> Source: [sk185110](https://support.checkpoint.com/results/sk/sk185110)

# sk185110 - How to enable forwarding of STP / BPDU packets through a bridge interface in a Maestro Security Group

| Property | Value |
|----------|-------|
| Solution ID | sk185110 |
| Date Created | 2026-06-29 |
| Last Modified | 2026-07-22 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Solution

### Overview

This feature configures a Maestro Orchestrator to forward Spanning Tree Protocol (STP) / BPDU packets that arrive at the Uplink and at the Management ports to a Maestro Security Group configured with a bridge interface.

Without this feature enabled, Maestro Orchestrators drop STP / BPDU packets that arrive at the Uplink and at the Management ports.

Example topology that shows how STP packets can pass between Switch "A" and Switch "B":

```
 [Network "A"]      [Network "B"]
      |                  |
      |                  |
  [Switch "A"]       [Switch "B"]
   [with STP]         [with STP]
      |                  |
      |                  |
 (Uplink or         (Uplink or)
  Mgmt port)         Mgmt port)
      |                  |
+------------------------------+
|     Maestro Orchestrator     |
+------------------------------+
              | |
         (Downlink ports)
              | |
        [Security Group]
    [with a Bridge interface]
```

### Availability

This feature is available starting from:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) - Take 36
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) - Take 118
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) - Take 158

### Important Notes

* You must perform these steps on each Maestro Orchestrator in the environment.  
  To minimize the traffic impact, configure one Maestro Orchestrator at a time.  
  This way, it is not necessary to schedule a full maintenance window.
* At this time, only the Line Card "CPAC-4-10/25F-DA" on Security Appliances was tested and certified for forwarding STP / BPDU packets.

### Configuration Instructions for each Maestro Orchestrator

1. Install the Jumbo Hotfix Accumulator on the Maestro Orchestrator and reboot.

   Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).
2. Connect to the command line on the Maestro Orchestrator.

3. Log in to the Expert mode.

4. Enable the BPDU forwarding:

   `jsont -f /etc/maestro.json -s /mho_stp_forward/state -v enabled`
5. Restart the daemon:

   `orchd restart`

   **Warning** - No traffic flows through the Maestro Orchestrator while this daemon is restarting.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content