interfaces column under security group, this unassign interfaces are from orchestrator or gateway ?  Hope to get clarification

Cheers!

[PhoneBoy]

This is done at the Orchestrator level, not the device/gateway level.

[Lari_Luoma · Accepted solution]

All interfaces in Maestro (except the downlinks) are housed on the orchestrators. When you create a security group, you assign gateways and interfaces into it (in orchestrator WebUI). The interfaces not assigned to any security group are "unassigned". You should only assign interfaces to each security group that you will need.

[Ali426]

Appreciate the response! my question was

1. Unassign interfaces - are this physical interfaces of gateways or are this physical interfaces of orchestrator itself ?

2. In the attach diagram - LAN connections from core switches and wan connections from internet are connected to orchestrator only, dont we have to connect lan and wan connections to gateways ?

3. Basically i am trying to understand real time best practise traffic flow  

[_Val_]

@Ali426 It is best to actually consult the documentation.

Your questions were answered twice already here.

An orchestrator is connected to the GWs with uplinks and downlinks only. All production interfaces are connected to the orchestrator. 

[Ali426]

@_Val_ thanks for the response! so as per my understanding

1. Traffic from source network comes to orchestrator

2. then orchestrator send the traffic to respective gateway of that security group

3. Gateway will process this traffic and send back to orchestrator over the downlink

4. Orchestrator then send this traffic to destination

Summary:

1.Gateways will just receive traffic from orchestrator, process the traffic and send back to orchestrator

2. Gateways will never have Internal or External connection connected to them physically

[_Val_]

Correct. MHO is a load balancer, as part of other operations. It breaks your traffic into flows, which are sent to GWs for processing via downlinks and returned filtered (policy applied and enforced) via uplinks. A Security Group with multiple physical appliances is acting as a single logical security GW. 

Look into documentation and look up in the community, there are tons of info:

For example,

• Maestro Jump Start Video Course: https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/Check-Point-Jump-Start-Course-Maes...
• Maestro Intoriductory session by @Lari_Luoma: https://community.checkpoint.com/t5/Maestro/Introduction-to-Maestro-EMEA-session/m-p/156237