Monitoring Cluster Nodes via 'HA Reserved Management Interface'

4 replies
4268 views

Hello, I have a remote location deployed with an 81F active/passive cluster (v6.4.5). Now i'm trying to get both nodes into my monitoring - without luck so far. I have an VPN Tunnel to the cluster and according to KB FD32214 (https://kb.fortinet.com/kb/documentLink.do?externalID=FD32214) it should be possible with a dedicated HA management interface aka 'HA Reserved Management Interface' - for devices which do not have a dedicated out-of-band management interface like 4x/5x/6x/8x series. I configured the dedicated interface as described in the KB but i'm not able to access it. The management interface needs to have an different ip as any of the other interfaces and it's not possible to use that interface in an policy (not even in the cli). So, how to i connect to the nodes using those interfaces via VPN? The interface is up and admin access for PING & SNMP configured but not even pingable from the firewall itself when using it's own ip as ping-option source from that interface.... Have issues to understand how that should work in general...

Toshi_Esumi

SuperUser

The dedicated-management interface in HA works when it's reachable directly outside of user network. If you use a VPN, it's inside of user network so no bridge to the management interface.

screenieAuthor

New Member

I know what you mean, but that would require a separate internet connection or an additional router inside the network just to make this interface reachable. Don't hope Fortinet designed it that way as it would be usless.