Configuring MGMT interface on same subnet as WAN1 (Outside) interface on HA Pair

[gweatherall]

I'm configuring a pair of FortiGate 100E firewalls in our lab as a pilot to convert from Cisco ASA 5510 firewalls to FortiGate 100E firewalls and I've been able to replicate the majority of the hardware configuration, but I'm running into some issues with a management interface and HA sync.

On the ASA, we use the WAN interface for management of both the active and standby firewalls. Cisco ASA interfaces can be configured with a "standby" command <ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2 for example> and the standby firewall will be reachable by the standby IP Address. However, this doesn't appear to be an option on the FortiGate. My workaround was going to be configuring a static management IP Address on both the primary and secondary firewalls in the same subnet as the WAN1 interface, so that we could always reach them. In theory, I'd like it to look something like this:

WAN1 - 192.168.1.1

Primary MGMT - 192.168.1.2

Secondary MGMT - 192.168.1.3

I'm able to configure the interfaces without any issues, but I cannot actually ping or reach the MGMT interfaces, and there doesn't appear to be a way to configure a static default route out using the MGMT interface (I probably don't want to anyway, since I want all outbound traffic to leave over the WAN1 interface).

How can I set up my MGMT interface to use the same subnet as the WAN1 interface and still be able to reach it remotely?

[emnoc · Accepted solution]

I would not do that in a real life  but you can probably set  a dedicate interface AUX/MGT in the ha-cfg and set the gateway

e.g

config system ha     set group-name "myfgthasgrp"     set mode a-p     set password ENC TB1sAMk9folBwB9s9xqhWiNp+iGAaB/TcyLiLWX+Y+9ssz8RnAE6hACHJFYLJpRc2DSygnAE7i+mPjuciSMQVFo9zN93xGxW846mBFYQ8sccdt1GdAeQERvc+RGikkeFEuWzde9+58zbXxoW6LzFmnT+d8it4yA/z1peHdnu18MA/kxCAqo5Pv5oGHF/rBE4uaFYqQ==     set hbdev "port5" 50 "port6" 50     set session-pickup enable     set ha-mgmt-status enable     set ha-mgmt-interface "mgmt"     set ha-mgmt-interface-gateway 10.1.1.1     set override enable     set priority 100     set monitor "port1: end

config sys interface

   edit "mgmt"         set vdom "root"         set ip 10.1.1.11 255.255.255.0         set allowaccess ping https ssh snmp fgfm         set type physical         set dedicated-to management         set description "FGT1500D MANAGEMENT LAN ACCESS"         set device-identification disable         set lldp-transmission enable         set listen-forticlient-connection disable         set snmp-index 122     next

end

Do that on each  unit HA-cfg but yes this is not 100% like a  ciscoASA

BTW you can cli exe ha managment  ( this is close to asa cli changeto )

Ken

[gweatherall]

Thanks Ken, turns out the only line I was missing was to define the ha-mgmt-interface-gateway IP Address. We're using this method because these are being placed into an existing production environment and we want to keep mgmt access on the same VLAN as before, without needing to create a separate subnet for OOB MGMT. Our main goal is to be able to reach the standby firewall via SSH or Web while the primary.

[emnoc]

Glad it works out for you. You can use the  AUX interfaces on models so equipped. What I like about the earlier cisco ASA, the "mgmt" interface could be used as data-flow ports. FortiOS allows you to dedicate interfaces for management which will not part-take of any vdom  route table.

Ken

[Toshi_Esumi]

Although I haven't tried it myself, it's a surprise you could configure two different IPs in a same subnet on two interfaces, wan1 and mgmt. I expected you couldn't configure.

By the way, the mgmt interface you configured in HA becomes a special interface only for management. And it completely separated from interfaces for user traffic. I would just use 192.168.1.1/xx for WAN1 for regular management access that let you get in the active/master unit at that time. Then like 192.168.2.1/29 and .2/29 at mgmt on both units with a GW 192.168.2.1 on the switch/router side for specific unit access.