MAGG Interfaces

Management Aggregation (MAGG) is a High Availability and Load Sharing solution for management interfaces on Scalable Platform Security Groups.

You can create a Bond interface on the Management Ports. This can be useful for testing purposes, or as a proxy interface for an unnumbered interface.

This section shows you how to configure a MAGG interface in the Gaia PortalClosed Web interface for the Check Point Gaia operating system. and Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

Notes:

  • MAGG interface does not support VLAN interfaces on its management bonding group.

  • The name of a MAGG interface in GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. is "magg<Bond Group ID>".

    For example, the name of a MAGG interface with a Bond Group ID of 1 is "magg1".

  • To configure MTU on a MAGG subordinate interface, you must configure MTU on the Bond interface.

    This MTU applies to all subordinate interfaces assigned to this MAGG interface.

  • Configuration of the MAGG bonding mode is available only in Gaia gClish of a Security Group (Known Limitation PMTR-93476).

Configuring MAGG Interfaces in Gaia Portal

Important - On Scalable Platforms (Maestro and Chassis), you must connect to the Gaia Portal of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click Interface Management > Network Interfaces.

2

Click Add > Magg.

3

In the Comment field, enter the applicable comment text (up to 100 characters).

4

On the IPv4 tab, do one of these:

  • Select Obtain IPv4 address automatically to get the IPv4 address from the DHCPv4 server.

    Important - Scalable Platforms (Maestro and Chassis) do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv4 address and subnet mask in the applicable fields.

5

Optional: On the IPv6 tab, do one of these:

  • Select Obtain IPv6 address automatically to get the IPv6 address from the DHCPv6 server.

    Important - Scalable Platforms (Maestro and Chassis) do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv6 address and mask length in the applicable fields.

Important:

6

On the Magg tab:

  1. Select or enter a Bond Group ID. This parameter is an integer between 0 and 1024.

  2. Select the subordinate interface eth<X>-Mgmt<Y> interfaces from the Available Interfaces list and then click Add.

    Note - Make sure that the subordinate interfaces do not have any IP addresses or aliases configured.

7

On the Advanced tab:

  1. Configure the Monitor Interval - How much time to wait between checking each subordinate interface for link-failure. The valid range is 1-5000 ms. The default is 100 ms.

  2. Configure the Down Delay - How much time to wait, after sending a monitor request to a subordinate interface, before bringing down the subordinate interface. The valid range is 1-5000 ms. The default is 200 ms.

  3. Configure the Up Delay - How much time to wait, after sending a monitor request to a subordinate interface, before bringing up the subordinate interface. The valid range is 1-5000 ms. The default is 200 ms.

  4. Select the Transmit Hash Policy - the algorithm for subordinate interface selection according to the specified TCP/IP Layer.

    Select either Layer 2 (uses XOR of the physical interface MAC address), or Layer 3+4 (uses IP addresses and Ports).

8

Click OK.

Step

Instructions

1

In the navigation tree, click Interface Management > Network Interfaces.

2

Select a MAGG interface and click Edit.

3

In the Edit magg<ID> window, it is possible to change all available settings.

4

Click OK.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Select a MAGG interface and click Delete.

3

Click OK, when the confirmation message shows.

Configuring MAGG Interfaces in Gaia Clish

Important - On Scalable Platforms (Maestro and Chassis), you must run the applicable commands in Gaia gClish of the applicable Security Group.

Step

Instructions

1

Make sure that the physical subordinate interfaces do not have IP addresses.

2

Add a new management bonding group.

3

Set the state of the physical subordinate interfaces to UP.

4

Add subordinate interfaces to the management bonding group.

5

Configure the management bond operating mode.

6

Configure other bond parameters: media monitoring, and delay rate.

7

Examine the management bonding group configuration.

Syntax

Syntax

add bonding group <Bond Group ID> mgmt

Example

gaia> add bonding group 777 mgmt

Note - Do not change the state of bond interface manually using the "set interface <Bond ID> state" command. This is done automatically by the bonding driver.

