156-836: Check Point Certified Maestro Expert - R81.X

The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration. LLDP can help to discover the topology and connectivity of the Maestro environment.

Reference

* Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9

* Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: LLDP, page 3-9

According to the Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-175 document1, ports 1 - 4 are Management ports that are used to connect the MHO to the customer's management infrastructure, such as SmartConsole or SmartDomain Manager. Ports 5 - 26 are Uplink ports that are used to connect the MHO to the customer's network infrastructure, such as switches, routers, or firewalls. Ports 27 - 47 are Downlink ports that are used to connect the MHO to the Security Group Modules (SGMs) in the Security Group. Ports 49 - 55 are Backplane ports that are used to connect the MHO to another MHO in a Dual Orchestrator environment.

* Maestro Expert (CCME) Course - Check Point Software, page 42

* Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline3

* Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-1751

The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.

* Maestro Expert (CCME) Course - Check Point Software, page 71

* Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

One of the possible reasons for the ''Failed to get remote orchestrator interfaces'' error message, when clicking on ''Orchestrator'' in WebUI, is that the remote orchestrator has no empty interfaces that can be assigned to a security group. This can happen if all the interfaces on the remote orchestrator are already part of configured security groups, or if the remote orchestrator has no physical interfaces at all. In this case, the WebUI cannot display the unassigned interfaces of the remote orchestrator, and shows the error message.

Reference

* Not able to see unassigned interfaces on checkpoint Orchestrator

* Maestro 140 not detecting Interfaces

* Maestro Expert (CCME) Course - Check Point Software, page

One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.

Reference

* Maestro Expert (CCME) Course - Check Point Software, page 251

* CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22

* Check Point Certified Maestro Expert (CCME) R81.X, page 23