Created on 11-04-2016 06:30 AM Edited on 03-28-2024 11:48 AM By lsaroukhani
Description
Scope
All FortiGate models with mgmt interface running supported FortiOS versions (FortiGate 100D, 200D, 900D, 1000D and 3040C running FortiOS 5.0, 5.2 or 5.4).
Solution
Dedicating an interface to management can be done in GUI as well as CLI:
config system interface
edit mgmt
set dedicated-to management
end
Note that when "config system dedicated-mgmt" is enabled and the interface is set to mgmt1:
config system dedicated-mgmt
set status enable
set interface "mgmt1"
set default-gateway 10.24.3.200
set dhcp-server enable
set dhcp-netmask 255.255.252.0
set dhcp-start-ip 10.24.3.201
set dhcp-end-ip 10.24.3.210
end
In the background, the FortiGate creates a hidden VDOM named ”dmgmt-vdom" and the mgmt1 interface VDOM will be switched from root to dmgmt-vdom:
config system interface
edit "mgmt1"
set vdom "dmgmt-vdom"
set ip 10.24.3.199 255.255.252.0
set allowaccess ping https ssh http telnet
set type physical
set dedicated-to management
set role lan
set snmp-index 27
next
end
To enter the dmgmt-vdom VDOM on the FortiGate:
# execute enter dmgmt-vdom
current vdom=dmgmt-vdom:3
# get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default
Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 10.24.3.200, mgmt1, [1/0] <=====Default route via mgmt1 created in dmgmt-vdom
C 10.24.0.0/22 is directly connected, mgmt1
Mgmt1 cannot be referenced in the configuration file anymore.
To keep mgmt1 as a dedicated-to management interface and to allow referencing it in the configuration file, a VRF can be set on mgmt1 instead:
config system dedicated-mgmt
set status disable
end
config system interface
edit "mgmt1"
set vdom "root"
set vrf 1
set ip 10.24.3.199 255.255.252.0
set allowaccess ping https ssh http telnet
set type physical
set dedicated-to management
set role lan
set snmp-index 27
next
end
Default route via mgmt1 can be created:
config router static
edit 0
set gateway 10.24.3.200
set device "mgmt1"
next
# get router info routing-table database
Routing table for VRF=1
S *> 0.0.0.0/0 [10/0] via 10.24.3.200, mgmt1, [1/0]
C *> 10.24.0.0/22 is directly connected, mgmt1
Related article:
Technical Tip: FortiGate SNMP polling via the dedicated HA management port - HA status MIB OID
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.