Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
j_a_m_e_s
New Contributor III

FGCP Management IP

Dear All,

 

When running FGCP is there any way to maintain a separate MGT IP on the active and passive FGTs? 

 

I can see that the data-plane interfaces on the units need layer two reachability because in the event of a failover the IP and MAC will float to the standby unit (and GARP will take place). It seems a bit awkward to have the same MGT IP float between the boxes because you wouldn't get any direct SSH/SNMP/HTTPS reachability of the standby for monitoring purposes.

 

Additionally, if one used dynamic routing on the FGT, wouldn't you need to peer with the virtual IP on the upstream switch? Again, this seems a bit awkward compared with FGSP.

 

Many thanks again for any insight.

 

James.

 

11 REPLIES 11
lobstercreed
Valued Contributor

I believe this is what you're looking for?

 

https://kb.fortinet.com/kb/documentLink.do?externalID=FD32214

j_a_m_e_s

Thank you! I deleted all references to my existing "mgmt1" interface then applied the commands you referenced. Now I can SSH individually to each. This is progress, but may I ask some follow-on questions?

 

config system ha
 set ha-mgmt-status enable
 config ha-mgmt-interfaces
  edit 1
   set interface "mgmt1"
   set dst 10.0.0.254
  next
end
end

DeviceA:

config system interface
  edit mgmt1

   set ip 10.0.0.1 255.255.255.0

   set allowaccess ping ssh fgfm https snmp

   set type physical

   set dedicated-to-management
  next
end

DeviceB:

config system interface
  edit mgmt1

   set ip 10.0.0.2 255.255.255.0

   set allowaccess ping ssh fgfm https snmp

   set type physical

   set dedicated-to-management
  next
end

 

1. Will this work with FMG and FAZ?

2. Will on-box agents like NTP and SNMP-Traps know to use this MGT path?

3. I used to keep mgmt1 in the a vdom named root and set a local-in policy. Is this no longer possible? I notice that I can no longer do a "set vdom root" under the mgmt1 interface? Is there anyway to secure the management?

 

Kind regards

 

James.

 

lobstercreed

Interesting questions, and I'm afraid I don't know all the answers.  Perhaps one of the other more experienced admins will weigh in, but I can say this:

[ol]
  • It works, yes.  Both systems recognize this as an HA cluster, and to be honest I haven't really investigated which interface the source traffic comes from.  I think it's the dedicated management but I'm not really sure.
  • I know that SNMP uses the dedicated management port as that's part of the point (mentioned explicitly in the link), and I think NTP does but again haven't necessarily double-checked the sniffs.
  • I've never used VDOMs that way and am not sure the exact ramifications of this but I don't know why local-in policies wouldn't still apply the same way they do to any other interface.[/ol]
  • BensonLEI

    Hi, guys,

    I am also facing this problem ( I am using Forti600E with V6.4.4 :(

     

    When I configured the "mgmt" port, got the following problem:

    Forti600E_04 # config system ha Forti600E_04 (ha) # set ha-mgmt-status enable Forti600E_04 (ha) # config ha-mgmt-interfaces Forti600E_04 (ha-mgmt-interfaces) # edit 1 new entry '1' added

    Forti600E_04 (1) # set interface "mgmt" node_check_object fail! for interface mgmt

    value parse error before 'mgmt' Command fail. Return code -23

    Forti600E_04 (1) #

     

     

    The command "set dedicated-to management"also can not be applied to this physical interface "mgmt".

     

    May I know if the "mgmt1" is virtual interface or what else ?

     

    many thanks

    j_a_m_e_s
    New Contributor III

    Had a similar problem last night. You need to go through every vdom and delete references to the interface giving the error (mgmt). It's a pain, but the GUI can show you show many references are left. Check out this post (near the end) which show the same problem and solution: [link]https://forum.fortinet.com/tm.aspx?m=126650[/link]

     

    Also, after "set interface " enter the ? (question mark) to see what is in the list. On my model it's mgmt1 or mgmt2. If you have just mgmt, it might be a virtual IF created by someone, you can check by doing a "show" under "config system interface".

    j_a_m_e_s
    New Contributor III

    Do you think I also need ha-direct to get SNMP, NTP etc working?

     

    config system ha
     set ha-direct enable
    end

     

    There some interesting discussion about the reserved-management interface being added to a hidden vdom named "vsys_ha". I wonder if the local-in policy can be tweaked inside this?

     

    Unfortunately the whole MGT configuration with FGCP is a bit messy. It's a shame because the "HA Reserved Management"  really would solve a lot of problems if you could only secure it.

     

    j_a_m_e_s
    New Contributor III

    Update. Our Fortinet SE provided some helpful guidance on this. 

     

    # Indicate the managementVDOM here ('root' by default):
    config system global
     set management-vdom root
    end

     

    # Your ha-reserved-management IP can then be secured using local-in policies in the indicated vdom with an extra line on each policy

    config vdom
    edit root
    config firewall local-in-policy
        edit 1
            set ha-mgmt-intf-only enable <- applies the local-in poliy to the ha-reserved-management ip
            set intf "any"
            set srcaddr "all"
            set dstaddr "all"
            set service "SSH"
            set schedule "always"
            set action accept
        next
        edit 9
            set ha-mgmt-intf-only enable <- applies the local-in poliy to the ha-reserved-management ip
            set intf "any"
            set srcaddr "all"
            set dstaddr "all"
            set service "ALL"
            set schedule "always"
            set action deny
        next
    end

    WD40
    New Contributor

    Yes it's possible to achieve that, you can use the "set management-ip" command to set a different ip on each cluster node.

    https://docs.fortinet.com/document/fortigate/6.0.0/handbook/349060/in-band-management

     

     

    j_a_m_e_s
    New Contributor III

    Another important discovery is that FMG doesn't work with the ha-reserved-management IP. It will add the device correctly, but once you install a policy the installation gets stuck at 35% and the FGFM connection will drop. 

     

    There is a KB mentioning this, but not suggesting a solution:

    https://kb.fortinet.com/kb/viewContent.do?externalId=FD37209&sliceId=1

     

    It seems that another interface can be used for the FMG. If anyone has tried this could you let me know please?

    Labels
    Top Kudoed Authors