Hardware Components

This section provides a description of hardware components of Quantum Maestro OrchestratorsClosed A scalable Network Security System that connects multiple Check Point Security Appliances into a unified system. Synonyms: Orchestrator, Quantum Maestro Orchestrator, Maestro Hyperscale Orchestrator. Acronym: MHO..

Legend

Item

Description

 

Item

Description

1

Port 1 is the Management port for Security GroupsClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected.

(leads to the Check Point Management Server).

 

7

Management port (Mgmt1) for the Gaia OS on the OrchestratorClosed See "Maestro Orchestrator"..

2

Ports 2 – 16 are the Uplink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to external and internal networks. Gaia operating system shows these interfaces in Gaia Portal and in Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security Gateway object. 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal networks).

 

8

RJ45 port for Console connection.

3

Ports 17 – 30 are the Downlink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to Check Point Security Appliances. You use DAC cables, Fiber cables (with transceivers), or Breakout cables to connect between the Downlink ports and Security Appliances. The Check Point Management traffic (policy, logs, synchronization, and so on) co-exists with the data (user) traffic on the Downlink ports. Bandwidth is guaranteed for the Check Point Management traffic (portion of the downlink bandwidth). These ports form the system backplane (management, data plane, synchronization).

(lead to Security Appliances).

 

9

Port 32 is the Internal Synchronization port that leads to the peer Orchestrator on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

4

In the Dual Site configuration, Port 31 is the External Synchronization port that leads to the peer Orchestrator on another Site.

In the Port Split mode (see MHO-175 Splitting Options):

  • 1st, 2nd, and 3rd splits are Downlinks.

  • 4th split is the External Sync.

 

10

Button to select indication states for the splitting control LEDs.

5

Micro USB 2.0 port.

 

11

Splitting control LEDs that show the indication state for Port LEDs:

  • State of which port to show (without a split cable).

  • State of which split port to show (in 1-to-2 split, or 1-to-4 split).

See MHO-175 Splitting Options.

6

System Health LEDs.

 

12

Port LEDs that show the status of all ports (including the split ports).

Legend

Item

Description

 

Item

Description

1

Ports 1 - 2 are the Management port for Security Groups

(lead to the Check Point Management Server).

 

6

System Health LEDs.

2

Ports 3 – 16 are the Uplink ports 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal networks).

 

7

Reset button with the label RST.

3

Ports 17 – 29, and 31 are the Downlink ports

(lead to Security Appliances).

 

8

In the Dual Site configuration, Port 30 is the External Synchronization port that leads to the peer Orchestrator on another Site.

4

Management port (Mgmt1) for the Gaia OS on the Orchestrator.

 

9

Port 32 is the Internal Synchronization port that leads to the peer Orchestrator on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

5

USB 2.0 port.

 

10

RJ45 port for Console connection.

Legend

Item

Description

 

Item

Description

1

Ports 1 - 4 are the Management port for Security Groups

(lead to the Check Point Management Server).

 

7

Port 48 is the Internal Synchronization port that leads to the peer Orchestrator on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

2

System Health LEDs.

 

8

In the Dual Site configuration, Port 56 is the External Synchronization port that leads to the peer Orchestrator on another Site.

(In the R80.20SP version, Port 47 is the External Synchronization port.)

3

Ports 5 – 26 are the Uplink ports 1 Gbps / 10 Gbps

(lead to external and internal networks).

 

9

Management port (Mgmt1) for the Gaia OS on the Orchestrator.

4

Ports 27 – 47 are the Downlink ports

(lead to Security Appliances).

 

10

Management port (Mgmt2) for the Gaia OS on the Orchestrator.

5

Ports 49 – 55 are the Uplink ports 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal networks).

 

11

USB 2.0 port.

6

LEDs that show the state of the split ports

when connecting Breakout cablesClosed An optical fiber cable that contains several jacketed simplex optical fibers that are packaged together inside an outer jacket. Synonyms: Fanout cable, Fan-Out cable, Splitter cable..

 

12

RJ45 port for Console connection.

  1. Connect to the command line on the first Orchestrator in your environment.

  2. Log in to Gaia Clish.

  3. If you connected a breakout cable to a port, then configure the applicable QSFP mode:

    set maestro port <Port ID> qsfp-mode {1G | 10G | 4x10G | 4x25G | 25G | 40G | 100G}

    Notes:

    • "<Port ID>" specifies the port to configure.

      The format is three numbers separated with a slash character:

      <Orchestrator ID>/<Port Label on Front Panel>/<Port Split ID>

    • The 25 Gbps speed is available in:

    You can configure only these QSFP modes:

    Orchestrator

    Ports

    Supported QSFP Modes

    MHO-175

    All ports

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

    MHO-170

    Ports with odd <Port Label on Front Panel>

    numbers (1, 3, 5, and so on)

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

     

    Ports with even <Port Label on Front Panel>

    numbers (2, 4, 6, and so on)

    • 25G

    • 40G

    • 100G

    MHO-140

    Ports with the <Port Label on Front Panel>

    numbers from 1 to 48

    • 1G

    • 10G

    • 25G

     

    Ports with the <Port Label on Front Panel>

    numbers 49, 51, 53, and 55

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

     

    Ports with the <Port Label on Front Panel>

    numbers 50, 52, 54, and 56

    • 25G

    • 40G

    • 100G

  4. Configure the port type:

    set maestro port <Port ID> type {downlink | uplink | management | site_sync | ssm_sync}

    You can configure only these port types:

    Orchestrator

    Port Number

    Supported Port Types

    MHO-175

    1

    • management

    • downlink

     

    2 and higher

    • management

    • downlink

    • uplink

    • site_sync (sync between sites)

    • ssm_sync (sync on the same site)

     

    32

    ssm_sync (sync on the same site)

    MHO-170

    1, 2

    • management

    • downlink

     

    3 and higher

    • management

    • downlink

    • uplink

    • site_sync (sync between sites)

    • ssm_sync (sync on the same site)

     

    32

    ssm_sync (sync on the same site)

    MHO-140

    1, 2, 3, 4

    • management

    • downlink

     

    5 and higher

    • management

    • downlink

    • uplink

    • site_sync (sync between sites)

    • ssm_sync (sync on the same site)

     

    48

    ssm_sync (sync on the same site)

    Important - It is not supported to change the port type of the dedicated Internal Synchronization port:

    • MHO-175 - Port 32

    • MHO-170 - Port 32

    • MHO-140 - Port 48

  5. Save the configuration:

    save config

  6. Examine the port configuration:

    show maestro port <Port ID> qsfp-mode

    show maestro port <Port ID> type