# Connectivity issues may occur in a Maestro Security Group when VLAN encapsulation is disabled on Orchestrators in Maestro Dual Site environment

**Product**: Maestro HyperScale Firewall  
**Version**: R81.10 (EOS), R81.20, R82, R82.10  
**OS**: Gaia  
**Last Modified**: 2026-03-09

## Symptoms

- Connectivity issues may occur in a Maestro Security Group in the following scenario:

1. Maestro Dual Site environment with 2 Orchestrators on each Site  
  2. VLAN encapsulation is disabled on all Maestro Orchestrators with the Clish command:
  
     ```
     set maestro configuration security-appliances inter-site vlan encapsulation disabled
     ```

- Connectivity issues may include:
  
  - Traffic drops with the reason "First packet isn't SYN"  
  - Packet drops with the reason "Local interface address spoofing" for the subnet 192.0.2.*  
  - MAC Address flapping on the external switches connected to Maestro Uplinks  
  - Connectivity issues between Maestro Security Group Members

## Cause

Network loop between the Site-sync ports of the two Maestro Orchestrators on the same site:

## Solution

We're here for you

Please log in / sign in to view solution

## Article Properties

**Access Level**: Advanced  
**Status**: Approved  
**Date Created**: 2023-08-10  
**Last Modified**: 2026-03-09

#### Haven't found what you're looking for?
##### Our customer support team is only a click away and ready to help you 24 hours a day.