maestro shared uplinks

[amoruck]

Hello, 

I have maestro security group (R81.10, one site, dual MHO) with shared uplink ports feature disabled; It is using two 4-port LACP bonds. Now I learned about shared uplinks and of course would like my uplinks to be shared - can I somehow convert existing interface configuration to shared one without breaking everything and starting from scratch? 

[Dario_Perez]

Check https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/T... 

[amoruck]

I can't see my scenario there... There is very detailed description what to do if someone is just to create new bond interfaces and security groups, but what if I have my security group already operational and I only want to enable shared links?

[Dario_Perez]

is basically the same 

[amoruck]

Not exactly, the difference is I already have my interfaces configured; Do I have to delete all my interfaces and virtual systems and create them again to enable this feature? it's kind of a nuisance to do in production environment

[Dario_Perez · Accepted solution]

the best practice is to have a bond, so you can add a new interface, remove the old, apply share to old and get it back. 

But you can change the share to true on assigned interface, 

As always create snapshot, export it and ask for maintenance window 

[Wolfgang]

Most problematic task will be result in an outage of the SG.

e. Reboot all Security Group Members in the Security Group:

reboot -b all

[amoruck]

Yes, it is very unfortunate if there is no workaround for this. 

[amoruck]

I have tried this in lab (one mho-140 and two SGs, with R81.10 and old T79 jumbo, and it seems that you dont need to reboot all gateways at once. I have started with one SG with non-shared uplinks (two physical ports, bundled in LACP bond), than set shared-uplinks to enabled for this SG, (still alive!), rebooted one of two gateways, than the second, and everything worked fine, without any traffic interruption/link flap. Second SG was than able to use the same uplinks without any problem. 

Of course, it was just my lab - your mileage may vary ; -). But it would be nice if Check Point remembered about the poor admins when writing docs, not like "reboot -b all, what's the problem, do you use our hardware for any serious purpose?"

[Zolo]

Hi Wolfgang,

Could you share where you found this?

Because the Admin Guide does not include such a task.

Thanks in advance.

[Wolfgang]

@Zolo information for shared uplinks was updated December 2023. Sounds like these limitation not more exist.

[Zolo]

Thank you.