Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
amoruck
Participant
Jump to solution

maestro shared uplinks

Hello, 

I have maestro security group (R81.10, one site, dual MHO) with shared uplink ports feature disabled; It is using two 4-port LACP bonds. Now I learned about shared uplinks and of course would like my uplinks to be shared - can I somehow convert existing interface configuration to shared one without breaking everything and starting from scratch? 

0 Kudos
1 Solution

Accepted Solutions
Dario_Perez
Employee Employee
Employee

the best practice is to have a bond, so you can add a new interface, remove the old, apply share to old and get it back. 

But you can change the share to true on assigned interface, 

As always create snapshot, export it and ask for maintenance window 

View solution in original post

0 Kudos
11 Replies
amoruck
Participant

I can't see my scenario there... There is very detailed description what to do if someone is just to create new bond interfaces and security groups, but what if I have my security group already operational and I only want to enable shared links?

0 Kudos
Dario_Perez
Employee Employee
Employee

is basically the same 

0 Kudos
amoruck
Participant

Not exactly, the difference is I already have my interfaces configured; Do I have to delete all my interfaces and virtual systems and create them again to enable this feature? it's kind of a nuisance to do in production environment

0 Kudos
Dario_Perez
Employee Employee
Employee

the best practice is to have a bond, so you can add a new interface, remove the old, apply share to old and get it back. 

But you can change the share to true on assigned interface, 

As always create snapshot, export it and ask for maintenance window 

0 Kudos
Wolfgang
Authority
Authority

Most problematic task will be result in an outage of the SG.

e. Reboot all Security Group Members in the Security Group:

reboot -b all

0 Kudos
amoruck
Participant

Yes, it is very unfortunate if there is no workaround for this. 

0 Kudos
amoruck
Participant

I have tried this in lab (one mho-140 and two SGs, with R81.10 and old T79 jumbo, and it seems that you dont need to reboot all gateways at once. I have started with one SG with non-shared uplinks (two physical ports, bundled in LACP bond), than set shared-uplinks to enabled for this SG, (still alive!), rebooted one of two gateways, than the second, and everything worked fine, without any traffic interruption/link flap. Second SG was than able to use the same uplinks without any problem. 

Of course, it was just my lab - your mileage may vary ; -). But it would be nice if Check Point remembered about the poor admins when writing docs, not like "reboot -b all, what's the problem, do you use our hardware for any serious purpose?"

0 Kudos
Zolo
Contributor
Contributor

Hi Wolfgang,

Could you share where you found this?

Because the Admin Guide does not include such a task.

Thanks in advance.

0 Kudos
Wolfgang
Authority
Authority

@Zolo information for shared uplinks was updated December 2023. Sounds like these limitation not more exist.

2024-02-02 08_14_59-Important Information.png

0 Kudos
Zolo
Contributor
Contributor

Thank you.

0 Kudos