Skip to main content
Shantilal1998
Shantilal1998
Explorer II
May 24, 2025
Question

In-band management access issue on Fortigate

  • May 24, 2025
  • 6 replies
  • 2061 views

Hi Team,

 

I have configured In-band management access for taking the access of both Pri and Sec devices from different network but I am only able to take access of primary device not secondary.

 

I had checked in the sniffer, traffic was coming from the management interface but it was returning back to the source.

 

Kindly suggest.

6 replies

funkylicious
SuperUser
funkylicious
SuperUser
May 24, 2025

can you post some config of the inband management that you have ?

"jack of all trades, master of none"
    Shantilal1998
    Shantilal1998Author
    Explorer II
    May 24, 2025

    edit "internal1"
    set vdom "root"
    set management-ip 10.1.x.3 255.255.255.0
    set allowaccess ping https ssh
    set type physical
    set alias "MGMT"
    set snmp-index 4
    next

     

    Same 10.1.x.4 255.255.255.0 for secondary.

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    May 24, 2025

    i guess that you have a static route back to your source on a different interface ?

    "jack of all trades, master of none"
      Shantilal1998
      Shantilal1998Author
      Explorer II
      May 24, 2025

      Yes, it is pointing to internal3. but why traffic is coming from internal1. It should come via internal3.

      funkylicious
      SuperUser
      funkylicious
      SuperUser
      May 24, 2025

      can you share the sniffer output on the secondary device while trying to connect ?

      also, get router info kernel from it.

      "jack of all trades, master of none"
        Shantilal1998
        Shantilal1998Author
        Explorer II
        May 24, 2025

        I don't have access now. Will share in 1 or 2 days.

        Yurisk
        SuperUser
        Yurisk
        SuperUser
        May 24, 2025

        Have you had a look at https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-implement-In-Band-Management-interface-for/ta-p/225314 ? It explains it pretty good.

         

        yurisk.info - all things Fortinet blog, no ads
          Shantilal1998
          Shantilal1998Author
          Explorer II
          May 27, 2025

          The issue resolved. I used OOB and re-route management traffic via my LAN switch.

          ToniFG
          ToniFG
          New Member
          November 3, 2025

          So, you did not fix it but you changed your mind and moved from in-line to out-of-band management, right?   Just asking, because I am facing same issue.  I can not manage to get passive cluster member access.  Thanks.

          Shantilal1998
          Shantilal1998Author
          Explorer II
          November 3, 2025

          In-line we can't reserve the port that's why used OOB.

           

          My requirement was to have both firewall access independently. So, I just pass the traffic via firewall and re-route the traffic from core switch to the mgmt port. As we know after reserving the mgmt port we can't assign the port in the policy.

           

          External Network ----> FortiGate -----> Core Switch -----> FortiGate Mgmt port

           

          FortiGate is same in the flow. Hope you understood.

          ToniFG
          ToniFG
          New Member
          November 3, 2025

          I got it thank you.  I am exactly in the same situation.  So I am trying to have independent access to each node without crossing the FW to manage it (like you did with OOB).  But looks like in line solution does not work...

          Shantilal1998
          Shantilal1998Author
          Explorer II
          November 3, 2025

          Hmm.. This is only way to achieve this.

          Terms & ConditionsAccessibility statement