D500 HA cluster and IP on interface

Forum|Forum|7 years ago
April 8, 2019
3 replies
3511 views

I am trying to understand how to assign IP addresses to firewalls when in HA Cluster. Should I assign IP directly to physical interface or should I create a logical interface? I am looking to run in Active/Passive; however, I find it silly to create a IP on the physical interface, what would get mirror to the other unit. Due to the latter, a logical interface with IP sounds more beneficial.

Thank you

ede_pfau

SuperUser

Why silly?

In an a/p cluster, you treat the cluster as ONE machine. All configuration is synched from one member to the other (so you don't have to take care of that).

That is true for interface addresses as well. As the passive cluster member is not participating in your LANs' traffic the "duplicate" address does not matter.

To use a physical or a logical port (zone?) is up to you. Generally, you have all options available on physical ports, and only a subset on zones.

gradius85Author

New Member

ede_pfau wrote:
Why silly?

In an a/p cluster, you treat the cluster as ONE machine. All configuration is synched from one member to the other (so you don't have to take care of that).
That is true for interface addresses as well. As the passive cluster member is not participating in your LANs' traffic the "duplicate" address does not matter.

To use a physical or a logical port (zone?) is up to you. Generally, you have all options available on physical ports, and only a subset on zones.

This is what I was trying to detail - for what I wanted...

https://kb.fortinet.com/kb/documentLink.do?externalID=FD34744

ede_pfau

SuperUser

OK, I've read the KB article. This is one way how to manage a cluster. From experience, it's not really common to go into VDOM mode just for mgmt purposes, at least not in the scenarios I've managed.

Personally, I do not like VDOM mode, I'd only use it if I can't avoid it. As a CLI user, I constantly hop between global, root and xxx VDOM while debugging, and it just steals time.

Of course, there are valid reasons for using a VDOM (like the need for multiple default routes).

I get along quite well with mgmt ports alone, actually never needed to receive a slave's logs. YMMV.

Sign up

Login with SSO

Login to the community

Login with SSO