156-836 Exam Dumps - Checkpoint CCME Questions and Answers

According to the Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-175 document1, ports 1 - 4 are Management ports that are used to connect the MHO to the customer’s management infrastructure, such as SmartConsole or SmartDomain Manager. Ports 5 - 26 are Uplink ports that are used to connect the MHO to the customer’s network infrastructure, such as switches, routers, or firewalls. Ports 27 - 47 are Downlink ports that are used to connect the MHO to the Security Group Modules (SGMs) in the Security Group. Ports 49 - 55 are Backplane ports that are used to connect the MHO to another MHO in a Dual Orchestrator environment.

References:

•Maestro Expert (CCME) Course - Check Point Software, page 42

•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline3

•Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-1751

One of the possible reasons for the “Failed to get remote orchestrator interfaces” error message, when clicking on “Orchestrator” in WebUI, is that the remote orchestrator has no empty interfaces that can be assigned to a security group. This can happen if all the interfaces on the remote orchestrator are already part of configured security groups, or if the remote orchestrator has no physical interfaces at all. In this case, the WebUI cannot display the unassigned interfaces of the remote orchestrator, and shows the error message.

References

•Not able to see unassigned interfaces on checkpoint Orchestrator

•Maestro 140 not detecting Interfaces

•Maestro Expert (CCME) Course - Check Point Software, page

References =

•Check Point Maestro R81.X Administration Guide, page 64, section “Correction Layer” 1

•Check Point Maestro R81.X Getting Started Guide, page 26, section “Correction Layer” 2

•Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3

•Check Point Maestro Frequently Asked Questions (FAQ), question 9 4

1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm 3: https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20Maestro%20under%20the%20hood%202022.pptx 4: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails= &solutionid=sk147853&partition=Basic&product=Maestro

The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.

References

•R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1

•Support, Support Requests, Training … - Check Point Software2

•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge

The maximum number of appliances within the same security group is 31. This is because a security group can have up to 31 Security Group Modules (SGMs) of the same or different models, and each SGM is an appliance that runs the Check Point software. A security group can span across multiple chassis, and each chassis can have up to 16 SGMs. However, the total number of SGMs in a security group cannot exceed 31.

References:

•Maestro Expert (CCME) Course - Check Point Software, page 51

•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

This is the correct answer because it follows the upgrade order and procedure specified in the R81.10 and R81.20 Administration Guides for Maestro environments. The MHOs are responsible for managing and synchronizing the SGMs, so they must be upgraded to the target version before the SGMs. However, the SGMs can be upgraded one by one or in batches, as long as they are compatible with the MHOs. The upgrade process also supports Multi-Version Clustering, which allows different versions of SGMs to operate in the same Security Group with zero downtime.

References =

•Check Point R81.10 for Scalable Platforms - Check Point Software

•Check Point R81.20 for Scalable Platforms - Check Point Software

•CHECK POINT MAESTRO EXPERT

Uplink interfaces are used to connect Maestro Hyperscale Orchestrators (MHOs) to the customer’s network infrastructure, such as switches, routers, or firewalls. They are also used to send and receive management and control traffic from the customer’s network to the MHOs.

References:

•Maestro Expert (CCME) Course - Check Point Software, page 41

•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

This is not one of the ways to configure a Security Group in a Dual Site environment, because load balancers are not required or supported for the inter-site communication between the Maestro Orchestrators (MHOs). The MHOs use the Site-Sync port and VLANs to synchronize the resources and connections across the sites. The three valid scenarios for Dual Site configuration are:

•Direct connectivity between remote site Orchestrators: This scenario requires two orchestrators, one for each site, and a direct connection between them using the site-sync port.

•Two orchestrators on the same site are connected to the remote site orchestrators through two different switches: This scenario requires four orchestrators, two for each site, and a connection between them using the site-sync port and two external switches that support QinQ and MTU increment.

•Two orchestrators on the same site are connected to the remote site orchestrators through one switch: This scenario also requires four orchestrators, two for each site, and a connection between them using the site-sync port and one external switch that support QinQ and MTU increment.

References =

•Maestro Dual Site configuration with a direct connection through L2 switches

•[Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)]

•[Maestro Frequently Asked Questions (FAQ)]

The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.

References

•R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2

•Maestro Expert (CCME) Course - Check Point Software, page 18

•Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16

The /var/log/messages file is a general system log file that contains information about various system events, such as booting, shutdown, cron jobs, kernel messages, and other system services. Logs without a dedicated log file can be found in this file, as well as some Maestro Gaia Clishcommands that are not saved in the /var/log/command_logger.log file.

References

•Maestro Audit Logs - Where are they? - Check Point CheckMates1

•sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2

•Maestro Expert (CCME) Course - Check Point Software, page 33