Hardware Components

This section provides a description of hardware components of Quantum Maestro OrchestratorsClosed A scalable Network Security System that connects multiple Check Point Security Appliances into a unified system. Synonyms: Orchestrator, Quantum Maestro Orchestrator, Maestro Hyperscale Orchestrator. Acronym: MHO..

Legend

Item

Description

 

Item

Description

1

Port 1 is the Management port for Security GroupsClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected.

(leads to the Check Point Management Server).

It is possible to use only this one port to manage the Security Groups.

 

8

RJ45 port for Console connection.

2

Ports 2 – 16 are the Uplink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to external and internal networks. Gaia operating system shows these interfaces in Gaia Portal and in Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security Gateway object. 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal data networks).

 

9

Reset button.

3

Ports 17 – 30 are the Downlink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to Check Point Security Appliances. You use DAC cables, Fiber cables (with transceivers), or Breakout cables to connect between the Downlink ports and Security Appliances. The Check Point Management traffic (policy, logs, synchronization, and so on) co-exists with the data (user) traffic on the Downlink ports. Bandwidth is guaranteed for the Check Point Management traffic (portion of the downlink bandwidth). These ports form the system backplane (management, data plane, synchronization).

(lead to Security Appliances).

Important - It is not supported to configure these ports as Uplink.

 

10

Port 32 is the Internal Synchronization port that leads to the peer OrchestratorClosed See "Maestro Orchestrator". on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

4

Port 31 is the External Synchronization port in the Dual Site configuration.

This port leads to the peer Orchestrator on another Site.

In the Port Split mode (see MHO-175 Splitting Options):

  • 1st, 2nd, and 3rd splits are Downlinks.

  • 4th split is the External Sync.

Important - It is not supported to configure this port as Uplink.

 

11

Button to select indication states for the splitting control LEDs.

5

Micro USB 2.0 port.

 

12

Splitting control LEDs that show the indication state for Port LEDs:

  • State of which port to show (without a split cable).

  • State of which split port to show (in 1-to-2 split, or 1-to-4 split).

See MHO-175 Splitting Options.

6

System Health LEDs.

 

13

Port LEDs that show the status of all ports (including the split ports).

7

Management port (Mgmt1) for the Gaia OS on the Orchestrator.

 

 

 

Legend

Item

Description

 

Item

Description

1

Ports 1 - 2 are the Management port for Security Groups

(lead to the Check Point Management Server).

It is possible to use only these two ports to manage the Security Groups.

 

6

USB 2.0 port.

2

Ports 3 – 16 are the Uplink ports 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal data networks).

 

7

System Health LEDs.

3

Ports 17 – 30 are the Downlink ports

(lead to Security Appliances).

 

8

Reset button with the label RST.

4

Port 31 is the External Synchronization port in the Dual Site configuration.

This port leads to the peer Orchestrator on another Site.

Note - In the R80.20SP version, Port 30 is the default External Synchronization port.

 

9

Port 32 is the Internal Synchronization port that leads to the peer Orchestrator on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

5

Management port (Mgmt1) for the Gaia OS on the Orchestrator.

 

10

RJ45 port for Console connection.

Legend

Item

Description

 

Item

Description

1

Ports 1 - 4 are the Management port for Security Groups

(lead to the Check Point Management Server).

It is possible to use only these four ports to manage the Security Groups.

 

7

Port 48 is the Internal Synchronization port that leads to the peer Orchestrator on the same Site.

Important - It is not supported to change the default type of this port ("ssm_sync").

2

System Health LEDs.

 

8

Port 56 is the External Synchronization port in the Dual Site configuration.

This port leads to the peer Orchestrator on another Site.

Note - In the R80.20SP version, Port 47 is the default External Synchronization port.)

3

Ports 5 – 26 are the Uplink ports 1 Gbps / 10 Gbps

(lead to external and internal data networks).

 

9

Management port (Mgmt1) for the Gaia OS on the Orchestrator.

4

Ports 27 – 47 are the Downlink ports

(lead to Security Appliances).

 

10

Optional management port (Mgmt2) for the Gaia OS on the Orchestrator.

