- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
(For your reference ) OOB mgmt interface for HA cluster management interface
Starting with FortiOS 5.6, there is a new way to access every machine directly. This method is In-Band ( or OOB ) and does not require a reserved interface.
For example: Two Fortigate 600E devices ( I am using v6.6.4) and forming a HA-pair; an IP address for their OOB mgmt interface individually, and an IP address for the HA-cluster; as the following requirement (no mgmt VDOM, and the following configuration through root VDOM) : 1. 10.101.1.40 ( for the cluster IP = always towards the master unit) 2. 10.101.1.39 ( for the OOB "mgmt" interface of the primary Fortigate) 3. 10.101.1.41 ( for the OOB "mgmt" interface of the secondary Fortigate) 4. The above IP addresses should not be overlapped
============================================================
The configuration is so simple and direct:
1. set up the HA-pair hardware
2. configure the physical mgmt interface without no IP
3. set up a virtual HA_interface under this physical mgmt interface as the following:
That is all configuration, simple enough.
==============================================================
My configuration
============================================
Forti600E_03 # sh sys int mgmt config system interface edit "mgmt" set vdom "root" set allowaccess snmp fgfm ftm set type physical set lldp-reception disable set lldp-transmission disable set role lan set snmp-index 2 next end
Forti600E_03 # sh sys int HA_mgmt_Port config system interface edit "HA_mgmt_Port" set vdom "root" set management-ip 10.101.1.39 255.255.255.0 set ip 10.101.1.40 255.255.255.0 set allowaccess ping https ssh snmp set role lan set snmp-index 26 set interface "mgmt" set vlanid 11 next end
10.101.1.40 = HA-pair IP
10.101.1.39 = individual Fortigate IP
=======
virtual mac add for the HA-pair IP = 10.101.1.40 ( from outside )
virtual mac add for the physical interface = 10.101.1.39 ( from outside, the active fortigate device )
mac addr for the physical interface = 10.101.1.41 ( from outside, the standby fortigate device )
------------ARP list----------------------
FG1111D_B # get sys arp | grep 10.101 ... 10.101.1.39 5 00:09:0f:09:11:01 v11 10.101.1.40 0 00:09:0f:09:11:01 v11
Hope this is useful to you
Cheers
