Check Point 16600HS Maestro Security Gateway Datasheet
Quantum 16600 Hyperscale
Security Gateway for Maestro
Top Security Effectiveness
Check Point #1 for the 3rd year in a row with 99.9% malware block rate in Miercom Enterprise & Hybrid Mesh Firewall Report 2025 Benchmark
Hyperscale Network Security
On-demand expansion and resilient access to mission-critical applications
Named a Leader in the Forrester Wave
Enterprise Firewalls Q4 2022
Awarded the Frost & Sullivan Firewall Company of the Year
Unified Management and Ops Efficiency
Increase protection and reduce TCO with a consolidated security architecture
Industry Recognition
Named a Leader for the 23rd time in the Gartner® Magic Quadrant for Network Firewalls
Named a Leader in the Forrester Wave
Scalable, resilient AI Deep Learning powered threat prevention
The Maestro hyperscale network security solution orchestrates multiple Quantum firewalls as one unified system, with seamless and near limitless scaling. Bring scale, agility and elasticity of the cloud on premises with efficient N+1 clustering based on Check Point HyperSync technology.
Maestro Hyperscale Orchestrators distribute internal and external network traffic equally across multiple 16600 firewalls managed as a single group with a common security feature set and policy. With Maestro, businesses of all sizes can have cloud scale and agility with datacenter resiliency — all while maximizing cost efficiency.
PERFORMANCE HIGHLIGHTS
Firewall Next Gen Firewall
HIGH PERFORMANCE, SCALABLE SECURITY
16600 Hyperscale Security Gateway
- Sync 10/100/1000 Base-T port
- RJ45 console port
- 2x 100 GbE QSFP28 ports
- USB Type-C console port
With Maestro, you can start with two gateways and then can grow to up to 52 gateways. For example, when you start with 35.2 Gbps using two 16600HS gateways you can finish with an 850 Gbps security solution that supports over 500 million concurrent connections. Simply by using Check Point Maestro.
Hyperscale Security System
With Maestro, you can start with two gateways and then can
Connection C
When a Security Group is created, an IP address is created for a Single Management Object connection to the security management server. Easily create and assign IP addresses to the internal and external network interfaces. These uplinks are the visible components of the Maestro security solution.
- Lights-out Management port
- Management 10/100/1000 Base-T port
- 2x USB 3.0 ports
- Redundant hot-swap power supplies
Cost- Efficient N+1 Deployments
Now businesses of all sizes can enjoy cloud-level resiliency and telco-grade technology using the efficient Maestro N+1 clustering design.
SPECIFICATIONS
Performance
Enterprise Test Conditions
| Threat Prevention (Gbps)¹ | 17.6 |
|---|---|
| NGFW (Gbps)² | 30 |
| IPS (Gbps) | 42 |
| Firewall (Gbps) | 87 |
RFC 3511, 2544, 2647, 1242 Performance (Lab)
| Firewall 1518B UDP (Gbps) | 117 |
|---|---|
| VPN AES-128(Gbps) | 17 |
| Connections/sec | 375,000 |
| Concurrent connections | 32M |
- Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection
Additional Features
• 2x 100 GbE QSFP28 ports
Highlights
