Loop Back interface

[mingj9966]

Hi guys i am need in fortigate , and just started to learn in depth into fortigate . Purchased fortigate 80F for home/lab , want to know  in which enviorment will need to use loop back interface ?

 

Please provide some use case , Thanks so much

[akumar02]

Good Morning @mingj9966 ,

Kindly look at the following articles for detailed explanation:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-and-using-a-loopback-interface...

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/853005/loopback-interface#:~....

[Toshi_Esumi]

The direct/short answer is most unlikely you would "need" it in most cases unless you set up a routing protocol with other routers and you need to have an interface that would never go down.

In other words, even with a routing ptocol, you can use one of interfaces on the FGT to peer with the others.
Unlike regular L3 routers, once you create a loopback interface and try connecting it with something outside, you have to have proper policies like "loopback<->inbound/outbound interfaces" to make it work.

Toshi

[ede_pfau]

One use case would be to put the management access onto the LB interface.

We used to just use the LAN port for this, enabling HTTPS, ping and SSH.

First, that is probably not the most secure setup, as a malicious attack could come from the inside.

Then, if by chance this port's connection is removed, thus link down, there is no mgmt access anymore.

So we switched to using LB interfaces (there is at least one per VDOM). We dedicated a super-net like 10.6.0.0/16 for all LBs, then use 10.6.<siteID>.0/32 for each location. Of course, you will have to add routes, policies and sometimes phase2s to include this range, but using a super-net makes that a bit easier.