Syntax

set interface <Name of Subordinate Interface eth<X>-Mgmt<Y>> state on

add bonding group <Bond Group ID> mgmt interface <Name of Subordinate Interface eth<X>-Mgmt<Y>>

Important - Make sure that the subordinate interfaces, which you wish to add to the Bonding Group, do not have IP addresses.

Example

gaia> set interface eth1-Mgmt1 state on

gaia> set interface eth2-Mgmt1 state on

gaia> add bonding group 777 mgmt interface eth1-Mgmt1

gaia> add bonding group 777 mgmt interface eth2-Mgmt1

Notes:

  • The subordinate interfaces must not have IP addresses assigned to them.

  • The subordinate interfaces must not have aliases assigned to them.

  • A bond interface can contain between two and eight subordinate interfaces.

Syntax

set bonding group <Bond Group ID>
      mode active-backup
      mode xor xmit-hash-policy {layer2 | layer3+4}
      8023AD [lacp-rate {slow | fast}]
      [up-delay <0-5000>]
      [down-delay <0-5000>]
      [mii-interval <1-5000>]

Bond operating mode specifies how subordinate interfaces are used in a bond interface.

Syntax

set bonding group <Bond Group ID>
      active-backup [primary <Name of Subordinate Interface>]
      mode xor xmit-hash-policy {layer2 | layer3+4}
      8023AD [lacp-rate {slow | fast}]

Notes:

  • The MAGG interface supports only these bond modes: 802.3AD (802.1AX LACP), Active-Backup, or XOR.

  • The Active-Backup mode supports configuration of the primary subordinate interface.

  • The XOR mode requires the configuration of the transmit hash policy.

  • The 802.3AD (LACP) mode supports the configuration of the LACP packet transmission rate.

Examples

gaia> set bonding group 1 mode active-backup primary eth1-Mgmt1

gaia> set bonding group 1 mode xor xmit-hash-policy layer3+4

gaia> set bonding group 1 mode 8023AD lacp-rate fast

The Up-Delay specifies show much time in milliseconds to wait before enabling a subordinate interface after link recovery was detected.

Syntax

set bonding group <Bond Group ID> up-delay <0-5000>

Example

gaia> set bonding group 1 up-delay 100

Note - The default up-interval value is 200 ms.

The Down-Delay specifies how much time in milliseconds to wait before disabling a subordinate interface after link failure was detected

Syntax

set bonding group <Bond Group ID> down-delay <0-5000>

Example

gaia> set bonding group 1 down-delay 100

Note - The default down-interval value is 200 ms.

The Media Monitoring Interval specifies how much time in milliseconds to wait before checking the link on subordinate interfaces for a failure.

Syntax

set bonding group <Bond Group ID> mii-interval <1-5000>

Example

gaia> set bonding group 1 mii-interval 100

Note - The default mii-interval value is 100 ms.

You can configure the minimum number of required interface links for a bonding group in the 802.3AD mode.

If fewer subordinate interfaces in a bonding group have their link in the "up" state, the Gaia changes the state of the bonding group to "down".

Syntax

set bonding group <Bond Group ID> min-links <0-8>

Example

gaia> set bonding group 1 min-links 2

Note - The default "min-links" value is 0. With this value, the minimum number of required subordinate interfaces that must stay in the "up" state in a bond of N subordinate interfaces is N-1.

Syntax

delete bonding group <Bond Group ID> [interface <Interface Name> | force-ignore-routes]

Example

gaia> delete bonding group 777 interface eth2-Mgmt1

Note - You must delete all non-primary subordinate interfaces before you remove the primary subordinate interface.

