Hardware: Management Ports?

[VicAndr]

When I look through datasheets of new FortiGate units I see that they (except low models) have a Management Port, and some have even 2 (i.e. FG-300D, FG-500D,...). I have few questions re. those management ports. 1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)? I know that I am missing something here... Can someone answer the above questions? Thank you, VA

[emnoc · Accepted solution]

1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?

1: for out of band management. Ideal when you have a OOB network or some other path. The route table sites as a OOB route-table also 2: not it' s defined for management of the device. Some have dual-management ports. 3: it' s management port.

[emnoc]

This is where 802.1q trunking comes in place. You can craft hundred of vlans and trunking them to your distribution/access core. I personally never heard of anybody using a mgmt interface outside of an ASA for carrying user traffic. Also does anybody know if you can use these for HA and heart-beart monitors?

[Mickey]

emnoc wrote:
This is where 802.1q trunking comes in place. You can craft hundred of vlans and trunking them to your distribution/access core. I personally never heard of anybody using a mgmt interface outside of an ASA for carrying user traffic. Also does anybody know if you can use these for HA and heart-beart monitors?

At least on the FG-500D, you can use either of the two management ports for HA heart-beat.  From the command line you can get the list of allowed HA ports like this:

config system ha

    set hbdev ?

I don't know if the fact that it's not NPU accelerated impacts the performance for HA heartbeat or session synchronization.

[Jupiter_FTNT]

neither of SFP ports on both FG-300D and FG-500D are accelerated as well.

This is wrong, all SFP ports on both 300D and 500D are accelerated by NP6 You can try " d np np6 port-list "

[VicAndr]

Unfortunately I can' t try this CLI commend since I do not have that specific unit. I based my statement on FG-300D FG-500D datasheet which mentions 4 x FortiASIC-accelerated ports on FG-300D and 8 x ones on FG-500D. But thank you - it is good to know, otherwise it would seem to be performance " unbalanced" unit.

[whayden1 · Accepted solution]

VinAndr originally asked the following questions.  I provide the following answers which I think are more accurate and up-to-date.  Some of this post is redundant, but it also corrects misinformation about MGMT ports as they apply to Fortinet.

1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces?

Answer 1: As previously stated numerous times in this thread the MGMT ports provide out-of-band management of the unit in question.  This is important to organizations that have OOBM infrastructure.  The management port can be configured in a number of ways.  In more recent FortiOS you have the option to have management ports dedicated to management functions.

config system interface edit mgmt set dedicate-to management next end

When a port is configured as a dedicated management interface its IP/Subnet will not be advertised or participate in routing.  It's simply an access port.  There are other ways to accomplish this however.  For example you can configure VDOM's where the root VDOM is the Management VDOM and traffic is on another VDOM.  This provides a lot of flexibility.  We could ramble on here for some time so I'll move on.

2. Can those ports handle regular network traffic?

Answer 2: Yes, almost any port on a Fortinet appliance can be tasked to perform any role.  The name of the port is just that, a name.  However not all ports on Fortinet products are equal (see 3).

3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?

Answer 3: Some ports on FortiGates for are ASIC accelerated and other are not.  You will need to check your datasheet to determine which ports are FortiASIC accelerated if any.  Most FortiGates usually have at least 2 ASIC accelerated ports.  In all cases a port labeled MGMT and HA will NOT be accelerated.  This does not mean that you cannot use it as a standard port.  It will work just fine, just don't expect too much of it in terms of UTM capability.  It will have no problems performing straight up IPSEC, Firewall and light UTM functions. I hope this helps clear the waters.