> Source: [sk168092](https://support.checkpoint.com/results/sk/sk168092) # sk168092 - Maestro Dual Site configuration with a direct connection through L2 switches | Property | Value | |----------|-------| | Solution ID | sk168092 | | Date Created | 2020-07-20 | | Last Modified | 2026-02-16 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R82.10, R82, R81.20, R81.10 (EOS) | | OS | Gaia | ## Solution **Table of Contents:** * Introduction * Scenario # 1 - Direct connection between Orchestrators * Scenario # 2 - Two Orchestrators on the same site are connected to the remote site Orchestrators through two different switches * Scenario # 3 - Two Orchestrators on the same site are connected to the remote site Orchestrators through one switch * Disabling "QinQ" VLAN encapsulation for Site Sync * Important Notes * Testing Dual-Site infrastructure ### Introduction {#intro} > Refer to the [Quantum Maestro Getting Started Guide](https://sc1.checkpoint.com/documents/Appliances/GSG_Maestro/EN/Default.htm). > > There are three primary scenarios for Dual Site configuration: > > * Direct connectivity between Maestro Sites > > * Two Orchestrators on the same Maestro Site are connected to the Orchestrators on the remote Maestro Site through two different switches. > > * Two Orchestrators on the same Maestro Site are connected to the Orchestrators on the remote Maestro Site through one switch. > > If there is only one Orchestrator for each Maestro Site, and it is connected through switches, then Scenarios 2 and 3 are the same. > > #### Secured Networks > > It is critical to protect the Maestro Sites against both malicious and unintentional threats: > > * On each Security Appliance, each required network port must connect to Maestro Orchestrators with a direct able (without intermediate devices). > > * On the same Maestro site, the internal synchronization ports (known as "SYNC-INT" and "SSM_Sync") on both Orchestrators must connect to each other with a direct cable or must connect to an isolated dedicated network. > > * On the different Maestro sites, the external synchronization ports (known as "SYNC-EXT" and "Site_Sync") on the corresponding Orchestrators must connect to each other with a direct cable or must connect to an isolated dedicated network. > > #### Orchestrator Configuration > > To configure a Dual Site environment, configure these parameters on each Orchestrator in the environment: > > * **orchestrator-amount** - The number of Orchestrators on each Maestro Site (must be the same value on all Orchestrators). > > * **orchestrator-site-amount** - The number of Maestro Sites. > > * **orchestrator-site-id** - The Maestro Site ID, on which the local Orchestrator is located. > > * **orchestrator-site-vlan** (default = 3600) - The base VLAN ID for the inter-site VLAN ID calculation. The Orchestrators use this base value internally to calculate their external site-sync VLAN ID. It is calculated as "\ + 0" for the first Orchestrator, and "\" + 1 for the second Orchestrator on the same site. As a result, this parameter value must be the same on all Orchestrators in the setup. > > For example, if the "`orchestrator-site-vlan`" value is 3600, then this is the internal calculation of the Site Sync VLAN: > > |---------|-------|-------| > | Site | MHO 1 | MHO 2 | > | Site #1 | 3600 | 3601 | > | Site #2 | 3600 | 3601 | > > * **External Synchronization Port** (known as "SYNC-EXT" and "Site_Sync") - The Orchestrator port for external sync between Orchestrators on different Maestro Sites. > > #### Dual Site Sync Packets > > There are two categories of Sync packets in a Dual Site environment. > > * **Orchestrator Sync packets** - These Sync packets contain information about available and assigned resources on each site. Sync packets are transmitted from the "SYNC-EXT" / "Site_Sync" port with a single existing VLAN tag (by default: 3951 or 3952). > > * **Security Group Sync packets** - These packets are ClusterXL Sync packets between Security Group Members. Security Group Sync packets are transmitted from the "SYNC-EXT" / "Site_Sync" port with two existing VLAN tags. The inner tag is an internal VLAN associated with the specific Security Group. The outer tag is the Site VLAN (3600 or 3601, as explained above). > > Orchestrators use these VLAN IDs: > > |-----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | VLAN | Description | > | 3600 | Security Group Sync packets (outer tag) - synchronization between Security Group Members - between MHO 1_1 and MHO 2_1. By default, "QinQ" is enabled and encapsulates the VLAN ID 380\ in this VLAN ID 3600. | > | 3601 | Security Group Sync packets (outer tag) - synchronization between Security Group Members - between MHO 1_2 and MHO 2_2. By default, "QinQ" is enabled and encapsulates the VLAN ID 380\ in this VLAN ID 3601. | > | 380\ | Security Group Sync packets (inner tag) - synchronization between Security Group Members. You cannot change this VLAN to another ID, but you can follow [sk181385](https://support.checkpoint.com/results/sk/sk181385) to translate it to another VLAN ID. | > | 3951 | Orchestrator Sync packets - synchronization of Orchestrator configuration between MHO 1_1 and MHO 2_1. | > | 3952 | Orchestrator Sync packets - synchronization of Orchestrator configuration between MHO 1_2 and MHO 2_2. | > > #### External Switch Configuration > > If Orchestrators are connected through external switches, ports on the external switches must be configured accordingly. > > When Orchestrators run the version R81 and lower, your external switches **must** support 802.1ad ("QinQ") and allow packets with more than one VLAN tag. These external switches **must not** remove existing VLAN tags. > > When Orchestrators run the version R81.10 and higher, you can disable the 802.1ad ("QinQ") encapsulation. In this scenario, you must send over a VLAN Trunk all Security Group Sync packets with the inner VLAN IDs 380\ of all Security Groups between the Maestro Sites. You must follow [sk181385](https://support.checkpoint.com/results/sk/sk181385) to configure the required VLAN translation. > > If necessary, you can configure the external switch to add one more VLAN tag to the Dual Site Sync packets. If you do this, keep these requirements in mind: > > * Security Group Sync packets are transmitted from the "SYNC-EXT" / "Site_Sync" port with two existing VLAN tags. Adding one more VLAN tag causes the packet to have three VLAN tags. The external switches must not drop packets with more than two VLAN tags (otherwise, Dual Site does not work). > > * All Dual Site Sync packets must arrive at the other Maestro site in the same state in which they were transmitted. If you added an additional VLAN tag, the final switch must strip it before it is forwarded to the Orchestrator on the other site. > > * Each additional VLAN tag will increase the size of the packet. It may be necessary to increase the MTU the external switch for Dual Site to work correctly. > > Configure the ports on external switches as described below.
Show the Entire Article ### Scenario # 1 - Direct connection between Orchestrators {#scenarioone} Show / Hide this section > Example diagram for MHO-140: > > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk168092/dual-site-direct202007181615393.jpg) > > When you use a direct connection between Orchestrators, only a basic configuration is required on each Orchestrator: > > * `orchestrator-amount` = 1 or 2 > > * `orchestrator-site-amount` = 2 > > * `orchestrator-site-id`: > > * MHO 1_1 and MHO 1_2 = 1 > * MHO 2_1 and MHO 2_2 = 2 > * `orchestrator-site-vlan` > > default = 3600 > * `site_sync` port configuration > > Example: > `set maestro port 1/56/1 type site_sync` > `set maestro port 2/56/1 type site_sync` ### Scenario # 2 - Two Orchestrators on the same site are connected to the remote site Orchestrators through two different switches {#scenariotwo} Show / Hide this section > Example diagram for MHO-140: > > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk168092/dual-site-4-switches202007191019231.jpg) > > When you work with different switches (a different switch for each Orchestrator), the Orchestrator and the switch configuration are required. Switches **must** be transparent for double-tagged packets, but it **must not** modify the VLAN tags on Orchestrator Sync packets. > > ### Configuration of Orchestrators > > * `orchestrator-amount` = 1 or 2 > > * `orchestrator-site-amount` = 2 > > * `orchestrator-site-id`: > > * MHO 1_1 and MHO 1_2 = 1 > * MHO 2_1 and MHO 2_2 = 2 > > > > * `orchestrator-site-vlan` > > default = 3600 > * `site_sync` port configuration > > Example: > `set maestro port 1/56/1 type site_sync` > `set maestro port 2/56/1 type site_sync` > > ### Configuration of Switches (according to the diagram) > > * Port leading to MHO 1_1: VLAN trunk for VLAN IDs 3600, 3951 > > * Port leading to MHO 1_2: VLAN trunk for VLAN IDs 3601, 3952 > > * Port leading to MHO 2_1: VLAN trunk for VLAN IDs 3600, 3951 > > * Port leading to MHO 2_2: VLAN trunk for VLAN IDs 3601, 3952 > > * Link between Switches 1_1 and 2_1: VLAN trunk for VLAN IDs 3600, 3951 > > * Link between Switches 1_2 and 2_2: VLAN trunk for VLAN IDs 3601, 3952 ### Scenario # 3 - Two Orchestrators on the same site are connected to the remote site Orchestrators through one switch {#scenariothree} Show / Hide this section > Example diagram for MHO-140: > > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk168092/dual-site-2-switches202007191021102.jpg) > > When you work with the same switches for both Orchestrators at the same site, both the Orchestrator and the switch configuration are required. Switches **must** be transparent for double-tagged packets. However, it **must not** modify the existing VLAN tags on Orchestrator Sync packets. > > ### Orchestrators Configuration > > * `orchestrator-amount` = 1 or 2 > > * `orchestrator-site-amount` = 2 > > * `orchestrator-site-id`: > > * MHO 1_1 and MHO 1_2 = 1 > * MHO 2_1 and MHO 2_2 = 2 > * `orchestrator-site-vlan` > > default = 3600 > * `site_sync `port configuration > > Example: > `set maestro port 1/56/1 type site_sync` > `set maestro port 2/56/1 type site_sync` > > ### Switch Configuration (according to the diagram) > > * Port leading to MHO 1_1: VLAN trunk for VLAN IDs 3600, 3951 > > * Port leading to MHO 1_2: VLAN trunk for VLAN IDs 3601, 3952 > > * Port leading to MHO 2_1: VLAN trunk for VLAN IDs 3600, 3951 > > * Port leading to MHO 2_2: VLAN trunk for VLAN IDs 3601, 3952 > > * Link between Switches: VLAN trunk for VLAN IDs 3600, 3601, 3951, 3952 ### Disabling the "QinQ" VLAN encapsulation for Site Sync {#disable_encapsulation_site_sync} Show / Hide this section When Orchestrators run the version R81.10 or higher, you can disable the "QinQ" VLAN encapsulation for Site Sync (and use only one VLAN instead of two): 1. Connect to the command line on each Orchestrator. 2. In Gaia Clish, run: `set maestro configuration security-appliances inter-site vlan encapsulation disabled` `save config` 3. In the Expert mode, run: `orchd restart` 4. Follow [sk181385](https://support.checkpoint.com/results/sk/sk181385) to configure different VLANs for different Security Groups for each pair of Orchestrators. The effect of the procedure is that the Orchestrators do not encapsulate the Security Groups' Sync traffic, which is transmitted from the "SYNC-EXT" / "Site_Sync" port in the Site Sync VLAN (example: VLANs 3600 and 3601). Each Orchestrator transmits the Security Groups' Sync packets from the "SYNC-EXT" / "Site_Sync" port with VLAN IDs 3951 / 3952 / 380\, which means that these VLANs must be explicitly allowed in the external switch trunk port. ### Important Notes {#importantnotes} Show / Hide this section * If the Maestro Sites are connected through switches (and not directly), then the network between these Sites must be a secured trusted Layer 2 network (we recommend a dedicated / isolated network). * If you are using Cisco ACI infrastructure and you encounter packet loss on the inter-site sync network, refer to [sk184685](https://support.checkpoint.com/results/sk/sk184685). * All switches between Orchestrators (Scenarios # 2 and # 3) must support 802.1ad ("QinQ") and allow packets with more than one VLAN tag. It may be necessary to increase the MTU in the corresponding switch ports. When Orchestrators run the version R81.10 or higher, you can disable the "QinQ" VLAN encapsulation for Site Sync (and use only one VLAN ID instead of two VLAN IDs). See the section "Disabling "QinQ" VLAN encapsulation for Site Sync". * You can change the "`orchestrator-site-vlan`" value in Gaia Clish on the Orchestrators: `set maestro configuration orchestrator-site-vlan ` `save config` * Starting in R81.10, you can change the base VLAN IDs 3951 and 3952 with this Gaia Clish command on the Orchestrators: `set maestro configuration orchestrators base-vlan <3950 - 4000>` `save config` * The "SYNC-EXT" / "Site_Sync" ports on each Orchestrator belong to a XOR Link Aggregation Group ("LAG") that the Orchestrator creates automatically. You cannot see or change this link aggregation group with any Gaia Clish commands. To see this link aggregation group, use the "`orch_stat`" command in the Expert mode on the Orchestrator. ### Testing Dual Site infrastructure {#Testing Dual} Show / Hide this section > Connectivity between Orchestrators on different sites: > > * From MHO 1_1 run pings to MHO 2_1: `ping 203.0.113.15` > > * From MHO 1_2 run pings to MHO 2_2: `ping 203.0.113.16` > > > > If there is no ping, examine VLAN IDs 3951 and 3952. > > Connectivity between Orchestrators on the same site: > > * From MHO 1_1 run pings to MHO 1_2: `ping 192.0.2.2` > > * From MHO 2_1 run pings to MHO 2_2: `ping 192.0.2.16` > > > > If there is no ping, examine the cable between the "SYNC-EXT" / "Site_Sync" ports on Orchestrators on the same site. > > Connectivity between Security Group Members (appliances): > > * From SGM 1_1 run pings to SGM 2_1 on the sync network: `ping 192.0.2.15` > > > > If there is no ping, examine VLAN IDs 3600 and 3601.
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content