Checkpoint QUANTUM MAESTRO User manual

[Classification: Protected]
11 November2021
QUANTUM MAESTRO
Getting Started Guide

Check Point Copyright Notice
© 2019 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and distributed under
licensing restricting their use, copying, distribution, and decompilation. No part of this product or related
documentation may be reproduced in any form or by any means without prior written authorization of Check
Point. While every precaution has been taken in the preparation of this book, Check Point assumes no
responsibility for errors or omissions. This publication and features described herein are subject to change
without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)
(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR
52.227-19.
TRADEMARKS:
Refer to the Copyright page for a list of our trademarks.
Refer to the Third Party copyright notices for a list of relevant copyrights and third-party licenses.

Important Information
Quantum Maestro Getting Started Guide|3
Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date with the
latest functional improvements, stability fixes, security enhancements and protection against
new and evolving attacks.
Certifications
For third party independent certification of Check Point products, see the Check Point
Certifications page.
Quantum Maestro Getting Started Guide
Latest Version of this Document in English
Open the latest version of this document in a Web browser.
Download the latest version of this document in PDF format.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments.

Important Information
Quantum Maestro Getting Started Guide|4
Revision History
Date Description
11 November
2021
Updated:
n
"Mounting the Quantum Maestro Orchestrator MHO-140 and MHO-170 in a
Rack" on page68 - updated the rack depth range
n
"MHO-140 Specifications" on page182 - updated the max power consumption
22 June2021 Added:
nInformation about Quantum Maestro Orchestrator MHO-175 in all applicable
topics
03 May2021 Improved:
nFormatting and document layout
Removed:
nInformation about the configuration of Security Groups (this information appears
in the Maestro Administration Guides)
12
September
2020
Improved:
nFormatting and document layout
Updated:
n
"Introduction" on page16
n
"MHO-170 Front Panel" on page26
n
"MHO-140 Rear Panel" on page30
n
"Ports" on page45
n
"Dual Site" on page131
n
"Connecting Two Quantum Maestro Orchestrators for Redundancy" on page87
n
"Thermal Threshold Definitions" on page183
25
September
2019
Updated:
n
"Fan Status LED" on page34 - Added a note that currently FAN LEDs are always
off
09
September
2019
Added:
n
"Dual Site" on page131
Updated:
n
"Hardware Components" on page20
n
"Mounting the Quantum Maestro Orchestrator MHO-140 and MHO-170 in a
Rack" on page68
n
"Connecting Two Quantum Maestro Orchestrators for Redundancy" on page87
n
"Quantum Maestro Orchestrator Ports and Gaia OS Interfaces" on page170

Important Information
Quantum Maestro Getting Started Guide|5
Date Description
10 July 2019 Updated:
nDocument design
n
"MGMT Ports" on page45
n
"Connecting Two Quantum Maestro Orchestrators for Redundancy" on page87
n
"Splitting the Ports with Breakout Cables" on page82
n
"MHO-170 Specifications" on page181
n
"MHO-140 Specifications" on page182
01 July 2019 Added (this information was moved from the Maestro Administration Guide):
n
"Connecting Cables to Quantum Maestro Orchestrators" on page81
Updated:
nDocument design
28 February
2019
First release of this document

Table of Contents
Quantum Maestro Getting Started Guide|6
Table of Contents
Glossary 9
Safety Warnings 13
Introduction 16
Overview 16
Shipping Carton Contents 17
Features 18
Speed and Throughput 19
Ports, Power Supply Units, and Fan Units 19
Hardware Components 20
MHO-175 Front Panel 23
MHO-175 Rear Panel 25
MHO-170 Front Panel 26
MHO-170 Rear Panel 28
MHO-140 Front Panel 29
MHO-140 Rear Panel 30
LEDs 31
LED Notifications 31
System Status LED 32
Fan Status LED 34
Power Supply Unit Status LEDs 36
Bad Port LED 39
Port LEDs 39
Ports 45
Reset Button 49
Replacing Power Supply Units 50
Replacing Fan Units 52
Mounting the Quantum Maestro Orchestrator MHO-175 in a Rack 53
Mounting the Quantum Maestro Orchestrator MHO-140 and MHO-170 in a Rack 68
Connecting Cables to Quantum Maestro Orchestrators 81
Single Site 82
Splitting the Ports with Breakout Cables 82
Breakout Cables 82
MHO-175 Splitting Options 83

