New Member

Solved

OOB mgmt interface for HA cluster mgmt interface

Forum|Forum|5 years ago
February 3, 2021
8 replies
12838 views

Hi, guys,

I am confused to Fortigate HA cluster mgmt interface.

I have two Fortigate 600E devices and form a HA-pair; an IP address for their OOB mgmt interface individually, as the following requirement (no mgmt VDOM, and the following configuration through root VDOM) :

1. 192.168.100.10 ( for the OOB "mgmt" interface of the primary Fortigate) 2. 192.168.100.20 ( for the OOB "mgmt" interface of the secondary Fortigate) 3. 192.168.100.100 (for the cluster IP = always towards the master unit)

4. How I can configure the above requirement

5. The above IP addresses should not be overlapped

any advice and recommendation, many many thanks.

Best answer by ede_pfau

The exact steps depend on the FOS version installed, but for v6 I recommend:

- do not configure the port you want to use for mgmt at all

- in System / HA, select a dedicated port for management, select "mgmt"

- then in Network / Interfaces, put in the IP address, mask and any other detail

The special quirk of HA mgmt ports is that their address can overlap with that of an other port, e.g. LAN. And secondly, that the configuration (esp. the address) is not synchronized across the cluster.

In the past, I've had some trouble getting this to work when I started with the port config first, HA config later.

If you need to, you can specify a gateway address for the HA mgmt in the CLI.

ede_pfauAnswer

SuperUser

The exact steps depend on the FOS version installed, but for v6 I recommend:

- do not configure the port you want to use for mgmt at all

- in System / HA, select a dedicated port for management, select "mgmt"

- then in Network / Interfaces, put in the IP address, mask and any other detail

The special quirk of HA mgmt ports is that their address can overlap with that of an other port, e.g. LAN. And secondly, that the configuration (esp. the address) is not synchronized across the cluster.

In the past, I've had some trouble getting this to work when I started with the port config first, HA config later.

If you need to, you can specify a gateway address for the HA mgmt in the CLI.

BensonLEIAuthor

New Member

Hi, Ede,

I tried to the following configuration, but got problem, any recommendation, thx :

Forti600E_04 # config sys dedicated-mgmt

Forti600E_04 (dedicated-mgmt) # set status enable

Forti600E_04 (dedicated-mgmt) # set int "mgmt" node_check_object fail! for interface mgmt

value parse error before 'mgmt' Command fail. Return code -23

Forti600E_04 (dedicated-mgmt) #

Many thanks

ede_pfau

SuperUser

FOS version?

There are too many places where this is configured...

config system ha
    set mode a-p
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "mgmt"
        next
    end
end
config system interface
    edit "mgmt"
        set ip 10.20.0.3 255.255.254.0
        set allowaccess ping https ssh
        set type physical
        set dedicated-to management
        set role lan
        set snmp-index 1
        set ap-discover disable
    next
end

This is from a FG-200E running v6.0.11.

Sign up

Login with SSO

Login to the community

Login with SSO