> Source: [sk182023](https://support.checkpoint.com/results/sk/sk182023)

# sk182023 - Management Server cannot connect to Maestro Security Groups through the dedicated Mgmt port on the Orchestrator

| Property | Value |
|----------|-------|
| Solution ID | sk182023 |
| Date Created | 2024-02-26 |
| Last Modified | 2025-01-16 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |
| Platform | Maestro Orchestrator |

## Symptoms

- * Policy installation fails on a Maestro Security Group.

* Traffic does not pass between the Management Server and the dedicated 'Mgmt' port on the Orchestrator, although all cables are connected between the Management Server, switches, and the dedicated 'Mgmt' port on the Orchestrator.

* Gaia Portal and Gaia Clish ("`show interface Mgmt1`") on the Orchestrator show that the dedicated 'Mgmt' port is up.

* The relevant command on the involved switches shows that the required ports are up.

* Output of the Expert mode command "`orch_stat -p`" on the Orchestrator shows that the dedicated 'Mgmt' port is plugged, but its state and its link are down.

  Example output (truncated):

  ```
  
  [Expert@MyOrch:0]# orch_stat -p
  
  Ports Status
  +---------------+----------------+-----------+-----+-----------+-------------+------------+-------------------+-
  | Physical Port | Interface Name | Type      | SG  | QSFP Mode | Admin State | Link State | Transceiver State | 
  +---------------+----------------+-----------+-----+-----------+-------------+------------+-------------------+-
  | 1/1/1         | eth1-Mgmt1     | Mgmt      | 1   | 10G       | DOWN        | DOWN       | PLUGGED           | 
  +---------------+----------------+-----------+-----+-----------+-------------+------------+-------------------+-
  ```

* Output of the Expert mode command "`mlxlink`" on the Orchestrator shows "`The port is closed by command. Please check that the interface is enabled`".

  * On the MHO-175 model, run:

    `mlxlink -d /dev/mst/mt53100_pci_cr0 -p <Number of Physical Port> -m`
  * On the MHO-140 / MHO-170 models, run:

    `mlxlink -d /dev/mst/mt52100_pci_cr0 -p <Number of Physical Port> -m`

  Example output (truncated) from MHO-140 / MHO-170 models:

  ```
  
  [Expert@MyOrch:0]# mlxlink -d /dev/mst/mt52100_pci_cr0 -p 1 -m
  
  Operational Info
  ----------------
  State                           : Disable
  Physical state                  : ETH_AN_FSM_ENABLE
  Speed                           : N/A
  Width                           : N/A
  FEC                             : N/A
  Loopback Mode                   : N/A
  Auto Negotiation                : ON
  
  Supported Info
  --------------
  ...
  
  Troubleshooting Info
  --------------------
  Status Opcode                   : 1
  Group Opcode                    : PHY FW
  Recommendation                  : The port is closed by command. Please check that the interface is enabled.
  
  ...
  ```

* Output of the Gaia Clish command "`show maestro port <Port ID> optic-info`" on the Orchestrator shows that the involved transceiver is supported.

  Example:

  ```
  
  MyOrch> show maestro port 1/1/1 optic-info
  
  Physical Port: 1/1/1
  Vendor name: XXX
  Serial Number: SFP-1GB-T-CP
  Check Point Part Number: XXX
  Enforcement: Supported
  Check Point SKU: CPAC-TR-1T,CPAC-TR-1T-B
  Material ID: XXX,XXX
  Product Type: 1000Base-CU
  Speed: 1G
  ```

## Cause

The administrative state of the corresponding port on the Orchestrator is "down".

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content