Management ports in FortiGate cluster

Forum|Forum|9 years ago
January 23, 2017
4 replies
7339 views

Hello,

I'm going to setup a cluster of two FG-900D (a-p) and I have one concern regarding how to use the management ports. Since the 900D has two mgmt ports, I intend to use one port as dedicated mgmt port for the appliance and the second port for the cluster's management. Each port shall belong to different LAN.

a. Has anybody tried this configuration before?

b. Would you recommend this configuration or not?

c. How can I do it? If I use the "Reserve Management Port for Cluster Member" option, does this apply to both mgmt ports or only to one port?

d. Anything else to suggest?

Thanks

Andreas

boneyard

Valued Contributor

aagrafi wrote:
a. Has anybody tried this configuration before?

yeah.

aagrafi wrote:
b. Would you recommend this configuration or not?

if you really want that separate cluster management address it is the way to go.

aagrafi wrote:
c. How can I do it? If I use the "Reserve Management Port for Cluster Member" option, does this apply to both mgmt ports or only to one port?

that option will only be for the node mgmt addresses (you choose 1 and only 1 interface there), the cluster will be a normal one, so it will also participate in normal routing. also remember to set your node routing via the CLI.

aagrafi wrote:
d. Anything else to suggest?

definitely don't overlap the ip ranges (so nodes and cluster in the same subnet), you will get some unexpected routing to look forward to then.

aagrafiAuthor

New Member

Suppose that Mgmt1 port is reserved for luster member. Can the Mgmt2 port be used for the cluster management? In such case the mgmt2 port does not participate in routing (or do I have to enable routing in this port)? Is this configuration supported?

boneyard

Valued Contributor

aagrafi wrote:
Can the Mgmt2 port be used for the cluster management?
In such case the mgmt2 port does not participate in routing (or do I have to enable routing in this port)?

what do you exactly mean with cluster management? like i tried to explain before, there is just one interface (doesn't even have to be mgmt1 or mgmt2) that has a special role. other interfaces can be used to do management on and they all will be "cluster" interfaces, but they are just regular interfaces and will participate in routing. of course with firewall policies you can limit access across them.

if you have a specific situation in mind or planning for please share it so people can suggest how to make the fortigate work in that.

Sign up

Login with SSO

Login to the community

Login with SSO