Table of Contents
Quantum Maestro Getting Started Guide|7
MHO-170 Splitting Options 85
MHO-140 Splitting Options 86
Connecting Two Quantum Maestro Orchestrators for Redundancy 87
Diagram 87
Workflow 94
Connecting Cables to MHO-175 98
Connecting to the Management Port with DAC or Fiber Cables 98
Connecting to the Management Port with Breakout Cables 100
Connecting to the Uplink Ports with DAC or Fiber Cables 101
Connecting to the Uplink Ports with Breakout Cables 104
Connecting to the Downlink Ports with DAC or Fiber Cables 106
Connecting Cables to MHO-170 109
Connecting to the Management Ports with DAC or Fiber Cables 109
Connecting to the Management Ports with Breakout Cables 111
Connecting to the Uplink Ports with DAC or Fiber Cables 112
Connecting to the Uplink Ports with Breakout Cables 115
Connecting to the Downlink Ports with DAC or Fiber Cables 118
Connecting Cables to MHO-140 121
Connecting to the Management Ports with DAC or Fiber Cables 121
Connecting to the Uplink Ports with DAC or Fiber Cables 123
Connecting to the Uplink Ports with Breakout Cables 125
Connecting to the Downlink Ports with DAC or Fiber Cables 128
Dual Site 131
Dual Site with Direct Connection 132
Dual Site with two Switches 146
Dual Site with four Switches 158
Quantum Maestro Orchestrator Ports and Gaia OS Interfaces 170
Additional Information 179
MHO-175 Specifications 179
MHO-170 Specifications 181
MHO-140 Specifications 182
Thermal Threshold Definitions 183
RJ45 to DB9 Harness Pinout 184
Declaration of Conformity 185
MHO-175 186

Table of Contents
Quantum Maestro Getting Started Guide|8
MHO-170 and MHO-140 187
What is the Next Step? 188

Glossary
Quantum Maestro Getting Started Guide|9
Glossary
B
Breakout
See "Breakout Cable".
Breakout Cable
An optical fiber cable that contains several jacketed simplex optical fibers that are
packaged together inside an outer jacket. Also called fanout, fan-out, or splitter cable.
D
DAC
See "DAC Cable".
DAC Cable
Direct Attach Copper cable. A form of the high-speed shielded twinaxial copper cable
with pluggable transceivers on both ends. Used to connect to network devices (switches,
routers, or servers).
Downlink
See "Downlink Ports".
Downlink Ports
Interfaces on the Maestro Hyperscale Orchestrator used to connect to Check Point
Security Appliances. You use DAC cables, Fiber cables (with transceivers), or Breakout
cables to connect between the Downlink ports and Security Appliances. The Check Point
Management traffic (policy, logs, synchronization, and so on) co-exists with the data
(user) traffic on the Downlink ports. Bandwidth is guaranteed for the Check Point
Management traffic (portion of the downlink bandwidth). These ports form the system
backplane (management, data plane, synchronization).

Glossary
Quantum Maestro Getting Started Guide|10
G
Gaia gClish
The name of the command line shell in Check Point Gaia operating system for Security
Appliances connected to Check Point Maestro Hyperscale Orchestrators. Commands
you run in this shell apply to all Security Appliances in the Security Group.
gClish
See "Gaia gClish".
H
HyperSync
Check Point patented technology that makes sure that active connections are only
synchronized to backup Security Appliances in the Security Group. HyperSync makes
sure each connection flow has a backup within the Security Group.
M
Maestro Hyperscale Orchestrator
A scalable Network Security System that connects multiple Check Point Security
Appliances into a unified system. Acronym: MHO.
Management Interface
Interface on Gaia computer, through which users connect to Portal or CLI. Interface on a
Gaia Security Gateway or Cluster member, through which Management Server connects
to the Security Gateway or Cluster member.
O
Orchestrator
See "Maestro Hyperscale Orchestrator".

