Created on
04-05-2010
04:04 AM
Edited on
09-24-2025
05:35 AM
By
Jean-Philippe_P
Description
This article describes how to configure the FortiGate HA Reserved Management Interface.
The aim is to provide direct management access to each cluster unit using a different IP address by reserving a management interface as part of the HA configuration.
This simplifies the use of external services such as SNMP to monitor and manage the cluster units.
Note/prerequisite:
It is not possible to use this interface to route traffic as it is an Out-Of-Band management interface for each cluster member, use a different subnet for 'HA Reserved Management Interface (Out-Of-Band) than the cluster access subnet, and if the need is to use the same subnet, consider using In-Band Management as explained in this article: Technical Tip: How to implement In-Band Management.
Scope
FortiGate.
Solution
In a multi-VDOM setup, use the following command:
config global
config load-balance setting
set slbc-mgmt-intf port2
end
Note:
The interface must not be referenced in any config to be set as a reserved management interface. To check if the interface is referenced, use this KB article: Technical Tip: How to Check Referenced Objects.
execute ha manage <HA cluster index of slave> <username> <password>
For v6.4.x and newer versions:
Configuration using the CLI:
config system ha
set ha-mgmt-status [enable|disable]
config ha-mgmt-interface
edit <x>
set interface <interface name>
set gateway <xxx.xxx.xxx.xxx>
next
end
As an example, this is how this configuration looks on the CLI:
The gateway IP address has to be configured on the secondary unit as well. Without configuring the gateway IP on the secondary unit, the secondary unit cannot be accessible from the GUI.
For version 7.6.3+ FortiOS supports IPv6 for HA reserved management port and usage of IPv6 gateway:
config system ha
set ha-mgmt-status [enable|disable]
config ha-mgmt-interface
edit <x>
set interface <interface name>
set gateway <xxx.xxx.xxx.xxx>
set gateway6 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
next
end
end
Related documents:
Technical Tip: Default route via HA reserved management Interface not visible on route table
Out-of-band Management with reserved management interfaces
Setting up an HA reserved management Interface on the FortiGate 6000 Chassis
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.