• 2x CPUs, 24 physical cores, 48 virtual cores
• 1x 480 GB storage
• 128 GB memory
• Virtual Systems: up to 250
Content Security
First Time Prevention Capabilities
• File disarm and reconstruction via Threat Extraction • Average emulation time for unknown files that require full sandbox evaluation is under 100 seconds • Maximal file size for Emulation is 100 MB • Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid, Terminal Servers and with 3rd parties via a Web API • Emulation OS Support: Windows XP, 7, 8.1, 10
Applications
• Enforce consistent policy for local and remote users on Windows, macOS, Linux, Android and Apple iOS platforms
Network
• Total physical and virtual (VLAN) interfaces per appliance: 1024/4096 (single gateway/with virtual systems)
Network Connectivity
• 802.3ad passive and active link aggregation
High Availability
• Active/Active L2, Active/Passive L2 and L3
• Session failover for routing change, device and link failure
IPv6
• Unicast and Multicast Routing (see SK98226)
• NAT66
• CoreXL, SecureXL
• OSPFv2, BGP, RIP
• Static routes, Multicast routes
• Policy-based routing
• PIM-SM, PIM-DM, IGMP v2, and v3
Maestro Maximums
• Up to 8 Security Groups
• Up to 28 gateways in a Security Group (dual site deployment, 14 from each site)
• 32x 100 GbE ports or 128x 10GbE (MHO 175)
Physical
• Operating: 0° to 40°C, humidity 5% to 95%
Environmental Conditions
• Safety: UL, CB, CE, TUV GS
• Environmental: RoHS, WEEE, REACH, ISO14001 factory certificate
ORDERING QUANTUM 16600HS MAESTRO SOLUTION S
MAESTRO HYPERSCALE SOLUTION PACKAGES
| MAESTRO HYPERSCALE SOLUTION PACKAGES | SKU |
|---|---|
| Maestro Solution with 2x16600HS firewalls and 1xOrchestrator(MHO-175), includes SandBlast(SNBT) Security Subscription Package for 1 Year. Each appliance includes 2x1GbE copper on-board, 2x100GbE QSFP28 ports, 2x AC PSUs, 1x 480GB SSD, 128GB RAM, telescopic rails, plus 2x100G DAC cables (3m, 3m). MHO-175 includes 1x100G DAC (3m). | CPAP-SG16602-HS-MHS-MH0175-SNBT |
| Maestro Solution with 3x16600HS firewalls and 1xOrchestrator(MHO-175), includes SandBlast(SNBT) Security Subscription Package for 1 Year. Each appliance includes 2x1GbE copper on-board, 2x100GbE QSFP28 ports, 2x AC PSUs, 1x 480GB SSD, 128GB RAM, telescopic rails, plus 2x100G DAC cables (3m, 3m). MHO-175 includes 1x100G DAC (3m). | CPAP-SG16603-HS-MHS-MH0175-SNBT |
SECURITY GATEWAY APPLIANCES FOR SCALE-UP
SECURITY GATEWAY ACCESSORIES
16600HS security gateway for Maestro, SandBlast subscription for the first year, includes 2x 1GbE copper on-board, 2x 100GbE QSFP28 ports, 2x AC PSUs, 1x 480GB SSD, 128 GB RAM, plus 2x 100 G DAC cables (3m, 3m).
SECURITY GATEWAY ACCESSORIES SKU
| SECURITY GATEWAY ACCESSORIES | SKU |
|---|---|
| 100G QSFP28 Direct Attach Copper(DAC) cable, 3 meters | CPAC-DAC-100G-3M |
| 40G QSFP+ Direct Attach Copper(DAC) cable, 3 meters | CPAC-DAC-40G-3M |
| Replacement 16GB RAM memory module for 16600 and 28600 Security Gateway | CPAC-RAM16GB-16/28K-HS |
| Replacement AC power supply for 16600HS, 26000, 28000, 28600HS Security Gateways | CPAC-PSU-AC-26000/28000 |
| Dual DC power supplies for 16000, 26000, 28000 Security Gateways | CPAC-PSU-DC-Dual-16000/26000/28000 |
