sk185110 - How to enable forwarding of STP / BPDU packets through a bridge interface in a Maestro Security Group

How to enable forwarding of STP / BPDU packets through a bridge interface in a Maestro Security Group

Solution

Overview

This feature configures a Maestro Orchestrator to forward Spanning Tree Protocol (STP) / BPDU packets that arrive at the Uplink and at the Management ports to a Maestro Security Group configured with a bridge interface.

Without this feature enabled, Maestro Orchestrators drop STP / BPDU packets that arrive at the Uplink and at the Management ports.

Example topology that shows how STP packets can pass between Switch "A" and Switch "B":

 [Network "A"]      [Network "B"]
      |                  |
      |                  |
  [Switch "A"]       [Switch "B"]
   [with STP]         [with STP]
      |                  |
      |                  |
 (Uplink or         (Uplink or)
  Mgmt port)         Mgmt port)
      |                  |
+------------------------------+
|     Maestro Orchestrator     |
+------------------------------+
              | |
         (Downlink ports)
              | |
        [Security Group]
    [with a Bridge interface]

Availability

This feature is available starting from:

Jumbo Hotfix Accumulator for R82.10 - Take 36
Jumbo Hotfix Accumulator for R82 - Take 118
Jumbo Hotfix Accumulator for R81.20 - Take 158

Important Notes

You must perform these steps on each Maestro Orchestrator in the environment.

To minimize the traffic impact, configure one Maestro Orchestrator at a time.

This way, it is not necessary to schedule a full maintenance window.

At this time, only the Line Card "CPAC-4-10/25F-DA" on Security Appliances was tested and certified for forwarding STP / BPDU packets.

Configuration Instructions for each Maestro Orchestrator

Install the Jumbo Hotfix Accumulator on the Maestro Orchestrator and reboot.

Refer to sk168597 - How to install a Hotfix.

Connect to the command line on the Maestro Orchestrator.
Log in to the Expert mode.
Enable the BPDU forwarding:

jsont -f /etc/maestro.json -s /mho_stp_forward/state -v enabled

Restart the daemon:

orchd restart

Warning - No traffic flows through the Maestro Orchestrator while this daemon is restarting.

Article Properties

Access Level: General

Status: Approved

Date Created: 2026-06-29

Last Modified: 2026-07-22