# How to enable forwarding of STP / BPDU packets through a bridge interface in a Maestro Security Group

## Solution

### Overview

This feature configures a Maestro Orchestrator to forward Spanning Tree Protocol (STP) / BPDU packets that arrive at the Uplink and at the Management ports to a Maestro Security Group configured with a bridge interface.

Without this feature enabled, Maestro Orchestrators drop STP / BPDU packets that arrive at the Uplink and at the Management ports.

Example topology that shows how STP packets can pass between Switch "A" and Switch "B":

```
 [Network "A"]      [Network "B"]
      |                  |
      |                  |
  [Switch "A"]       [Switch "B"]
   [with STP]         [with STP]
      |                  |
      |                  |
 (Uplink or         (Uplink or)
  Mgmt port)         Mgmt port)
      |                  |
+------------------------------+
|     Maestro Orchestrator     |
+------------------------------+
              | |
         (Downlink ports)
              | |
        [Security Group]
    [with a Bridge interface]
```

### Availability

This feature is available starting from:

- [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) \- Take 36
- [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) \- Take 118
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) \- Take 158

### Important Notes

- You must perform these steps on each Maestro Orchestrator in the environment.

To minimize the traffic impact, configure one Maestro Orchestrator at a time.

This way, it is not necessary to schedule a full maintenance window.
- At this time, only the Line Card "CPAC-4-10/25F-DA" on Security Appliances was tested and certified for forwarding STP / BPDU packets.

### Configuration Instructions for each Maestro Orchestrator

1. Install the Jumbo Hotfix Accumulator on the Maestro Orchestrator and reboot.

Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

2. Connect to the command line on the Maestro Orchestrator.

3. Log in to the Expert mode.

4. Enable the BPDU forwarding:

```
jsont -f /etc/maestro.json -s /mho_stp_forward/state -v enabled
```

5. Restart the daemon:

```
orchd restart
```

**Warning** \- No traffic flows through the Maestro Orchestrator while this daemon is restarting.

## Article Properties

Access Level: General

Status: Approved

Date Created: 2026-06-29

Last Modified: 2026-07-22