Skip to main content
iskandar_lie
Staff
iskandar_lie
Staff
September 26, 2022

Technical Tip: Implement independent management IP for an HA cluster

  • September 26, 2022
  • 0 replies
  • 19820 views

Description

This article describes how to implement an independent management IP for an HA cluster.

Scope

FortiGate v6.4, v7.0, v7.2, v7.4, v7.6, v8.0.

Solution

By default, FortiGate HA synchronizes all configuration from the primary to the secondary unit in FGCP. This includes the management interface config. Therefore, only the primary unit will be administratively accessible. The secondary unit is accessible only via the primary device (Technical Tip: Managing individual cluster units with the CLI command 'execute ha manage'). 

Using the 'high availability management IP address option', it is possible to add an independent management IP address to any cluster unit interface. This interface can be an in-band interface processing data traffic, or a dedicated-to-management out-of-band interface. The following is an example configuration of such an interface.

Screenshot 2025-09-10 155046.png

 

Note: The command 'set management-ip' cannot be configured when devices are in a standalone setup. HA has to be configured on the devices first. This is not synced across the devices and is unique to the cluster unit. The snippet above depicts that both the cluster units are accessible independently on this configured management IP. 

Note that the IP that will be used for management IP configuration should be a free IP in the same network range that is already configured on that interface, and a valid route or an IP that has a valid route in the routing table.

The following is another example of this configuration:

iskandar_lie_0-1663956082180.png

 

iskandar_lie_1-1663956095753.png

 

Now, each device is individually accessible even though there is no 'set ip' configuration on the interface itself. This is possible when the IP configured on management IP has a valid route in the routing table.  

iskandar_lie_2-1663956128597.png

 

iskandar_lie_3-1663956138418.png

 

The commands below are useful to verify the configurations:

This command will only show the configured IP address on the interface, not the management IP:

 

fnsysctl ifconfig port4


This command will show both IP addresses associated with port4:

diagnose ip address list | grep port4

 

Conclusion:

  • This method is an alternative to the reserved management interface: Out-of-band management with reserved management interfaces.

  • This configuration line will not be synchronized between the clusters, providing independent access to cluster members.

  • With this additional configuration, there is no impact to existing services - management or data plane. 

 
Note: Starting from FortiOS v8.0.0, IPv6 support has been added to the in-band management IP feature. Enabling it allows HA members to be accessed via IPv6.


config system interface
    edit "port9"
        set vdom "root"
        set ip 192.168.55.1 255.255.255.0
        set type physical
        set snmp-index 9
            config ipv6
                set ip6-address 2000:192:168:55::1/64
                set ip6-mgmt-address 2000:192:168:55::199/64  <------
                set ip6-allowaccess ping https ssh http
            end
        next
    end


Related documents:

      Terms & ConditionsAccessibility statement