156-836 Sample Questions & Answers

There is no asg_file or asg_cp2all command in Quantum Maestro. The documented tool is asg_cp2blades [-b ] [-r] [-s] [ ], run in Gaia gClish or Expert mode on a Security Group Member. It copies a file from the current SGM to the other SGMs; with no -b (or -b all) it targets all SGMs of that Security Group on all Maestro Sites. Each Security Group is a separate gateway, so running it on Security Group the new group copies the file only to that group's SGMs. The command does not run on the Orchestrator, update_conf_file only edits parameters in configuration files such as fwkern.conf, and asg_config save only saves the gClish configuration.

On Maestro Orchestrators R80.20SP - R81.20 there is no Gaia First Time Configuration Wizard, and Orchestrators do not need a license. The Getting Started Guide procedure is: connect to the MGMT port (default 192.168.1.1, admin/admin) or the console, activate the Orchestrator (enter "y"; this enables the Downlink and Uplink ports), then in Gaia Clish run set interface Mgmt1 ipv4-address mask-length , set interface Mgmt1 state on, set static-route default nexthop gateway address on and save config. Only then is Gaia Portal reachable at https:// . If the port is not set to state on (or no route/save), the WebUI is unreachable even though an IP was assigned.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

In Quantum Maestro R81.10, the built-in diagnostic tests are run with the "smo verifiers" commands in Gaia gClish on the Security Group. show smo verifiers report runs all tests (for example System Health = asg stat -v, Resources = asg resource, SSD Health = asg resource --ssd, Policy = asg policy verify -a, Licenses = asg_license_verifier -v, Bond, ARP Consistency, Core Dumps) and shows a Passed/Failed summary with a Reason column and the output file. show smo verifiers print shows the full output, and report name / report id run specific tests. There is no asg diag --chassis/--blades, g_asg_diag or asg test command.

"asg monitor" continuously shows the same information as "asg stat", refreshed at an interval. The "-v" parameter shows only the System component status, and "-all" shows both the Security Group Member and System component status. The command does not trace packets, show distribution hashes, or capture traffic. To find which member handles a connection, use "asg search". To capture traffic, use "tcpdump -mcap".

The R81.10 Gaia System Logging settings "Send audit logs to management server upon successful configuration" (set syslog mgmtauditlogs on) and "Send audit logs to syslog upon successful configuration" (set syslog auditlog permanent) record every Gaia configuration change that authorized users make. With Remote System Logging you can also forward them to a syslog/SIEM server. On Scalable Platforms (Maestro), you configure this on the applicable Security Group. There is no show audit-trail command. cpstat shows status counters, the Expert mode shell history is per-user and not an audit record, and Threat Prevention logs record traffic, not administrator changes.

Multiple Security Groups allow for logical separation of the security gateways within the same Maestro chassis. Each Security Group acts as an independent firewall cluster, managed as its own Single Management Object (SMO). This is ideal for scenarios like multi-tenancy, separating perimeter and internal firewalls, or testing new policies on a dedicated group of SGMs without affecting production traffic on another group.

False. For a Security Group upgrade, the administrator transfers the CPUSE Offline package to the Security Group once, for example into /var/log/. In Gaia gClish, "installer import local " imports it; gClish commands apply to all Security Group Members. "installer verify member_ids all" checks all members. "installer upgrade member_ids " then upgrades one logical group of members at a time. The package does not have to be copied to each member manually.

Two Orchestrators on the same site work together Active/Active (there is no 'standby' Orchestrator). The Getting Started Guide states that only two Orchestrators of the same model can be connected (MBS-5038), and that to prevent traffic outage in an environment with two Orchestrators on a single site, each Uplink interface and each Management interface must be configured as a Bond interface spanning both Orchestrators. The Orchestrators need no license, and there is no floating SMO address to configure for Orchestrator redundancy.

Two Orchestrators on the same site work together Active/Active (there is no 'standby' Orchestrator). The Getting Started Guide states that only two Orchestrators of the same model can be connected (MBS-5038), and that to prevent traffic outage in an environment with two Orchestrators on a single site, each Uplink interface and each Management interface must be configured as a Bond interface spanning both Orchestrators. The Orchestrators need no license, and there is no floating SMO address to configure for Orchestrator redundancy.

With Layer 4 distribution enabled (the default, together with Auto-Topology), the Orchestrator adds ports to the distribution decision: User mode uses Source Port + Destination IP, Network mode uses Source IP + Destination Port, and General mode uses Source IP, Source Port, Destination IP and Destination Port. Without it, User mode uses only the Destination IP, Network mode only the Source IP, and General mode Source + Destination IP. So all connections from many users hidden behind one NAT source IP would land on the same SGM. Keeping Layer 4 distribution enabled uses the varying source ports to spread those connections across SGMs, and each connection still stays on one SGM.