sk181385 - Connectivity issues may occur in a Maestro Security Group when VLAN encapsulation is disabled on Orchestrators in Maestro Dual Site environment
Connectivity issues may occur in a Maestro Security Group when VLAN encapsulation is disabled on Orchestrators in Maestro Dual Site environment
Product: Maestro HyperScale Firewall
Version: R81.10 (EOS), R81.20, R82, R82.10
OS: Gaia
Last Modified: 2026-03-09
Symptoms
- Connectivity issues may occur in a Maestro Security Group in the following scenario:
Maestro Dual Site environment with 2 Orchestrators on each Site
VLAN encapsulation is disabled on all Maestro Orchestrators with the Clish command:
set maestro configuration security-appliances inter-site vlan encapsulation disabled
Connectivity issues may include:
- Traffic drops with the reason "First packet isn't SYN"
- Packet drops with the reason "Local interface address spoofing" for the subnet 192.0.2.*
- MAC Address flapping on the external switches connected to Maestro Uplinks
- Connectivity issues between Maestro Security Group Members
Cause
Network loop between the Site-sync ports of the two Maestro Orchestrators on the same site:
Solution
We're here for you
Please log in / sign in to view solution
Article Properties
Access Level: Advanced
Status: Approved
Date Created: 2023-08-10
Last Modified: 2026-03-09