Glossary
Quantum Maestro Getting Started Guide|11
S
Security Group
A logical group of Security Appliances that provides Active/Active cluster functionality. A
Security Group can contain one or more Security Appliances. Security Groups work
separately and independently from each other. To the production networks, a Security
Group appears a single Security Gateway. Every Security Group contains: (A)
Applicable Uplink ports, to which your production networks are connected; (B) Security
Appliances (the Maestro Hyperscale Orchestrator determines the applicable Downlink
ports automatically); (C) Applicable management port, to which the Check Point
Management Server is connected.
SGM
Security Appliance. Part of the Security Group that contains the assigned Security
Appliances. Security Appliance in a Security Group has one IPv4 address and
represents all assigned Security Appliances as one entity.
Shared Management
Feature that allows to assign the same Management Port (interface ethX-MgmtY) on a
Maestro Hyperscale Orchestrator to different Security Groups. The assigned
Management Port has a different IP address and a different MAC address in each
Security Group, to which this port is assigned.
SMO
Single Management Object. Single Security Gateway object in SmartConsole that
represents a Security Group configured on Maestro Hyperscale Orchestrator.
SMO Master
The physical Security Appliance in a Security Group that handles management tasks for
all Security Appliances in the Security Group. By default, the Security Appliance with the
lowest Member ID is assigned this role.
SSM
Security Switch Module. Role of the Maestro Orchestrator that manages the flow of
network traffic to and from the Security Groups.
U
Uplink
See "Uplink Ports".

Glossary
Quantum Maestro Getting Started Guide|12
Uplink Ports
Interfaces on the Maestro Hyperscale Orchestrator used to connect to external and
internal networks. Gaia Operating System shows these interfaces in Gaia Portal and in
Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security
Gateway object.

Safety Warnings
Quantum Maestro Getting Started Guide|13
Safety Warnings
Installation Instructions
Read all installation instructions before you connect the equipment to the power source.
Bodily Injury Due to Weight
Use enough people to lift this product safely:
Weight Recommended Number of People
<18 kg (<40 lbs) 1 person
18 - 32 kg (40 - 70 lbs) 2 people
32 - 55 kg (70 - 121 lbs) 3 people
>55 kg (>121 lbs) Use a mechanical lift
Risk of Electric Shock!
With the fan unit removed, power pins are accessible within the module cavity.
Do not insert tools or body parts into the fan unit cavity.
Over-temperature
Do not operate this equipment in an area with an ambient temperature that exceeds the recommended
maximum: 45°C (113°F).
To guarantee proper cooling, allow at least 8 cm (3 inches) of clearance around the ventilation openings.
Stacking the Chassis
Do not stack the Chassis on any other equipment. If the Chassis falls, it can cause bodily injury and
equipment damage.
Redundant Power Supply Connection - Electrical Hazard
This product includes a redundant power supply or a blank cover in its place.
In case of an empty power supply bay, do not operate this equipment with the blank cover removed, or
not properly fastened.
Double Pole/Neutral Fusing
This Quantum Maestro Orchestrator has double pole/neutral fusing.
Remove all power cords before you open the cover of this product or touch any internal parts.

