Configuring MGMT interface on same subnet as WAN1 (Outside) interface on HA Pair

Question

I'm configuring a pair of FortiGate 100E firewalls in our lab as a pilot to convert from Cisco ASA 5510 firewalls to FortiGate 100E firewalls and I've been able to replicate the majority of the hardware configuration, but I'm running into some issues with a management interface and HA sync.

On the ASA, we use the WAN interface for management of both the active and standby firewalls. Cisco ASA interfaces can be configured with a "standby" command <ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2 for example> and the standby firewall will be reachable by the standby IP Address. However, this doesn't appear to be an option on the FortiGate. My workaround was going to be configuring a static management IP Address on both the primary and secondary firewalls in the same subnet as the WAN1 interface, so that we could always reach them. In theory, I'd like it to look something like this:

WAN1 - 192.168.1.1

Primary MGMT - 192.168.1.2

Secondary MGMT - 192.168.1.3

I'm able to configure the interfaces without any issues, but I cannot actually ping or reach the MGMT interfaces, and there doesn't appear to be a way to configure a static default route out using the MGMT interface (I probably don't want to anyway, since I want all outbound traffic to leave over the WAN1 interface).

How can I set up my MGMT interface to use the same subnet as the WAN1 interface and still be able to reach it remotely?

emnoc · Accepted Answer

I would not do that in a real life but you can probably set a dedicate interface AUX/MGT in the ha-cfg and set the gateway

e.g

config system ha set group-name "myfgthasgrp" set mode a-p set password ENC TB1sAMk9folBwB9s9xqhWiNp+iGAaB/TcyLiLWX+Y+9ssz8RnAE6hACHJFYLJpRc2DSygnAE7i+mPjuciSMQVFo9zN93xGxW846mBFYQ8sccdt1GdAeQERvc+RGikkeFEuWzde9+58zbXxoW6LzFmnT+d8it4yA/z1peHdnu18MA/kxCAqo5Pv5oGHF/rBE4uaFYqQ== set hbdev "port5" 50 "port6" 50 set session-pickup enable set ha-mgmt-status enable set ha-mgmt-interface "mgmt" set ha-mgmt-interface-gateway 10.1.1.1 set override enable set priority 100 set monitor "port1: end

config sys interface

edit "mgmt" set vdom "root" set ip 10.1.1.11 255.255.255.0 set allowaccess ping https ssh snmp fgfm set type physical set dedicated-to management set description "FGT1500D MANAGEMENT LAN ACCESS" set device-identification disable set lldp-transmission enable set listen-forticlient-connection disable set snmp-index 122 next

end

Do that on each unit HA-cfg but yes this is not 100% like a ciscoASA

BTW you can cli exe ha managment ( this is close to asa cli changeto )

Ken

Toshi_Esumi · Answer

Although I haven't tried it myself, it's a surprise you could configure two different IPs in a same subnet on two interfaces, wan1 and mgmt. I expected you couldn't configure.

By the way, the mgmt interface you configured in HA becomes a special interface only for management. And it completely separated from interfaces for user traffic. I would just use 192.168.1.1/xx for WAN1 for regular management access that let you get in the active/master unit at that time. Then like 192.168.2.1/29 and .2/29 at mgmt on both units with a GW 192.168.2.1 on the switch/router side for specific unit access.

Sign up

Login with SSO

Login to the community

Login with SSO