Access to other devices on mgmt VLAN through fortigates

[damianhlozano]

Hello team!!!

We have 2 Fortigates 100F in HA, we have connected the management VLAN (VLAN 30) on "Mgmt" interface on both Fortigates (VLAN 30 is untagged on ports where Mgmt interfaces are connected) and configured HA to use Mgmt interface as "Out of band", with dedicated IP for both Fortigates (A boss wanted to configure this as out of band)

Now, we have many other devices on the management VLAN.

We cannot access to any device on the management VLAN, from a computer in another VLAN, but we need to this to be possible.  Also, we need to access Fortigates from another VLAN.

I think I can add routes in FGTs, because the mgmt network segment is not on the routing table, but this seems dirty to me.  It sounds like "out of band" doesn't make sense in that case.

I think I can add VMs in the management VLAN for this purpose, but I am adding steps to access to Fortigates and switches

Which is the common scenario for management VLAN?

All people who needs to access any device in the Management VLAN should be in this VLAN?

Other devices as switches, aps, etc, should be in different VLAN? 

Thanks in advance.

Regards,

Damián

[Kangming]

mgmt can use an independent routing table. You can refer to this kb to set the management IP for the 2 devices of HA respectively. The GW of the management IP is set under HA setting.

Technical Tip: HA Reserved Management Interface

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/1901...

[damianhlozano]

Thanks for your response Kangming!!

I know about this, I used this, previously, to set mgmt interface as "Out of band"

My question is about standards for Fortigates:

Which is the common scenario for management VLAN?

All people who needs to access any device in the Management VLAN should be in this VLAN?

Other devices as switches, aps, etc, should be in different VLAN? 

Thanks in advance.

Regards,

Damián

[Kangming]

>>>Which is the common scenario for management VLAN?

I think your VLAN30 is the standard management VLAN scenario, and the mgmt interfaces of all devices are connected to VLAN30.

For information about managing FGT mgmt access, please refer to this kb:

Technical Tip: HA Reserved Management Interface

How to manage and control the access of VLAN 30 traffic through FGT can be operated on FGT as follows:

We can configure an independent interface on FGT, such as Port10 (For ACCESS mgmt device). This interface Port10(The IP address is in the same network segment as MGMT, they have separate routing tables) is connected to the SW of VLAN 30. Then FGT can configure routing and policies for accessing the devices in management VLAN 30 through Port10.

>>>All people who needs to access any device in the Management VLAN should be in this VLAN?

Administrators can usually be located in any VLAN and only need to be controlled by routing and policies. Unless there are special requirements. Administrator control can usually be securely controlled through trusted hosts, two-factor authentication, LDAP authentication, etc., and rarely controlled through a separate VLAN/network segment.

>>>Other devices as switches, aps, etc, should be in different VLAN? 

This is entirely determined by the design of the network. If the network is small, all can be placed in the same VLAN. If there are many departments and many devices that need to be managed separately, then a good VLAN and IP address design is needed to manage these SW/AP/Router/FW, etc., which are in different locations, departments, and functions. Therefore, there is no definite answer to this question. Everything is based on network design and planning.

[damianhlozano]

Thanks Kangming!!

Ok, the question about other devices was dumb, sorry.

Now, please figure this out:

* FGT1: 192.168.29.8/24

* FGT2: 192.168.29.9/24

* SW1: 192.168.29.118/24

All in the same VLAN 30

From SW1 I can ping FGT1 and FGT2

From another device on same VLAN, I can ping SW1

From FGT1 or FGT2, I cannot ping SW1

Why? I think this is because 192.168.29.0/24 is not on the routing table of FGTs. (Because of the "Out of band")

I think I can add routes in FGTs, but this seems dirty to me.  It sounds to me like "out of band" doesn't make sense in this case.

Is there a way to solve this without adding routes?

Thanks in advance.

Regards,

Damián

[Kangming]

OK, I got your point. You have configured "Technical Tip: HA Reserved Management Interface" and you want to ping the SW of the same management network segment through FGT mgmt HA reserved interface, right?

You need to follow the following steps, because "HA Reserved Management Interface" is equivalent to an independent VDOM in the background. You need to switch to it before you can use the mgmt interface of HA to ping.

The steps I gave you are on the root, which is why I need you to configure a new port10 and vlan30 IP address for it in the root vdom, so that you can access all addresses in VLAN30 through root vdom.

If you only want to ping SW through FGT, you can do it in the following this way

Can refer kb link(The links of these two KBs should perhaps be linked to each other so that customers can more easily obtain related information):

Technical Tip: HA Reserved Management Interface's hidden VDOM (vsys_hamgmt VDOM)

FGT1-LEFT # exe enter ?
<name>    vdom name
root
vsys_hamgmt

FGT1-LEFT # exe enter vsys_hamgmt  
current vdom=vsys_hamgmt:1

FGT1-LEFT # get router info routing-table all   
...
Routing table for VRF=0
C       192.168.91.0/24 is directly connected, port6

FGT1-LEFT # diagnose ip route list
...
tab=254 vf=1 scope=0 type=1 proto=17 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=192.168.91.254 dev=8(port6)  
...

FGT1-LEFT # exe ping 192.168.91.254
PING 192.168.91.254 (192.168.91.254): 56 data bytes
64 bytes from 192.168.91.254: icmp_seq=0 ttl=128 time=0.9 ms
64 bytes from 192.168.91.254: icmp_seq=1 ttl=128 time=1.3 ms
64 bytes from 192.168.91.254: icmp_seq=2 ttl=128 time=0.8 ms
64 bytes from 192.168.91.254: icmp_seq=3 ttl=128 time=0.5 ms
64 bytes from 192.168.91.254: icmp_seq=4 ttl=128 time=0.7 ms

[damianhlozano]

Yes, thanks, you got my point!!!

I need some time to read and test this, but I dont have enought time right now

I will see this later and will post here the results

Regards,

Damián

[damianhlozano]

Hello Kangming!

Accessing the "vsys_hamgmt" vdom I can ping anything else on the management VDOM.

Now, please, figure this out:

* I have a computer in another VLAN, for example, PC01 on VLAN 10.

* The default gateway of the PC01 is the IP of Fortigates on this VLAN 10

* I need to access from the computer on VLAN 10 to SW1

What can I do in this case?

I cannot create rules, using mgmt interface.

I need to create an inter-vdom link?

Thanks in advance.

Regards,

Damián

[Kangming]

Please refer to this comment:

>>>How to manage and control the access of VLAN 30 traffic through FGT can be operated on FGT as follows:

We can configure an independent interface on FGT, such as Port10 (For ACCESS mgmt device). This interface Port10(The IP address is in the same network segment as MGMT, they have separate routing tables) is connected to the SW of VLAN 30. Then FGT can configure routing and policies for accessing the devices in management VLAN 30 through Port10.

Add VLAN10 to VLAN 30(Port10) policy and the appropriate routing.

[damianhlozano]

Sorry, I left that out in a hurry.

This sounds like an option, I will try this later.

Thanks a lot!!

Regards,

Damián