Skip to main content
vishal1
vishal1
Explorer
August 26, 2024
Question

Fortigate query

  • August 26, 2024
  • 1 reply
  • 1045 views

Hello All,

 

Need help on below points.

 

1. Im planning to remove/disable central management from fortigate using below steps. 

go to security fabrics--click fabric connector--edit central mgmt--click disable and save

 

does removing fortigate from fortimanager flush the configuration on fortigate ?.

 

2. Does configuring snmp services for out of band with reserved management interfaces [HA] allow user to take administrative access of fortigate through snmp server or its just for monitoring. I'm following below link for configuration

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/313152/out-of-band-management-with-reserved-management-interfaces

1 reply

AEK
SuperUser
AEK
SuperUser
August 26, 2024

Hello Vishal

  1. Removing FGT from FMG management will not change anything to your FGT config
  2. FGT's SNMP is read-only and can't be used for any write queries. SNMP traps are used to send alerts from FGT, and SNMP queries are used only to read values from FGT.
AEK
    vishal1
    vishal1Author
    Explorer
    August 26, 2024

    Hi AEK,

     

    Thank you for your response. Basically im planning to configure snmp services using dedicated ha management interfaces using below configuration.

     

    1. Allow SNMP on port8 on both primary and secondary units:

      config system interface     edit port8         append allowaccess snmp     next end

      Add an SNMP community with a host for the reserved management interface of each cluster member. The host includes the IP address of the SNMP server.

      config system snmp community     edit 1         set name "Community"         config hosts             edit 1                 set ip 10.11.101.20 255.255.255.255                 set ha-direct enable             next         end     next end

      1. Add an SNMP user for the reserved management interface:

        config system snmp user     edit "1"         set notify-hosts 10.11.101.20         set ha-direct enable     next end

         

    Terms & ConditionsAccessibility statement