> Source: [sk184679](https://support.checkpoint.com/results/sk/sk184679)

# sk184679 - Intermittent traffic disruption on two MHOs in a Maestro environment 

| Property | Value |
|----------|-------|
| Solution ID | sk184679 |
| Date Created | 2026-02-13 |
| Last Modified | 2026-02-17 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |
| Platform | Maestro Orchestrator |

## Symptoms

- * Intermittent traffic disruption observed on two MHOs in a Maestro environment.

* Firewall logs show repeated drops from a specific SGM.

* The */var/log/maestro.log* file shows a mismatch matrix on two MHOs:  

  MHO1: `[Date, Time] < orchestrator_hostname> tor_util: debug: lock: Lock was acquired(tor_util set_sg_sgms <group_info>) [Date, Time] <orchestrator_hostname> tor_util: debug: build_external_mlx_dist_mtx: new ssm mtx 1,2,3,1,3,2`  

  MHO2: `[Date, Time] < orchestrator_hostname> tor_util: debug: remove_gw_rsrcdb_down_downlinks: Serial LR202407010574 downlink 73 state up [Date, Time] < orchestrator_hostname>`

* The */var/log/maestro.log* file shows downlink port flaps between the problematic SGM and one MHO:   


  `[Date, Time] < orchestrator_hostname> kernel:sx_netdev_handle_pude_event: Called for logical port - 10900 status DOWN `  
  `
  [Date, Time]< orchestrator_hostname> kernel:sx_netdev_handle_pude_event: Called for logical port - 10D00 status DOWN `  
  `
  [Date, Time] < orchestrator_hostname> kernel:sx_netdev_set_lag_oper_state: Called for lag_id 5 status UP `  
  `
  [Date, Time] < orchestrator_hostname> kernel:sx_netdev_handle_pude_event: Called for logical port - 10900 status UP`

* The */var/log/maestro.log* file shows different updates on the two MHOs:  


  MHO1: `The last update received was of all sgms being active.
  [Date, Time] < orchestrator_hostname> tor_util: debug: lock: Lock was acquired(tor_util set_sg_sgms 1 1 1_2 1_1,1_2,1_3 )
  [Date, Time] < orchestrator_hostname> tor_util: debug: lock: Lock was acquired(tor_util set_sg_sgms 1 1 1_1,1_2,1_3 1_1,1_2,1_3 )
  The last update received was of all sgms being active.`  


  MHO2: `The last update received was of 1_2 being the only active sgm.
  [Date, Time] < orchestrator_hostname> tor_util: debug: lock: Lock was acquired(tor_util set_sg_sgms 1 1 1_1,1_2,1_3 1_1,1_2,1_3 ) 
  [Date, Time] < orchestrator_hostname> tor_util: debug: lock: Lock was acquired(tor_util set_sg_sgms 1 1 1_2 1_1,1_2,1_3 ) 
  The last update received was of 1_2 being the only active sgm.`

* Issue resolved after rebooting the problematic MHO2, matrix aligned and drop logs stopped.

## Cause

A timing?related update condition occurred during downlink port flapping between MHO2 and SGM 1.2.  
Because connectivity to other SGMs was briefly lost, SGM 1.2 temporarily reported itself as the only active member.  
After connectivity was restored, updated information indicating all SGMs were active was sent.  
However, due to a timing overlap, MHO2 processed the outdated "SGM 1.2 only" update after the correct update.  
This led MHO2 to recalculate an incorrect distribution matrix, resulting in a matrix mismatch between MHO1 and MHO2.  
The mismatch persisted until MHO2 was rebooted.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

**Workaround** :  

1. Reboot MHO2 to realign the distribution matrix.
2. Run `distutil update` to synchronize the distribution matrix on both MHOs.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content