New Member

Solved

way of communication between Fortimanager and Fortigate?

6 replies
9347 views

Hello,

I want to be sure, the fortimanager communicate with the fortigate ( TCP 541), but is the fortigate communicate with Fortimanager too? Or Can i put the Fortimanager in a DMZ that the public network can't reached? ( only the Fortimanager can reach the public network not the opposit)

Thanks,

JF

scao_FTNTAnswer

Staff

Or Can i put the Fortimanager in a DMZ that the public network can't reached? ( only the Fortimanager can reach the public network not the opposit)

-- for your case, yes, you can do this and let FMG add FGT public IP. after FMG/FGT tunnel setup, later traffic is through tunnel

Thanks

Simon

scao_FTNT

Staff

Hi, JF, both FMG and FGT may use TCP 541 to connect, based on topology

When FMG is behind NAT and no VIP access, when FMG adding device, need to connect to FGT TCP 541 to setup tunnel

When FGT is behind NAT and no VIP access, then FMG can not directly add device by that IP and you need to config FMG IP in FGT admin settings page - "Central Management" to let FGT connect to FMG to setup tunnel, then you will see FGT in FMG unregistered device list and then you can promote/add FGT from unregistered device list to device manager

Thanks

Simon

scao_FTNTAnswer

Staff

Or Can i put the Fortimanager in a DMZ that the public network can't reached? ( only the Fortimanager can reach the public network not the opposit)

-- for your case, yes, you can do this and let FMG add FGT public IP. after FMG/FGT tunnel setup, later traffic is through tunnel

Thanks

Simon

jfceldaAuthor

New Member

Ok, thank you,

So i can let the FMG in a DMZ that public network can't reach and let the FMG connect to the Fortigates , who have a public IP adress

JF

scao_FTNT

Staff

So i can let the FMG in a DMZ that public network can't reach and let the FMG connect to the Fortigates , who have a public IP adress

-- yes

Thanks

Simon

scao_FTNT

Staff

forgot to say, this is for config management between FMG and FGT

if you want to use FGT to send log to FMG (for FMG side logging function), then you still need to let FMG IP be accessible by FGT

Thanks

Simon

Sam_S1

New Member

scao_FTNT wrote:
if you want to use FGT to send log to FMG (for FMG side logging function), then you still need to let FMG IP be accessible by FGT

Would you also need to open the logging ports if the FGM is in a DMZ? Or is the communication achieved by the management tunnel?

Sign up

Login with SSO

Login to the community

Login with SSO