Skip to main content
VicAndr
VicAndr
New Member
September 10, 2014
Solved

Hardware: Management Ports?

  • September 10, 2014
  • 9 replies
  • 41891 views
When I look through datasheets of new FortiGate units I see that they (except low models) have a Management Port, and some have even 2 (i.e. FG-300D, FG-500D,...). I have few questions re. those management ports. 1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)? I know that I am missing something here... Can someone answer the above questions? Thank you, VA
    Best answer by emnoc
    1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?
    1: for out of band management. Ideal when you have a OOB network or some other path. The route table sites as a OOB route-table also 2: not it' s defined for management of the device. Some have dual-management ports. 3: it' s management port.

    9 replies

    emnoc
    emnocAnswer
    New Member
    September 10, 2014
    1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?
    1: for out of band management. Ideal when you have a OOB network or some other path. The route table sites as a OOB route-table also 2: not it' s defined for management of the device. Some have dual-management ports. 3: it' s management port.
    VicAndr
    VicAndrAuthor
    New Member
    September 11, 2014
    Thank you all who answered the questions. Your answers are all in line with each other. While waiting for someone to respond in the forums though, I open a web-chat with Fortinet support and asked guy on the other end the very same questions. And guess what? His answers did not exactly match yours. He told that YES, management port (or two for that matter) are mainly used for out-band unit management (i.e. accessing members in a cluster). But they (management ports) might be used to process regular network traffic as well. What he was not sure about was whether those ports could take advantage of NPU or CP offloading. So I am a little confused now: either folks who work in the field do not know some " hidden" capabilities of hardware in their possession or Fortinet put incompetent people in a position to support its flock. The reason I ask all those questions was - we are thinking about FG-310B unit replacement. In terms of processing capabilities FG-300D seems to be a right fit BUT the problem is - it has a very low ports capacity. So I was wondering - could I take advantage of 2 management ports to handle network traffic as well - this way you could add 2 more ports to existing 4 1GB RJ45 ones. I was trying to find management ports description somewhere in the documentation but couldn' t have found any. Could someone point me to the right source, please?
    netmin
    netmin
    New Member
    September 10, 2014
    Plus: dedicated mgmt ports are usually configured with different IP addresses on the individual cluster members, so one can access them both, active or passive cluster member. Non-mgmt ports on a/p clusters share the configuration between the active member port and corresponding passive member port (only the active cluster member can be accessed).
    neonbit
    neonbit
    New Member
    September 11, 2014
    The management ports are unable to route traffic to other networks. They are only used for management purposes. Quite a few of the request for tenders we see ask for a dedicated management port because there is no risk of a mistake/malicious configuration that would allow the management interface to talk to another one.
    netmin
    netmin
    New Member
    September 11, 2014
    OK, more specific: dedicated mgmt ports in terms of: 
      config system interface   edit mgmt    set dedicate-to management   next  end
    do not process regular traffic. The same interface not dedicated to management may do this. NP Acceleration, as far as documentation shows, likely not, but you may want to double check it for your device: http://docs.fortinet.com/uploaded/files/1607/fortigate-hardware-accel-50.pdf
    VicAndr
    VicAndrAuthor
    New Member
    September 11, 2014
    OK, more specific: dedicated mgmt ports in terms of: config system interface edit mgmt set dedicate-to management next end do not process regular traffic. The same interface not dedicated to management may do this.
    Perfect! Your answer " glues" everything together. Thank you very much, netmin!
    netmin
    netmin
    New Member
    September 11, 2014
    Concerning the 300D model: http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-500D.pdf
    6 x GE RJ45 ports (including 4 x FortiASIC-accelerated ports, 2 x management ports), 4 x GE SFP slots, 120GB onboard storage
    emnoc
    emnoc
    New Member
    September 11, 2014
    I would be very very careful trying to use dedicate ports for user traffic and expecting acceleration. You should confirm that, due to the ASIC might not be bound to a " MGMT" interface. I don' t think you can get anything from free Consult with a fortinet-partner and get there blessing if you need fastpath.
    VicAndr
    VicAndrAuthor
    New Member
    September 11, 2014
    I would be very very careful trying to use dedicate ports for user traffic and expecting acceleration. You should confirm that, due to the ASIC might not be bound to a " MGMT" interface.
    I now know (both from netmin' s post as well I checked the doc he was referring to) that management ports are not accelerated. ...and that' s fine - sometimes you need few extra physical ports for low-volume users' and management unrelated traffic. 4 RJ45 ports for a powerful firewall to connect to networks around - is a shame. BTW, neither of SFP ports on both FG-300D and FG-500D are accelerated as well.
    emnoc
    emnoc
    New Member
    September 11, 2014
    This is where 802.1q trunking comes in place. You can craft hundred of vlans and trunking them to your distribution/access core. I personally never heard of anybody using a mgmt interface outside of an ASA for carrying user traffic. Also does anybody know if you can use these for HA and heart-beart monitors?
    Mickey
    Mickey
    New Member
    May 19, 2015

