Description
This article describes how to specify an HA-mgmt interface for logging when ha-direct is enabled in a FortiGate cluster.
Reserved HA Management interface configuration.
Scope
FortiGate in HA.
Solution
This article explains how to configure a FortiGate cluster to send logs to FortiAnalyzer or another logging device when ha-direct is enabled while keeping logging traffic outside of the management network.
The interface logs are sent out and are specified under the following circumstances:
Setup:
FortiGate cluster with ha-mgmt interfaces configured and ha-direct enabled:
config system ha
set group-name "HA-test"
set mode a-p
set password ENC
set hbdev "port3" 0
set ha-mgmt-status enable
config ha-mgmt-interfaces
edit 1
set interface "port2"
set gateway 10.5.63.254
next
end
set override disable
set ha-direct enable
end
Logging to FortiAnalyzer enabled:
config log fortianalyzer setting
set status enable
set server "10.0.12.89"
end
By default, FortiGate will send the logs out of port2 with such a configuration, as ha-direct is enabled (each FortiGate in the cluster sends its own logs via the ha-mgmt-interface).
To specify a different interface, the following actions need to be taken:
- The desired interface needs to be added as a second ha-mgmt-interface.
- A route towards FortiAnalyzer needs to be added to the ha-mgmt-interface configuration.
config system interface
edit port4
set ip 10.0.0.1 255.255.255.0
end
config system ha
config ha-mgmt-interfaces
edit 2
set interface port4
set gateway 10.0.0.254
set dst 10.0.12.89 255.255.255.255
next
end
end
Check that a second interface has been added on each cluster node to ha-mgmt-interfaces and the destination has been properly set. Once this is done, FortiGate will use the second ha-mgmt-interface to send logs.
diag sniff packet any ‘host 10.0.12.89 and port 514’ 4
port4 out 10.0.0.1.15530 -> 10.0.12.89.514: syn 694192021
port4 in 10.0.12.89.514 -> 10.0.0.1.15530: syn 3337122392 ack 694192022
port4 out 10.0.0.1.15530 -> 10.0.12.89.514: ack 3337122393
port4 out 10.0.0.1.15530 -> 10.0.12.89.514: psh 694192022 ack 3337122393
port4 in 10.0.12.89.514 -> 10.0.0.1.15530: ack 694192298
Related article:
Technical Tip: Sending messages (logs, SNMP, RADIUS) directly from the HA management interface.
