HA Reserved Mgmt Interface for FortiGuards, Syslog, SNMP, etc

[zinkt-101]

New Firewalls HA Setup with Reserved Management Interface

- I have a FortiGate400F internal firewall(not directly connected to internet) with HA A/P mode and three VDOMs.(root, vdomA and vdomB)

- I use my OOB mgmt interface as reserved mgmt in order to monitor both the primary and secondary firewall

FW1 mgmt IP : 192.168.1.1/24 (port 'mgmt)

FW2 mgmt IP : 192.168.1.2/24 (port 'mgmt)

- I also want OOB mgmt interface to use for other services such as SNMP, Syslog.

- Therefore, I have config 'ha-direct enable' so that the Syslog and SNMP traffic is passing through via that OOB mgmt interface.

- However, after reserved interface config, FortiGate is unable to reach to FortiGuards services due to no routing via reserved mgmt interface.

- i want the mgmt interface handle all the things (mgmt, FortiGuards, License, SNMP, Syslog, RADIUS, etc)

How can I archive this setup or what will be the best approach to meet my requirements.

thank you.

[abarushka]

Hello,

Could you please clarify whether routing is configured for HA management?

Routing table (management) can be verified by running the commands below:

execute enter vsys_hamgmt

get router info routing-table all

[zinkt-101]

Hi @abarushka 

Routing is not configured for HA mgmt as we cannot add routing via HA reserved mgmt interface.

Before I config my mgmt interface as

HA reserved mgmt, i have default route configured via mgmt inf to route traffic for all services like snmp, syslog, FortiGuard, license and system dns, etc .

[abarushka]

Hello,

Is there any particular reason why HA management interface routing is not configured? You can find a sample configuration below:

config system ha
config ha-mgmt-interfaces
edit 1
set interface <interface>
set dst <destination IP>
set gateway <IPv4 gateway>
next
end
end

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/313152/out-of-band-managemen...

[zinkt-101]

Oh sorry.

I thought a route under Network.

I did. I have a routing configured under HA mgmt

Dst 0.0.0.0/24

GW. 192.168.1.254

With this setup and ha-direct enable, syslog and snmp are working well.

But FortiGuard, FortiCloud, License and its DNS traffic are not working.

[abarushka]

Hello,

HA-direct won't be applicable for all self-originated traffic.  HA-direct will be applicable for syslog, FortiAnalyzer, FortiManager, SNMP, and NetFlow traffic:

https://docs.fortinet.com/document/fortigate/6.4.1/administration-guide/375961/routing-data-over-the...

Self-originated traffic (i.e. FortiGuard) can be control in an another way. For example:

config log fortiguard setting
set interface-select-method {auto | sdwan | specify}
set interface <interface>
end

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/848980/self-originating-traf...

However, HA management interface cannot be configured for self-originated traffic (i.e. FortiGuard), since HA management interface is in hidden VDOM.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface-s-hidden-...

[zinkt-101]

Hi

Since HA management interface cannot be configured for self-originated traffic (i.e. FortiGuad),

What interface should I use for FortiGuard? I dont want to use traffic interfaces of vdomA and vdomB.

- should i create another interface in root vdom only for FortiGuard?

- should i not use HA reserved feature to route all originated traffic via OOB mgmt?

What would be the best practices.

Thank you.