HA management behind VPN

[flamer]

Hi we have a firewall cluster in another country with an IPSEC VPN back to our local termination point.

We can access the primary firewall using its LAN interface, but we need to be able to access the secondary firewall directly aswell (for snmp monitoring etc).

When adding a new loopback, and adding it as a dedicated to management and HA direct interface, the traffic comes in through the VPN but routes out the LAN interface (hits a generic static route) It seems we cannot route any traffic once we have enabled dedicated to management option.

Is there a solution for this?

[Toshi_Esumi]

Not sure if this would satisfy your requirement "directly". But one way is to set physical loop connections. Lets say ...
[port-x on both units] -> switch on the same vlan-> [port-y on both units/dedicated-to management port]

Then you can set a unique IP on port-y on both units. This would work if the units have enough ports because it would require two additional ports.

The main issue is those dedicated-to management port/interface IPs wouldn't be in the regular routing-table. It's separated. So only way to route from the regular/user part of FGT to dedicated-to management part is to get out the unit once then come back in physically.

Toshi

[flamer]

thanks for the reply, these are actually VM's in Azure, the theory would still work using a shared vlan, unfortunately they don't trust us network folk in the backend of Azure :(

I suspect using a layer 3 capable switch could make it work aswell, put a /32 route on the primary Fortigate pointing the secondary mgmt IP at a layer3 sub-int on the switch, and have the switch have another layer 3 sub-int in the same subnet as the dedicated management interface.

Unfortunately all way too expensive and complex for a CSP environment. 

Is there any other way to make an IP address not float, without making it an HA direct interface?