Troubleshooting Tip: HA mgmt interface limitation

Description

This article describes how, in a FortiGate High Availability (HA) cluster, the HA management interface (ha-mgmt) provides out-of-band access to each individual unit, including the passive node. While this feature is useful for direct management and troubleshooting, it has several functional limitations that must be understood when designing or operating an HA environment.

Scope

FortiGate devices configured in HA (Active-Passive) using the HA management interface feature.

Solution

Behavior: The HA management interface operates independently on each cluster member. It uses a separate routing table and is not involved in HA failover decisions or data traffic forwarding. Each unit must be configured individually, and traffic sent through this interface is always local to the device.

Limitations:

Independent routing table:

The HA management interface does not use the main routing table. A dedicated gateway (ha-mgmt-gateway) and any required static routes must be configured per device. Without proper routing, connectivity to external services (e.g. SFTP, DNS) will fail.

No configuration synchronization:

Settings related to the HA management interface are not synchronized across cluster members. Each unit requires manual configuration, including IP address, gateway, and administrative access.

No participation in HA failover:

The HA management interface is not monitored by HA health checks and does not influence failover decisions. A failure of this interface will not trigger a cluster failover.

Out-of-band management only:

This interface cannot be used for data traffic. It does not support firewall policies, NAT, or security inspection. Its use is limited to administrative access and basic management protocols.

Limited protocol and feature support:

Only basic services such as HTTPS, SSH, ping, and SNMP are supported. Advanced features and security services are not available through this interface.

Cluster operations use active unit only:

Operations initiated at the cluster level (e.g. configuration backups, automation stitches) are executed only by the active unit. The passive unit’s HA management interface is not used in these cases.

Manual operations required for passive unit:

To perform actions from the passive unit (such as uploading a backup to an SFTP server), administrators must connect directly to the passive unit via its HA management IP. Automated or cluster-triggered actions will not originate from the passive node.

Source IP considerations:

Traffic originating from the HA management interface uses the interface’s own IP address. External systems (such as SFTP servers) must allow this source IP, which differs from the cluster virtual IP.

VDOM limitations:

In multi-VDOM environments, the HA management interface is associated with the global context and may not support advanced per-VDOM routing scenarios.