ACL between ports on FortiManager 7.2.4

Forum|Forum|2 years ago
November 6, 2023
3 replies
2232 views

I have a setup with one FortiManager that today manages internal firewalls. It has an interface connected to a mgmt network where most of our internal networking equipment are connected to.

We want to use this FortiManager to also manage other Fortigates from different customers.
My initial plan is to create a private VLAN and let a new interface on the FortiManager be behind a promiscious port,.It's only used for adding the units to the Fortimanager.

My consern is that the FortiManager becomes a bridge between our internal mgmt network and customers mgmt network. Example someone makes a static route on the customer Firewall that points to our internal mgmt network with the FortiManager as next hop.

I have not yet found any way to have an ACL directly on the FortiManager and would in this case be only dependent on the customer Fortigate ACL.

Another solution would be to route the traffic towards the FortiManager through a firewall, but I want to keep customer mgmt traffic outside of our internal mgmt network as much as possible.

Fortimanager

Best answer by asrour

Hello @Qwireca

The Fortimanager will not act as a bridge and will not route the traffic between connected FGTs

each FMG <> FGT connection will be on a separate FGFM tunnel between the Fortigate and the Fortimanager

Stephen_G

Moderator

Hello Qwireca,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Stephen_G - Fortinet Community Team

Toshi_Esumi

SuperUser

Although I didn't set up our FMG that way (everything is coming over the internet port), in your case, I would separate the customer FGT's connections on a different port, say port2, while your FGT is connected through port1. I don't think ACL is available on FMGs, so I would put a switch inbetween and set up ACLs there.
Or, if you don't have a switch that supports ACL and that has at least two ports available, I would sacrifice your own FGT's two ports for that purpose and control the FGFM traffic by a set of policies.
Just an idea without having any concrete design.

Toshi