how to manage each firewall in HA from a user vlan

Forum|Forum|1 year ago
June 18, 2025
5 replies
1165 views

hello, here is my problem.

i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover.

so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address.

if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card.

is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow.

maybe out band management? i don't know.

thank you

FortiGate

Best answer by funkylicious

you can use the ip of any interface, if you have enabled the administrative access for it ( http,https,ssh ) , if you are using trusted-hosts then make sure the source of the vm is part of them and that you have a correct route back to the vm from the firewall / any firewall rules that might be required along the path between those 2.

if you want to manage them individually in the HA, just use the - https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/10620/config-system-interface#:~:text=set%20management%2Dip%20%7Bipv4%2Dclassnet%2Dhost%7D under the interface in question

funkyliciousAnswer

SuperUser

you can use the ip of any interface, if you have enabled the administrative access for it ( http,https,ssh ) , if you are using trusted-hosts then make sure the source of the vm is part of them and that you have a correct route back to the vm from the firewall / any firewall rules that might be required along the path between those 2.

if you want to manage them individually in the HA, just use the - https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/10620/config-system-interface#:~:text=set%20management%2Dip%20%7Bipv4%2Dclassnet%2Dhost%7D under the interface in question

"jack of all trades, master of none"

dsi_bAuthor

New Member

hello, as i said i already tried to set an ip management on a physical interface on both firewalls(in band management https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implement-In-Band-Management-IP-for-HA-Cluster/ta-p/224671)

you need to be on the same vlan to access to the firewall gui or ssh on both firewalls in this way.

if you are on a seperate vlan, only the master responds (ping, gui or ssh) from a seperate vlan, not the slave. you only can ping the slave from the master. that doesn't answer to my need.

funkylicious

SuperUser

i've done plenty of deployments this way and worked everytime from a separate network, maybe because I had a route back to the source via router/L3 device in the same subnet where I assigned the management-ip on the interface.

"jack of all trades, master of none"