Configuring Bond Interface on the Management Ports of a Maestro Security Group

Important - If this Security Group is configured in the Traditional VSX mode, follow this workflow:

  1. In Gaia gClish, temporarily disable the Traditional VSX mode:

    set vsx off

  2. Configure a Bond Interface on the Management Ports as described below.

  3. In Gaia gClish, enable the Traditional VSX mode:

    set vsx on

Note - You can perform Steps 2 - 5 in either Gaia Portal (see Configuring Security Groups in Maestro in Gaia Portal), or Gaia Clish (see Configuring Security Groups in Maestro in Gaia Clish).

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Create a new Security Group:

  1. In the Network settings section, enter a dummy IP address configuration.

  2. Configure the First Time Wizard settings.

3

Assign two available management interfaces ethM-MgmtX and ethN-MgmtY to the Security Group.

4

Assign the applicable Security Appliances to the Security Group.

5

Assign the applicable Uplink ports to the Security Group.

6

Connect through the console port to the Security Appliance with Member ID 1 in this Security Group.

7

Log in to the Expert mode.

8

Go to the Gaia gClish:

gclish

9

Check which eth#-Mgmt# interface has the IP address you assigned to the Security Group.

In our example, we assume it is ethM-MgmtX.

10

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

11

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

12

Assign the real IP address (you wish to use for this Security Group) to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

13

Set the Bonding group as the new Gaia Management Interface:

set management interface magg<Bond ID>

14

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

15

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

16

Connect to one of the Quantum Maestro Orchestrators.

17

Make sure the Security Group settings are correct.

18

In a web browser, connect to the Management IP address of the Security Group and complete the First Time Configuration Wizard manually.

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Assign a second available management interface ethN-MgmtY to the Security Group.

You can perform this step in Gaia Portal (see Configuring Security Groups in Maestro in Gaia Portal), or Gaia Clish (see Configuring Security Groups in Maestro in Gaia Clish).

In our example, we assume that the interface ethM-MgmtX is already assigned.

3

Connect through the console port to the Security Appliance with Member ID 1 in this Security Group.

4

Log in to the Expert mode.

5

Go to the Gaia gClish:

gclish

6

Change the IP address on the ethM-MgmtX interface to some dummy IP address:

set interface ethM-MgmtX ipv4-address <Dummy IPv4 Address> mask-length <Mask Length>

7

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

8

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

9

Assign the real IP address to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

10

Set the Bonding group as the new Gaia Management Interface:

set management interface magg<Bond ID>

11

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

12

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

13

Connect to one of the Quantum Maestro Orchestrators.

14

Make sure the Security Group settings are correct.

15

On the Management Server, update the topology of interfaces in the corresponding Security Gateway object.

If this Security Group is configured in the Gateway mode of VSNext mode:

  1. From the left navigation panel, click Gateways & Servers.

  2. Open the Security Gateway object.

  3. From the left tree, click Network Management.

  4. Click Get Interfaces > Get Interfaces With Topology.

  5. Examine the configuration and accept it.

  6. Click OK.

  7. Install the applicable Access Control Policy.

If this Security Group is configured in the Traditional VSX mode:

  1. Connect to the command line on the Management Server.

  2. On a Multi-Domain Security Management Server, go to the context of the applicable Domain Management Server:

    mdsenv <IP Address or Name of Domain Management Server>

  3. Run this command and follow the instructions on the screen:

    vsx_util change_interfaces

    For infromation about this command, see the R82 VSX Administration Guide.