Adding more than 250 VLANs on an Orchestrator MHO-175 Maestro Uplink interface causes intermittent traffic outages

Product: Maestro HyperScale Firewall
Version: R80.20SP (EOS), R81.10 (EOS), R81.20
OS: Gaia
Platform: Maestro Orchestrator
Last Modified: 2023-08-14

Symptoms

• Intermittent traffic outages may occur a few minutes after you add additional VLANs on an Orchestrator MHO-175 Uplink interface (that is assigned to the Maestro Security Group), or after a policy installation onto the Maestro Security Group.

Notes:

• There are more than 250 VLANs on an uplink interface that is assigned to the Security Group.
• Traffic on other uplink interfaces that have fewer than 250 VLANs passes as expected.
• Packet capture on the Security Group Members may not show incoming traffic that arrives through this Uplink interface.

Cause

Orchestrator incorrectly handles the newly created VLANs when there are more than 250 VLANs configured on the same uplink interface.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 26
• Jumbo Hotfix Accumulator for R81.10 starting from Take 95

If you choose not to upgrade, Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, collect these:

1. The CPinfo file from the Management Server.
2. The output of the "asg info" command from the Maestro Security Group.
3. The output of the "asg_provision" command from the Maestro Security Group.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

This workaround is available:

1. Connect to the command line on each Maestro Orchestrator on each Site in this environment.
2. Log in to the Expert mode.
3. Restart the orchd service:

service orchd restart

Warnings:

• No traffic flows through the Quantum Maestro Orchestrator until the 'orchd' service restarts.
• If you do not install the Hotfix, the issue will occur again when you add a VLAN and install policy.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.