> Source: [sk1000168](https://support.checkpoint.com/results/sk/sk1000168)

# sk1000168 - Maestro Security Group loses connectivity after an additional Security Group Member becomes active

| Property | Value |
|----------|-------|
| Solution ID | sk1000168 |
| Date Created | 2026-09-18 |
| Last Modified | 2026-10-04 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R81.20 |
| OS | Gaia |
| Platform | Maestro Orchestrator |

## Symptoms

- * Traffic stops immediately after a second **Security Group Member (SGM)** becomes active in a Maestro VSX Security Group.
* The issue occurs only when both SGMs actively process traffic.
* Traffic distribution is approximately 50/50 between the SGMs before connectivity is lost.
* Connectivity returns when the second SGM is removed from active traffic processing.
* The second SGM successfully learns the server MAC address. ARP traffic from the server is visible on the relevant bond VLAN interface, but traffic is not processed correctly.

## Cause

<br />

The Maestro Security Group uses an unsupported **Link Aggregation Control Protocol (LACP)** topology.  

The bond contains 16 slave interfaces, which exceeds the supported maximum of eight slave interfaces for this design.  

In addition, the bond connects to two independent physical switches. The switches are not configured as a single logical switch by using **Virtual Port Channel (vPC)**, stacking, or an equivalent multi-chassis link aggregation technology. As a result, each switch appears as a different LACP partner.  

Because the bond receives different Aggregator IDs from different LACP partners, the same set of slave interfaces cannot become active on all SGMs. When only one SGM is active, traffic uses the active bond path for that member and connectivity appears normal.  

When a second SGM becomes active, it uses a different active portion of the bond associated with the other switch. This creates inconsistent bond paths between SGMs and causes traffic loss.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content