Internal Interface Configuration / Issues on Standalone Switch

[BingleHopper]

I am trying to use the internal management interface on a standalone FortiSwitch. How would I configure this for a static IP?

The basic scenario is a FortiSwitch connected to a Cisco switch acting as the Core.  VLAN 1 is native on the uplinks, VLAN 15 is user, VLAN 20 is phone, and VLAN 10 for the management IP.  All of the gateways live on the Core.

As per the documentation, it looks like you need to add a VLAN interface and select the internal interface as the device. This would be done after setting the internal interface's IP.

Not sure what the exact purpose of the VLAN interface is, except maybe to point a its IP as the next hop for a static route off the core.  When I try to create one without an ip (0.0.0.0 0.0.0.0) it gives an error. I am also given an error if I try to make the native VLAN of the internal interface the same as the VLAN interface. 

I have attempted setting it up just like the physical mgmt interface would be, with an ip and static route (and no vlan interface), but I got nothing.

Unfortunately, the documentation doesn't give an example of these nor explains the reason why to configure certain things.

I'm sure there's a fairly simple answer to this.

I typically use the physical management port, but in this case it is not an option (due to number of drops to core).  The only way I could use it would be to connect the management port into one of the ports on the switch.

Thank you.

[Toshi_Esumi · Accepted solution]

I went through this process a couple of month ago. It's slightly different between "dedicated MGMT port" models and "no dedicated MGMT port" models. Only because the default 192.168.1.99/24 is configure on the "mgmt" physical interface for the "MGMT" models.

You can do either way 1) make existing "internal" as VLAN 10, or 2) create a new VLAN 10 mgmt interface on top of internal.

For 1) you need to make the native-vlan for internal to 10 at "config switch interface", while the IP is configured at "config sys interface".

For 2) create a vlan mgmt interface with the IP specifying the interface as "internal" as well as VLAN ID 10 at "config sys interface". But don't forget to set VLAN 10 in allowed-vlan on "internal" at "config switch interface" because all VLAN L3 interfaces are built on top of "internal" interface.

Then you want to set the default route with "set device VLAN10" so the it would be reachable from outside, like Cisco SWs and GW.

Unless you configure these all via console, like I did, you need to keep the orignal 192.168.1.99 to be able to get to. I think that's why the manual was written that way.

Below is my example for FS-108F (non-MGMT model).

config system interface
  edit "internal"         <--- I didn't touch/change this part to keep the default access
    set mode dhcp
    set allowaccess ping https ssh
    set type physical
    set secondary-IP enable
    set defaultgw enable
    config secondaryip
      edit 1
        set ip 192.168.1.99 255.255.255.0
        set allowaccess ping https ssh
      next
    end
  next
  edit "mgmt999"
    set ip 10.255.255.4 255.255.255.240
    set allowaccess ping https ssh
    set vlanid 999
    set interface "internal"
  next
end

config switch interface
  edit "internal"
    set allowed-vlans 999
    set stp-state disabled
  next
end

config router static
  edit 1
    set device "mgmt999"
    set dst 0.0.0.0 0.0.0.0
    set gateway 10.255.255.1
  next
end

Toshi

[BingleHopper]

After I tried what you said and it did not work, I looked at the gateway and realized it was configured with the wrong subnet mask.  In fact, every single management IP was configured incorrect *(from before my time) because no one ever went back and checked the subnet mask on the gateway.

Thanks for the response.