Safety Warnings
Quantum Maestro Getting Started Guide|14
Multiple Power Inlets
The Power Supply Units are all independent.
Disconnect all power supplies to ensure a powered down state inside of this equipment.
During Lightning - Electrical Hazard
During periods of lightning activity, do not work on the equipment, connect or disconnect cables.
Connecting and Disconnecting of Copper Cables
Copper cables are heavy and not flexible. Therefore, carefully attach or detach them from the
connectors.
Refer to the cable manufacturer for special warnings and instructions.
Rack Mounting and Servicing
When this product is mounted or serviced in a rack, you must take special precautions to ensure that the
Quantum Maestro Orchestrator remains stable.
In general, fill the rack with equipment from the bottom to the top.
Equipment Installation
Only trained and qualified personnel should install, replace, and service this equipment.
Equipment Disposal
Dispose of this equipment in compliance with all national laws and regulations.
Installation Codes
Install this equipment according to the latest version of the country national electrical codes.
For North America, see the applicable requirements in the US National Electrical Code and the Canadian
Electrical Code.
Battery Replacement
Warning: Replace only with UL Recognized battery, certified for maximum abnormal charging current not
less than 4 mA.
There is a risk of explosion, if you replace the battery with a battery of an incorrect type.
Dispose of used batteries according to the instructions.
UL Listed and CSA Certified Power Supply Cord
For North American power connection, select a power supply cord that is UL Listed and CSA Certified, 3
- conductor [16 AWG], terminated with a molded plug rated at 125 V [13 A], with a minimum length of 1.5
m [6 feet], but no longer than 4.5m (15 feet).
For European connection, select a power supply cord that is internationally harmonized and marked
"<HAR>", 3 - conductor, minimum 1.0 square mm wire, rated at 300 V, with a PVC insulated jacket. The
cord must have a molded plug rated at 250 V, 10 A.

Safety Warnings
Quantum Maestro Getting Started Guide|15
Interconnection of Units
Cables for connecting to the unit RS232 and Ethernet Interfaces must be UL certified type DP-1 or DP-2
(Note - When residing in non LPS circuit).
Overcurrent Protection
You must incorporate in the building wiring a readily accessible listed branch circuit overcurrent
protective device rated 20 A.
Do Not Use the Switch as a Shelf or Work Space
Caution - Do not use the slide / rail mounted equipment as a shelf or a work space. The rails are not
intended for sliding the unit away from the rack. It is for permanent installation at final resting place only,
not used for service and maintenance.
WEEE Directive
According to the WEEE Directive 2002/96/EC, all waste electrical and electronic equipment (EEE)
should be collected separately and not disposed of with regular household waste.
Dispose of this product and all of its parts in a responsible and environmentally friendly way.
Country of Norway Power Restrictions
This unit is intended for connection to a TN power system and an IT power system of Norway only.

Introduction
Quantum Maestro Getting Started Guide|16
Introduction
In This Section:
Overview 16
Shipping Carton Contents 17
Features 18
Speed and Throughput 19
Ports, Power Supply Units, and Fan Units 19
Quantum Maestro Orchestrator is a scalable Network Security System built to secure the largest networks in
the world by orchestrating multiple Check Point Security Appliances into a unified system.
The Quantum Maestro Orchestrator provides:
nSecurity of infinite scale
nRedundancy - Quantum Maestro Orchestrator automatically distributes traffic between the Security
Appliances assigned to Security Groups
nAbility to connect more Security Appliances and use their resources easily in the existing Security
Groups
Overview
Quantum Maestro Orchestrator 1U systems are ideal for leaf and spine data center network solutions that
provide maximum flexibility, with port speeds from 1 Gbit/sec to 100 Gbit/sec per port, and port density that
enables full rack connectivity to any server at any speed. The ports allow a variety of blocking ratios that suit
all application requirements.
Quantum Maestro Orchestrator 1U systems enable the use of 1, 10, 40 and 100 GbE port speeds in a large
scale without the need to change power infrastructure facilities.

Introduction
Quantum Maestro Getting Started Guide|17
Shipping Carton Contents
This section describes the contents of the shipping carton.
Item Description
Appliance Quantum Maestro Orchestrator
Rack Mounting Accessories n2 static (fixed) rack mount rails
n2 rack mount blades
n2 rack mount ears
n8 M6 standard cage nuts
n8 M6 standard pan-head Phillips screws
n4 flat head Phillips screws with a round patch
(6-32x1/4", 100-Deg, Patch 360)
Cables and Adapters n2 power cables (Type C13-C14)
n2 cable retainers
n1 DB9 to RJ45 serial console cable
n1 DAC cable, 3m
Documentation nQuick Start Guide
nPort Mapping
nUser license agreement
Table: Shipping Carton Contents
Notes:
nDB9 connectors are also known as DE9 connectors.
nBefore installing your new Quantum Maestro Orchestrator, unpack it and check the parts list to make
sure that all the parts are in the package.
Check the parts for visible damage that may have occurred during shipping.