| DC power supply for 16000, 26000, 28000 Security Gateways | CPAC-PSU-DC-16000/26000/28000 |
| Lights-Out Management Module | CPAC-NLOM-C |
| Extended slide rails for 16600 Security Gateways(24”-36”) | CPAC-RAIL-EXT-L |
MAESTRO HYPERSCALE ORCHESTRATOR
| MAESTRO HYPERSCALE ORCHESTRATOR | SKU |
|---|---|
| Maestro Hyperscale Orchestrator 175 with 32x 100 GbE ports, plus 1x 100 G DAC cable (3m). | CPAP-MHO-175 |
| MAESTRO HYPERSCALE ORCHESTRATOR ACCESSORIES | SKU |
| Fan replacement for Maestro Hyperscale Orchestrator 175 | CPAC-FAN-MHO175 |
| AC power supply unit replacement for Maestro Hyperscale Orchestrator 140 and 175 | CPAC-PSU-AC-MHO140/175 |
| Rail kit for Maestro Hyperscale Orchestrators 140 and 175 | CPAC-RAIL-MHO140/175 |
MAESTRO HYPERSCALE ORCHESTRATOR ACCESSORIES
MHO-175 TRANSCEIVERS
| MHU-173 TRANSCEIVERS | SKU |
|---|---|
| 100G CWDM4, LC connector, 2Km/single mode fiber | CPAC-TR-100CWDM4 |
| 100G SWDM4, LC connector, 75m/OM3 fiber | CPAC-TR-100SWDM4 |
| QSFP28 transceiver module for 100G fiber ports - short range [100GBase-SR4] | CPAC-TR-100SR |
| QSFP28 transceiver module for 100G fiber ports - long range [100GBase-LR4] | CPAC-TR-100LR |
| QSFP+ transceiver for 40G fiber Ports - short range [40GBase-SR] OM3 fiber 100m, OM4 fiber 150m | CPAC-TR-40SR-QSFP-100m |
| QSFP+ transceiver module for 40G fiber ports - short range [40GBase-SR] | CPAC-TR-40SR-QSFP-300m |
| QSFP+ transceiver module for 40G fiber ports - long range [40GBase-LR] | CPAC-TR-40LR-QSFP-10Km |
| Bi-directional QSFP transceiver for 40G fiber Ports - short range [40GBase-SR-BD] | CPAC-TR-40SR-QSFP-BIDI |
| QSFP+ splitter for 40G fiber ports for Maestro (MH0140 and MH0175) - 3 meters | CPAC-TR-40SPLIT-QSFP-3M** |
| QSFP+ splitter for 40G fiber ports for Maestro (MH0140 and MH0175) - 6 meters | CPAC-TR-40SPLIT-QSFP-6M** |
| SFP28 transceiver module for 100G fiber ports - short range [25GBase-SR SFP28] | CPAC-TR-25SR-C |
| SFP28 transceiver module for 100G fiber ports - long range [25GBase-LR SFP28] | CPAC-TR-25LR-C |
| SFP+ transceiver module for 10G fiber ports - for links up to 40km (10GBASE-ER) | CPAC-TR-10ER-C |
| SFP+ transceiver module for 10G fiber ports - long range [10GBase-LR] | CPAC-TR-10LR-C |
| SFP+ transceiver module for 10G fiber ports - short range [10GBase-SR] | CPAC-TR-10SR-C |
| SFP+ transceiver 10GBASE-T RJ45(Copper)-for links up to 30m over CAT6a/CAT7 | CPAC-TR-10T-C |
| SFP transceiver module for 1G fiber ports - short range [1000Base-SX] | CPAC-TR-1SX-C |
| SFP transceiver module for 1G fiber ports - long range [1000Base-LX] | CPAC-TR-1LX-C |
| SFP transceiver to 1000 Base-T RJ45(Copper) | CPAC-TR-1T-C |
- In the R81.20 software release and later, the MHO-140 1/10G interfaces support 25G transceivers, ** It is recommended to use the CPAC-TR-40SR-QSFP-100m when using the splitters CPAC-TR-40SPLIT-QSFP-3M or CPAC-TR-40SPLIT-QSFP-6M
ORDERING MAESTRO SOLUTIONS ( Continued)
All-inclusive Security: Each gateway requires a license for the enabled security feature. The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP and SNBT are available for subsequent years.