Syntax

delete bonding group <Bond Group ID> interface <Name of Subordinate Interface 1>

delete bonding group <Bond Group ID> interface <Name of Subordinate Interface 2>

delete bonding group <Bond Group ID> interface <Name of Subordinate Interface ...>

delete bonding group <Bond Group ID> interface <Name of Subordinate Interface N>

delete bonding group <Bond Group ID>

Example

gaia> delete bonding group 777

Notes:

  • You must delete all non-primary subordinate interfaces before you remove the primary subordinate interface.

  • You must delete all subordinate interfaces from the bonding group before you remove the bonding group.

  • Do not change the state of bond interface manually using the "set interface bondID state" command.

    This is done automatically by the bonding driver.

Syntax

show bonding {group <Bond Group ID> | groups}

Parameters

Parameter

Description

<Bond Group ID>

Configures the Bond Group ID.

  • Range: 0 - 1024

  • Default: No default value

<Name of Subordinate Interface>

Specifies the name of the subordinate physical interface, which you add to (or remove from) the bond group.

Make sure that the subordinate interfaces do not have any IP addresses or aliases configured.

mode <Mode>

Configures the Bond operating mode (see Bond Interfaces (Link Aggregation)).

The MAGG interface only support the Active/Backup or the XOR mode:

  • active-backup [primary <Name of Subordinate Interface>]

    Bond uses one subordinate interface at a time (High Availability)

  • xor xmit-hash-policy {layer2 | layer3+4}

    Bond uses subordinate interfaces based on a hash function (High Availability + Load Sharing)

  • 8023AD [lacp-rate {slow | fast}]

    Dynamic bonding according to IEEE 802.3ad - LACP (Load Sharing)

primary <Name of Subordinate Interface>

Specifies the name of the primary subordinate interface in the bond.

By default, the first subordinate interface added to the bond group, becomes the primary.

Note - Applies only to the Active-Backup bond mode.

up-delay <0-5000>

Specifies the time in milliseconds to wait before enabling a subordinate interface after link recovery was detected.

  • Range: 0 - 5000 ms

  • Default: 200 ms

down-delay <0-5000>

Specifies the time in milliseconds to wait before disabling a subordinate interface after link failure was detected.

  • Range: 0 - 5000 ms

  • Default: 200 ms

mii-interval <1-5000>

Specifies the time in milliseconds to wait before checking the link on subordinate interfaces for a failure.

  • Range: 1 - 5000 ms

  • Default: 100 ms

xmit-hash-policy {layer2 | layer3+4}

Specifies the algorithm to use for assigning the traffic to Active subordinate interfaces:

  • layer2 - Based on the XOR of hardware MAC addresses

  • layer3+4 - Based on the IP addresses and Ports

Note - Applies only to the XOR bond mode.

Examples

gaia> set interface eth1-Mgmt1 state on
gaia> set interface eth2-Mgmt1 state on
gaia> add bonding group 1 mgmt
gaia> add bonding group 1 mgmt interface eth1-Mgmt1
gaia> add bonding group 1 mgmt interface eth2-Mgmt1
gaia> set bonding group 1 mode active-backup primary eth1-Mgmt1
gaia> show bonding group 1
Bond Configuration
    xmit-hash-policy Not configured
    down-delay 200
    primary eth1-Mgmt1
    lacp-rate Not configured
    mode active-backup
    up-delay 200
    mii-interval 100
    Bond Interfaces
        eth1-Mgmt1
        eth2-Mgmt1
gaia>
 
gaia> set interface eth1-Mgmt1 state on
gaia> set interface eth1-Mgmt1 state on
gaia> add bonding group 1 mgmt
gaia> add bonding group 1 mgmt interface eth1-Mgmt1
gaia> add bonding group 1 mgmt interface eth2-Mgmt1
gaia> set bonding group 1 mode xor xmit-hash-policy layer3+4
gaia> show bonding group 1
Bond Configuration
    xmit-hash-policy layer3+4
    down-delay 200
    primary Not configured
    lacp-rate Not configured
    mode xor
    up-delay 200
    mii-interval 100
    Bond Interfaces
        eth1-Mgmt1
        eth2-Mgmt1
gaia>