    emnoc wrote:
    This is where 802.1q trunking comes in place. You can craft hundred of vlans and trunking them to your distribution/access core. I personally never heard of anybody using a mgmt interface outside of an ASA for carrying user traffic. Also does anybody know if you can use these for HA and heart-beart monitors?

     

    At least on the FG-500D, you can use either of the two management ports for HA heart-beat.  From the command line you can get the list of allowed HA ports like this:

     

    config system ha

        set hbdev ?

     

    I don't know if the fact that it's not NPU accelerated impacts the performance for HA heartbeat or session synchronization.

    Jupiter_FTNT
    Staff
    Jupiter_FTNT
    Staff
    September 11, 2014
    neither of SFP ports on both FG-300D and FG-500D are accelerated as well.
    This is wrong, all SFP ports on both 300D and 500D are accelerated by NP6 You can try " d np np6 port-list "
    VicAndr
    VicAndrAuthor
    New Member
    September 11, 2014
    Unfortunately I can' t try this CLI commend since I do not have that specific unit. I based my statement on FG-300D FG-500D datasheet which mentions 4 x FortiASIC-accelerated ports on FG-300D and 8 x ones on FG-500D. But thank you - it is good to know, otherwise it would seem to be performance " unbalanced" unit.
    whayden1
    whayden1
    New Member
    June 23, 2015

    VinAndr originally asked the following questions.  I provide the following answers which I think are more accurate and up-to-date.  Some of this post is redundant, but it also corrects misinformation about MGMT ports as they apply to Fortinet.

    1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces?

     

    Answer 1: As previously stated numerous times in this thread the MGMT ports provide out-of-band management of the unit in question.  This is important to organizations that have OOBM infrastructure.  The management port can be configured in a number of ways.  In more recent FortiOS you have the option to have management ports dedicated to management functions.

     

    config system interface edit mgmt set dedicate-to management next end

     

    When a port is configured as a dedicated management interface its IP/Subnet will not be advertised or participate in routing.  It's simply an access port.  There are other ways to accomplish this however.  For example you can configure VDOM's where the root VDOM is the Management VDOM and traffic is on another VDOM.  This provides a lot of flexibility.  We could ramble on here for some time so I'll move on.

     

    2. Can those ports handle regular network traffic?

     

    Answer 2: Yes, almost any port on a Fortinet appliance can be tasked to perform any role.  The name of the port is just that, a name.  However not all ports on Fortinet products are equal (see 3).

    3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?

     

    Answer 3: Some ports on FortiGates for are ASIC accelerated and other are not.  You will need to check your datasheet to determine which ports are FortiASIC accelerated if any.  Most FortiGates usually have at least 2 ASIC accelerated ports.  In all cases a port labeled MGMT and HA will NOT be accelerated.  This does not mean that you cannot use it as a standard port.  It will work just fine, just don't expect too much of it in terms of UTM capability.  It will have no problems performing straight up IPSEC, Firewall and light UTM functions. I hope this helps clear the waters.

    Terms & ConditionsAccessibility statement