Technical Tip: FQDN address object not matched in local-in-policy when ha-mgmt-intf-only is enabled

The following configuration example illustrates the behavior:

config system ha
    set ha-mgmt-status enable
        config ha-mgmt-interfaces
            edit 1
                set interface "port4"
                set gateway 192.0.2.1
            next
        end

config firewall address
    edit "mgmt-fqdn"
        set type fqdn
        set fqdn "admin.example.com"
    next
end

config firewall local-in-policy
    edit 1
        set ha-mgmt-intf-only enable
        set intf "port1"
        set srcaddr "mgmt-fqdn"
        set dstaddr "all"
        set action accept
        set service "ALL"
        set schedule "always"
    next
    edit 2
        set ha-mgmt-intf-only enable
        set intf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "ALL"
        set schedule "always"
    next
end

When a dedicated HA management interface is configured, FortiGate processes its traffic in a separate internal context (vsys_hamgmt). This management path is isolated from the normal VDOM data plane and standard traffic forwarding policy engine.

Local-in policies with set ha-mgmt-intf-only enable are evaluated within this HA management context.

FQDN address objects rely on DNS resolution within the regular VDOM data plane. In the HA management context, FQDN-based source matching is not performed. As a result, the local-in policy does not match and access is denied.

This behavior is by design.

To restrict access to a dedicated HA management interface, use static IP subnet address objects instead of FQDN-type address objects.