Created on 09-12-2023 04:59 PM Edited on 02-26-2024 06:58 AM By Kate_M
I am trying to use the internal management interface on a standalone FortiSwitch. How would I configure this for a static IP?
The basic scenario is a FortiSwitch connected to a Cisco switch acting as the Core. VLAN 1 is native on the uplinks, VLAN 15 is user, VLAN 20 is phone, and VLAN 10 for the management IP. All of the gateways live on the Core.
As per the documentation, it looks like you need to add a VLAN interface and select the internal interface as the device. This would be done after setting the internal interface's IP.
Not sure what the exact purpose of the VLAN interface is, except maybe to point a its IP as the next hop for a static route off the core. When I try to create one without an ip (0.0.0.0 0.0.0.0) it gives an error. I am also given an error if I try to make the native VLAN of the internal interface the same as the VLAN interface.
I have attempted setting it up just like the physical mgmt interface would be, with an ip and static route (and no vlan interface), but I got nothing.
Unfortunately, the documentation doesn't give an example of these nor explains the reason why to configure certain things.
I'm sure there's a fairly simple answer to this.
I typically use the physical management port, but in this case it is not an option (due to number of drops to core). The only way I could use it would be to connect the management port into one of the ports on the switch.
Thank you.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I went through this process a couple of month ago. It's slightly different between "dedicated MGMT port" models and "no dedicated MGMT port" models. Only because the default 192.168.1.99/24 is configure on the "mgmt" physical interface for the "MGMT" models.
You can do either way 1) make existing "internal" as VLAN 10, or 2) create a new VLAN 10 mgmt interface on top of internal.
For 1) you need to make the native-vlan for internal to 10 at "config switch interface", while the IP is configured at "config sys interface".
For 2) create a vlan mgmt interface with the IP specifying the interface as "internal" as well as VLAN ID 10 at "config sys interface". But don't forget to set VLAN 10 in allowed-vlan on "internal" at "config switch interface" because all VLAN L3 interfaces are built on top of "internal" interface.
Then you want to set the default route with "set device VLAN10" so the it would be reachable from outside, like Cisco SWs and GW.
Unless you configure these all via console, like I did, you need to keep the orignal 192.168.1.99 to be able to get to. I think that's why the manual was written that way.
Below is my example for FS-108F (non-MGMT model).
config system interface
edit "internal" <--- I didn't touch/change this part to keep the default access
set mode dhcp
set allowaccess ping https ssh
set type physical
set secondary-IP enable
set defaultgw enable
config secondaryip
edit 1
set ip 192.168.1.99 255.255.255.0
set allowaccess ping https ssh
next
end
next
edit "mgmt999"
set ip 10.255.255.4 255.255.255.240
set allowaccess ping https ssh
set vlanid 999
set interface "internal"
next
end
config switch interface
edit "internal"
set allowed-vlans 999
set stp-state disabled
next
end
config router static
edit 1
set device "mgmt999"
set dst 0.0.0.0 0.0.0.0
set gateway 10.255.255.1
next
end
Toshi
I went through this process a couple of month ago. It's slightly different between "dedicated MGMT port" models and "no dedicated MGMT port" models. Only because the default 192.168.1.99/24 is configure on the "mgmt" physical interface for the "MGMT" models.
You can do either way 1) make existing "internal" as VLAN 10, or 2) create a new VLAN 10 mgmt interface on top of internal.
For 1) you need to make the native-vlan for internal to 10 at "config switch interface", while the IP is configured at "config sys interface".
For 2) create a vlan mgmt interface with the IP specifying the interface as "internal" as well as VLAN ID 10 at "config sys interface". But don't forget to set VLAN 10 in allowed-vlan on "internal" at "config switch interface" because all VLAN L3 interfaces are built on top of "internal" interface.
Then you want to set the default route with "set device VLAN10" so the it would be reachable from outside, like Cisco SWs and GW.
Unless you configure these all via console, like I did, you need to keep the orignal 192.168.1.99 to be able to get to. I think that's why the manual was written that way.
Below is my example for FS-108F (non-MGMT model).
config system interface
edit "internal" <--- I didn't touch/change this part to keep the default access
set mode dhcp
set allowaccess ping https ssh
set type physical
set secondary-IP enable
set defaultgw enable
config secondaryip
edit 1
set ip 192.168.1.99 255.255.255.0
set allowaccess ping https ssh
next
end
next
edit "mgmt999"
set ip 10.255.255.4 255.255.255.240
set allowaccess ping https ssh
set vlanid 999
set interface "internal"
next
end
config switch interface
edit "internal"
set allowed-vlans 999
set stp-state disabled
next
end
config router static
edit 1
set device "mgmt999"
set dst 0.0.0.0 0.0.0.0
set gateway 10.255.255.1
next
end
Toshi
After I tried what you said and it did not work, I looked at the gateway and realized it was configured with the wrong subnet mask. In fact, every single management IP was configured incorrect *(from before my time) because no one ever went back and checked the subnet mask on the gateway.
Thanks for the response.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
446 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.