5

Ports 49 – 55 are the Uplink ports 25 Gbps / 40 Gbps / 100 Gbps

(lead to external and internal data networks).

 

11

USB 2.0 port.

6

LEDs that show the state of the split ports

when connecting Breakout cablesClosed An optical fiber cable that contains several jacketed simplex optical fibers that are packaged together inside an outer jacket. Synonyms: Fanout cable, Fan-Out cable, Splitter cable..

 

12

RJ45 port for Console connection.

  1. Connect to the command line on the first Orchestrator in your environment.

  2. Log in to Gaia Clish.

  3. If you connected a breakout cable to a port, then configure the applicable QSFP mode:

    set maestro port <Port ID> qsfp-mode {1G | 10G | 4x10G | 4x25G | 25G | 40G | 100G}

    Notes:

    • "<Port ID>" specifies the port to configure.

      The format is three numbers separated with a slash character:

      <Orchestrator ID>/<Port Label on Front Panel>/<Port Split ID>

    • The 25 Gbps speed is available in:

    You can configure only these QSFP modes:

    Orchestrator

    Ports

    Supported QSFP Modes

    MHO-175

    All ports

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

    MHO-170

    Ports with odd <Port Label on Front Panel>

    numbers (1, 3, 5, and so on)

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

     

    Ports with even <Port Label on Front Panel>

    numbers (2, 4, 6, and so on)

    • 25G

    • 40G

    • 100G

    MHO-140

    Ports with the <Port Label on Front Panel>

    numbers from 1 to 48

    • 1G

    • 10G

    • 25G

     

    Ports with the <Port Label on Front Panel>

    numbers 49, 51, 53, and 55

    • 4x10G

    • 4x25G

    • 25G

    • 40G

    • 100G

     

    Ports with the <Port Label on Front Panel>

    numbers 50, 52, 54, and 56

    • 25G

    • 40G

    • 100G

  4. Configure the port type:

    set maestro port <Port ID> type {downlink | uplink | management | site_sync | ssm_sync}

    You can configure only these port types:

    Orchestrator

    Port Number

    Supported Port Types

    Description of Port Types

    MHO-175

    1

    management (a)

    Connects to a Management Server

    to manage the Security Groups

     

     

    downlink

    Connects to Security Appliances

     

    2 - 16

    uplink

    Connects to data networks

     

     

    downlink

    Connects to Security Appliances

     

     

    site_sync

    External sync between Maestro Sites

     

     

    ssm_sync

    Internal sync on the same Maestro Site

     

    17 - 31

    downlink

    Connects to Security Appliances

     

     

    site_sync

    External sync between Maestro Sites

     

     

    ssm_sync

    Internal sync on the same Maestro Site

     

    32

    ssm_sync (b)

    Internal sync on the same Maestro Site

    MHO-170

    1, 2

    management (a)

    Connects to a Management Server

    to manage the Security Groups

     

     

    downlink

    Connects to Security Appliances

     

    3 - 31

    uplink

    Connects to data networks

     

     

    downlink

    Connects to Security Appliances

     

     

    site_sync

    External sync between Maestro Sites

     

     

    ssm_sync

    Internal sync on the same Maestro Site

     

    32

    ssm_sync (b)

    Internal sync on the same Maestro Site

    MHO-140

    1, 2, 3, 4

    management (a)

    Connects to a Management Server

    to manage the Security Groups

     

     

    downlink

    Connects to Security Appliances

     

    5 - 47

    uplink

    Connects to data networks

     

     

    downlink

    Connects to Security Appliances

     

     

    site_sync

    External sync between Maestro Sites

     

     

    ssm_sync

    Internal sync on the same Maestro Site

     

    48

    ssm_sync (b)

    Internal sync on the same Maestro Site

    Important:

    1. It is possible to use only these ports to manage the Security Groups.

    2. It is not supported to change the port type (ssm_sync) of the default Internal Synchronization port:

      • MHO-175 - Port 32

      • MHO-170 - Port 32

      • MHO-140 - Port 48

  5. Save the configuration:

    save config

  6. Examine the port configuration:

    show maestro port <Port ID> qsfp-mode

    show maestro port <Port ID> type