FG-1800F ha and mgmt

[johnlloyd_13]

hi,

i received a new FG-1800F and saw there's 2x ha and 2x mgmt ports.

my question is, can i just utilize/configure only one of these? i.e. use ha1 and mgmt1 only

or is there a config guide/design to follow wherein i have to use both? seems it will use a lot of switch ports since we're using A/P HA.

what are some common design/scenarios for using two ha and mgmt?

# show system interface 
name    Name.
fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  disable   
ha1   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
ha2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  disable   
mgmt1   static   0.0.0.0 0.0.0.0  192.168.1.99 255.255.255.0  up   disable   physical  disable   
mgmt2   static   0.0.0.0 0.0.0.0  192.168.2.99 255.255.255.0  up   disable   physical  disable   
modem   pppoe   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  down   disable   physical  disable   
naf.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  disable   
port1   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port3   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port4   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port5   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port6   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port7   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port8   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port9   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   
port10   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   

<SNIP>

[Toshi_Esumi]

The HA ports are intended to be connected between units directly without going through switches, if possible. Those are for redundancy. So it of course still work even if one of them is down or not connected. But recommended to connect both for redundancy.
For MGMT ports, even if you don't connect both of them because you don't use/need out-of-band management, they should work fine normally.

Toshi

[johnlloyd_13]

hi,

we use mgmt port for OOB management, so in this case i'll just use mgmt1 port.

is it possible to just use 1x ha port? is it purely for redundancy purpose?

does it give more bandwidth/speed for config and session sync/replication if i use both ha1 and ha2?

[Toshi_Esumi]

That's what we do for different models. That should be fine. In your case one interface even has 10G bandwidth.

Toshi

[johnlloyd_13]

hi toshi,

can you please elaborate on what you do for different models?

i only found FG 1800F fast path architecture doc but it's not in depth.

do you use just a single mgmt and ha on "higher" FG models? or both for redundancy?

is there any performance issue with single port vs dual port design?

[Toshi_Esumi · Accepted solution]

I was talking about HA interfaces like on 100Fs, which has two 1G ports. We use MGMT1 for MGMT but use MGMT2 for HA with 1500D because there is no dedicated HA interface.
I don't see much necessity/added benefit to have two MGMT ports. They're not supposed to carry any user traffic. So not sure FTNT's design concept having two MGMT ports while there is a separate HA port(s).

And 1000F has one MGMT and one HA port only.

Toshi