Introduction
Quantum Maestro Getting Started Guide|18
Features
nThroughput and processing capacity:
lMHO-175 - Throughput of up to 3200 Gbit/sec and processing capacity up to 4.76 Bpps
lMHO-170 - Throughput of up to 3200 Gbit/sec and processing capacity up to 4.76 Bpps
lMHO-140 - Throughput of up to 1280 Gbit/sec and processing capacity up to 2.97 Bpps
nFlat latency in the cut-through mode:
lMHO-175 - 425 ns
lMHO-170 - 300 ns
lMHO-140 - 300 ns
nSpeeds of 1, 10, 40, and 100 GbE
nDynamically-shared, flexible packet buffering:
lMHO-175 - 42 MB
lMHO-170 - 16 MB
lMHO-140 - 16 MB
nLowest power, under 5 W per 100 GbE port
nEnhanced scalability
n1+1 hot-swappable power supplies
n4 N+1 hot-swap fans
nColor coded PSUs and fans

Introduction
Quantum Maestro Getting Started Guide|19
Speed and Throughput
The table below lists maximum throughput and interface speed for each Quantum Maestro Orchestrator
model:
Orchestrator
Model
10 GbE
SFP28 Interfaces
40 / 100 GbE
QSFP28 Interfaces
Maximal
Throughput
MHO-175 128
(use QSFP to SFP
breakout cables)
32 3.2 Tbit/sec
MHO-170 64
(use QSFP to SFP
breakout cables)
32 3.2 Tbit/sec
MHO-140 Total 64
48 SFP+ 8 QSFP28
(use QSFP to SFP
breakout cables)
8 1.28 Tbit/sec
Quantum Maestro Orchestrator supports different interfaces and speed rates when you use QSFP to SFP
adapters, or hybrid cables. For more information, see "Splitting the Ports with Breakout Cables" on page82 .
Ports, Power Supply Units, and Fan Units
Orchestrator
Model MGMT Ports USB Ports Console Ports PSUs Fans
MHO-175 1 on the front
panel
1 on the front
panel
1 on the front
panel
2 units 4 units
MHO-170 1 on the front
panel
1 on the front
panel
1 on the front
panel
2 units 4 units
MHO-140 2 on the rear
panel
1 on the rear
panel
1 on the rear
panel
2 units 4 units

Hardware Components
Quantum Maestro Getting Started Guide|20
Hardware Components
This section provides a description of hardware components of Quantum Maestro Orchestrators.
Port Mapping for the Quantum Maestro Orchestrator MHO-175
Item Description Item Description
1 Port 1 is the Management port for
Security Groups
(leads to the Check Point
Management Server)
7 Management port (Mgmt1) for the
Gaia OS on the Orchestrator
2 Ports 2 – 16 are the Uplink ports 40
Gbps / 100 Gbps
(lead to external and internal
networks)
8 RJ45 port for Console connection
3 Ports 17 – 30 are the Downlink ports
(lead to Security Appliances)
9 Port 32 is the Synchronization
port on the same Site
(leads to the peer Orchestrator on
the same Site
4 Port 31 is the Synchronization port in
Dual Site
(leads to the peer Orchestrator on
another Site)
In the Split mode, the 4th split is Sync
and other splits are Downlinks
10 Button to select indication states
for the splitting control LEDs
5 Micro USB 2.0 port 11 Splitting control LEDs that show
the indication state for Port LEDs:
nState of which port to show
(without a split cable).
nState of which split port to
show (in 1-to-2 split, or 1-
to-4 split).
Legend