Loop Back interface

Good Morning @mingj9966 ,

Kindly look at the following articles for detailed explanation:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-and-using-a-loopback-interface-on-a/ta-p/192607

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/853005/loopback-interface#:~:text=Typically%2C%20a%20loopback%20interface%20can,mode%20or%20in%20each%20VDOM.

The direct/short answer is most unlikely you would "need" it in most cases unless you set up a routing protocol with other routers and you need to have an interface that would never go down.

In other words, even with a routing ptocol, you can use one of interfaces on the FGT to peer with the others.
Unlike regular L3 routers, once you create a loopback interface and try connecting it with something outside, you have to have proper policies like "loopback<->inbound/outbound interfaces" to make it work.

Toshi

One use case would be to put the management access onto the LB interface.

We used to just use the LAN port for this, enabling HTTPS, ping and SSH.

First, that is probably not the most secure setup, as a malicious attack could come from the inside.

Then, if by chance this port's connection is removed, thus link down, there is no mgmt access anymore.

So we switched to using LB interfaces (there is at least one per VDOM). We dedicated a super-net like 10.6.0.0/16 for all LBs, then use 10.6.<siteID>.0/32 for each location. Of course, you will have to add routes, policies and sometimes phase2s to include this range, but using a super-net makes that a bit easier.