Hi,
On a 100D, we'd love to have a "real" mgmt interface (really out-of-band, not tied into any "production" routing table).
We have come across several things:
With VDOMs disabled, what are the differences between:
- config system interface: dedicated-to management ?
- config system interface: edit mgmt: set vdom dmgmt-vdom ? - config system dedicated-management (can someone explain what the second part of "This port is in the hidden VDOM dmgmt-vdom, which cannot be made the management VDOM" means) ?
Do you need to set these 3 things, or only part of them, or...?
In any case we couldn't make it work that the firewall was still reachable on mgmt when these things were configured.
config system ha set group-name "fn" set mode a-p set password ........ set hbdev "ha1" 50 set session-pickup enable set ha-mgmt-status enable set ha-mgmt-interface "mgmt" set ha-mgmt-interface-gateway 172.22.112.1 set override enable set priority 250 set monitor "dmz" "port1" end config system dedicated-mgmt set status enable set interface "mgmt" set default-gateway 172.22.112.1 end config system interface edit "mgmt" set ip 172.22.112.11 255.255.255.0 set allowaccess ping https ssh snmp http fgfm set type physical set dedicated-to management set snmp-index 8 next end
Now, with VDOMs enabled, it seems you can have a mgmt vdom
- config system global: mangement-vdom
- but only if ha-mgmt-enable is disabled.... because otherwise the mgmt port is assigned some internal vsys_ha VDOM
Then there is the reserved manamagent interface feature when HA is used. We currently use that with VDOMs disabled as we find that comes closest to what we want, and also closest to a working config. (I believe this case also uses the hidden vsys_ha VDOM).
When accessing the firewall over the management IP (thus the o-o-b management interface) it should reply using that address and on the mgmt interface, always.
Same for local originating outgoing traffic like "execute backup", traceroute, ping etc. which are managements actions IMHO.
At least you should be able to choose. "execute ping-options source" however even bails out with "binding source interface address error" when you tell it to use the mgmt source address. Traceroute clearly takes the "production" network route too. But "execute backup" is what troubles me most.
Can someone please enlighten me why having the o-o-b mgmt is always this complicated, and how to make it run smoothly? :)
Thanks,
Marki
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
I'm not familiar with management vdoms, but we have fortigate 1500D in ha a-a mode with vdoms and dedicated management of each node.
The way we achieved this was by:
config global
config system interface
edit mgmt1
set ip x.x.x.x/yy (each node has its own IP) set allowaccess ping https ssh snmp fgfm set dedicated-to management
end
config system ha [...]
set ha-mgmt-status enable
set ha-mgmt-interface "mgmt1" set ha-mgmt-interface-gateway z.z.z.z [...] end
BTW:
mgmt1 Interface is not assigned to any vdom in this case
I think that's all. I assume that there is not much difference when not using vdoms.
I hope this helps...
Greetings, hallodri
Hi again,
This is still not clear to me. Can someone tell me exactly what the following does and what the nuances are? (Support is unable to)
1)
config system dedicated-mgmt <-------------------
set status enable
set interface "mgmt"
set default-gateway ip.add.re.ss
end
2)
config system interface
edit "mgmt"
...
set dedicated-to management <-------------------
...
next
end
3) Why is it that FortiGateVMs don't seem to have dedicated-mgmt capability? Why would you not need that capability in the VM?
Bye
Marki
1) This CLI enables the so called OOB management in the mgmt port of the FortiGate. Thus, the "set default-gateway" command is need to set the default gateway to be used by the management traffic. e.g. not use the gateway that is been set through the static route (config router static).
2) This is a different story. With this command, you dedicate the management port for management only, e.g. not participate in the routing process. If you unset the mgmt port from dedicated, then this port becomes interface, e.g. it does routing and you can use it in firewall policies. This way you get an extra interface, but this interface is not ASIC accelerated.
3) This is my question too. I guess this is because the VM uses general purpose hardware and cannot do this.
Hi,
We same issue with our 100D device. Have followed all the above steps and still getting the below errod when we try to add command "set ha-mgmt-interface mgmt.".
FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt
value parse error before 'mgmt' Command fail. Return code -23
Attaching complete configurations as well.
FW01 (ha) # show config system ha set group-id 10 set group-name "FW-HA" set mode a-p set password ENC +Fbws9H6Vq9J0lEtMRiMSk1H5mWhbLSfTdKgXEs4r23f1TiHw98FVsXFileusW730cvfDQ== set session-pickup enable set override enable set priority 100 set monitor "Admin-VPC" "SAM-VPC" end
FW01 (ha) #
FW01 (mgmt) # show config system interface edit "mgmt" set vdom "dmgmt-vdom" set ip 172.29.8.27 255.255.252.0 set allowaccess https ssh set type physical set dedicated-to management set description "For Unit Management" set snmp-index 6 next end
FW01 (mgmt) #
FW01 (dedicated-mgmt) # show config system dedicated-mgmt set status enable set interface "mgmt" set default-gateway 172.29.8.1 end
FW01 (dedicated-mgmt) #
FW01 (ha) # set ha-mgmt-status enable
FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt
Hello guys,
I suppose that lijo.joseph would have fixed the issue about the error when adding the command "set ha-mgmt-interface mgmt.", but I have faced today this same problem and I haven't found any tip to fix that on the forum neither searching on Google. I have found what the problem was so I think it will save some time to the next admin that face that problem to have this info.
Fortigate (ha) # set ha-mgmt-interface mgmt1 node_check_object fail! for ha-mgmt-interface mgmt1
value parse error before 'mgmt1' Command fail. Return code -23
The actual problem in my case, which is a default configuration, is that the interface mgmt1 has a reference on the dhcp server...
config system dhcp server edit 1 ... set interface "mgmt1"
...
...then I deleted the reference and I have been able to add the command "set ha-mgmt-interface mgmt1".
I hope this will be useful for somebody.
Regards,
Paco.
Thanks Paco,
That was exactly my issue as well and its been visible with
fw # show | grep -f mgmt1
Once I deleted the reference from DHCP config was able to add MGMT1 as dedicated HA Management ( aka unit management ) interface
Regards,
Lijo
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1468 | |
1006 | |
748 | |
443 | |
206 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.