Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
flamer
New Contributor II

HA management behind VPN

Hi we have a firewall cluster in another country with an IPSEC VPN back to our local termination point.

 

We can access the primary firewall using its LAN interface, but we need to be able to access the secondary firewall directly aswell (for snmp monitoring etc).

 

When adding a new loopback, and adding it as a dedicated to management and HA direct interface, the traffic comes in through the VPN but routes out the LAN interface (hits a generic static route) It seems we cannot route any traffic once we have enabled dedicated to management option.

 

Is there a solution for this?

2 REPLIES 2
Toshi_Esumi
SuperUser
SuperUser

Not sure if this would satisfy your requirement "directly". But one way is to set physical loop connections. Lets say ...
[port-x on both units] -> switch on the same vlan-> [port-y on both units/dedicated-to management port]

Then you can set a unique IP on port-y on both units. This would work if the units have enough ports because it would require two additional ports.

The main issue is those dedicated-to management port/interface IPs wouldn't be in the regular routing-table. It's separated. So only way to route from the regular/user part of FGT to dedicated-to management part is to get out the unit once then come back in physically.

Toshi

flamer
New Contributor II

thanks for the reply, these are actually VM's in Azure, the theory would still work using a shared vlan, unfortunately they don't trust us network folk in the backend of Azure :(

 

I suspect using a layer 3 capable switch could make it work aswell, put a /32 route on the primary Fortigate pointing the secondary mgmt IP at a layer3 sub-int on the switch, and have the switch have another layer 3 sub-int in the same subnet as the dedicated management interface.

 

Unfortunately all way too expensive and complex for a CSP environment. 

 

Is there any other way to make an IP address not float, without making it an HA direct interface?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors