Dear All,
When running FGCP is there any way to maintain a separate MGT IP on the active and passive FGTs?
I can see that the data-plane interfaces on the units need layer two reachability because in the event of a failover the IP and MAC will float to the standby unit (and GARP will take place). It seems a bit awkward to have the same MGT IP float between the boxes because you wouldn't get any direct SSH/SNMP/HTTPS reachability of the standby for monitoring purposes.
Additionally, if one used dynamic routing on the FGT, wouldn't you need to peer with the virtual IP on the upstream switch? Again, this seems a bit awkward compared with FGSP.
Many thanks again for any insight.
James.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I believe this is what you're looking for?
https://kb.fortinet.com/kb/documentLink.do?externalID=FD32214
Thank you! I deleted all references to my existing "mgmt1" interface then applied the commands you referenced. Now I can SSH individually to each. This is progress, but may I ask some follow-on questions?
config system ha
set ha-mgmt-status enable
config ha-mgmt-interfaces
edit 1
set interface "mgmt1"
set dst 10.0.0.254
next
end
end
DeviceA:
config system interface
edit mgmt1
set ip 10.0.0.1 255.255.255.0
set allowaccess ping ssh fgfm https snmp
set type physical
set dedicated-to-management
next
end
DeviceB:
config system interface
edit mgmt1
set ip 10.0.0.2 255.255.255.0
set allowaccess ping ssh fgfm https snmp
set type physical
set dedicated-to-management
next
end
1. Will this work with FMG and FAZ?
2. Will on-box agents like NTP and SNMP-Traps know to use this MGT path?
3. I used to keep mgmt1 in the a vdom named root and set a local-in policy. Is this no longer possible? I notice that I can no longer do a "set vdom root" under the mgmt1 interface? Is there anyway to secure the management?
Kind regards
James.
Interesting questions, and I'm afraid I don't know all the answers. Perhaps one of the other more experienced admins will weigh in, but I can say this:
[ol]Hi, guys,
I am also facing this problem ( I am using Forti600E with V6.4.4 :(
When I configured the "mgmt" port, got the following problem:
Forti600E_04 # config system ha Forti600E_04 (ha) # set ha-mgmt-status enable Forti600E_04 (ha) # config ha-mgmt-interfaces Forti600E_04 (ha-mgmt-interfaces) # edit 1 new entry '1' added
Forti600E_04 (1) # set interface "mgmt" node_check_object fail! for interface mgmt
value parse error before 'mgmt' Command fail. Return code -23
Forti600E_04 (1) #
The command "set dedicated-to management"also can not be applied to this physical interface "mgmt".
May I know if the "mgmt1" is virtual interface or what else ?
many thanks
Had a similar problem last night. You need to go through every vdom and delete references to the interface giving the error (mgmt). It's a pain, but the GUI can show you show many references are left. Check out this post (near the end) which show the same problem and solution: [link]https://forum.fortinet.com/tm.aspx?m=126650[/link]
Also, after "set interface " enter the ? (question mark) to see what is in the list. On my model it's mgmt1 or mgmt2. If you have just mgmt, it might be a virtual IF created by someone, you can check by doing a "show" under "config system interface".
Do you think I also need ha-direct to get SNMP, NTP etc working?
config system ha
set ha-direct enable
end
There some interesting discussion about the reserved-management interface being added to a hidden vdom named "vsys_ha". I wonder if the local-in policy can be tweaked inside this?
Unfortunately the whole MGT configuration with FGCP is a bit messy. It's a shame because the "HA Reserved Management" really would solve a lot of problems if you could only secure it.
Update. Our Fortinet SE provided some helpful guidance on this.
# Indicate the managementVDOM here ('root' by default):
config system global
set management-vdom root
end
# Your ha-reserved-management IP can then be secured using local-in policies in the indicated vdom with an extra line on each policy
config vdom
edit root
config firewall local-in-policy
edit 1
set ha-mgmt-intf-only enable <- applies the local-in poliy to the ha-reserved-management ip
set intf "any"
set srcaddr "all"
set dstaddr "all"
set service "SSH"
set schedule "always"
set action accept
next
edit 9
set ha-mgmt-intf-only enable <- applies the local-in poliy to the ha-reserved-management ip
set intf "any"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set schedule "always"
set action deny
next
end
Yes it's possible to achieve that, you can use the "set management-ip" command to set a different ip on each cluster node.
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/349060/in-band-management
Another important discovery is that FMG doesn't work with the ha-reserved-management IP. It will add the device correctly, but once you install a policy the installation gets stuck at 35% and the FGFM connection will drop.
There is a KB mentioning this, but not suggesting a solution:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD37209&sliceId=1
It seems that another interface can be used for the FMG. If anyone has tried this could you let me know please?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.