Hardware: Management Ports?

[VicAndr]

When I look through datasheets of new FortiGate units I see that they (except low models) have a Management Port, and some have even 2 (i.e. FG-300D, FG-500D,...). I have few questions re. those management ports. 1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)? I know that I am missing something here... Can someone answer the above questions? Thank you, VA

[emnoc · Accepted solution]

1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?

1: for out of band management. Ideal when you have a OOB network or some other path. The route table sites as a OOB route-table also 2: not it' s defined for management of the device. Some have dual-management ports. 3: it' s management port.

[emnoc · Accepted solution]

1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)?

1: for out of band management. Ideal when you have a OOB network or some other path. The route table sites as a OOB route-table also 2: not it' s defined for management of the device. Some have dual-management ports. 3: it' s management port.

[VicAndr]

Thank you all who answered the questions. Your answers are all in line with each other. While waiting for someone to respond in the forums though, I open a web-chat with Fortinet support and asked guy on the other end the very same questions. And guess what? His answers did not exactly match yours. He told that YES, management port (or two for that matter) are mainly used for out-band unit management (i.e. accessing members in a cluster). But they (management ports) might be used to process regular network traffic as well. What he was not sure about was whether those ports could take advantage of NPU or CP offloading. So I am a little confused now: either folks who work in the field do not know some " hidden" capabilities of hardware in their possession or Fortinet put incompetent people in a position to support its flock. The reason I ask all those questions was - we are thinking about FG-310B unit replacement. In terms of processing capabilities FG-300D seems to be a right fit BUT the problem is - it has a very low ports capacity. So I was wondering - could I take advantage of 2 management ports to handle network traffic as well - this way you could add 2 more ports to existing 4 1GB RJ45 ones. I was trying to find management ports description somewhere in the documentation but couldn' t have found any. Could someone point me to the right source, please?

[netmin]

Plus: dedicated mgmt ports are usually configured with different IP addresses on the individual cluster members, so one can access them both, active or passive cluster member. Non-mgmt ports on a/p clusters share the configuration between the active member port and corresponding passive member port (only the active cluster member can be accessed).

[neonbit]

The management ports are unable to route traffic to other networks. They are only used for management purposes. Quite a few of the request for tenders we see ask for a dedicated management port because there is no risk of a mistake/malicious configuration that would allow the management interface to talk to another one.

[netmin]

OK, more specific: dedicated mgmt ports in terms of:

 config system interface
  edit mgmt
   set dedicate-to management
  next
 end
 

do not process regular traffic. The same interface not dedicated to management may do this. NP Acceleration, as far as documentation shows, likely not, but you may want to double check it for your device: http://docs.fortinet.com/uploaded/files/1607/fortigate-hardware-accel-50.pdf

[VicAndr]

OK, more specific: dedicated mgmt ports in terms of: config system interface edit mgmt set dedicate-to management next end do not process regular traffic. The same interface not dedicated to management may do this.

Perfect! Your answer " glues" everything together. Thank you very much, netmin!

[netmin]

Concerning the 300D model: http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-500D.pdf

6 x GE RJ45 ports (including 4 x FortiASIC-accelerated ports, 2 x management ports), 4 x GE SFP slots, 120GB onboard storage

[emnoc]

I would be very very careful trying to use dedicate ports for user traffic and expecting acceleration. You should confirm that, due to the ASIC might not be bound to a " MGMT" interface. I don' t think you can get anything from free Consult with a fortinet-partner and get there blessing if you need fastpath.

[VicAndr]

I would be very very careful trying to use dedicate ports for user traffic and expecting acceleration. You should confirm that, due to the ASIC might not be bound to a " MGMT" interface.

I now know (both from netmin' s post as well I checked the doc he was referring to) that management ports are not accelerated. ...and that' s fine - sometimes you need few extra physical ports for low-volume users' and management unrelated traffic. 4 RJ45 ports for a powerful firewall to connect to networks around - is a shame. BTW, neither of SFP ports on both FG-300D and FG-500D are accelerated as well.