MGMT IP in Cluster - Overlap?

[Key76]

New to FortiGate, so this may be long-winded way to ask what I want, so bear with me :)  IPs and port numbers are changed to generic for the purposes of this post.

I have two 500E devices in an active/standby HA-pair.

My management network is on the subnet 192.168.0/24 and my management switch (to which the management ports of all my devices are connected) is connected to FW Port 1.  Port 1 is configured with the IP 192.168.0.254/24 (the devices on my management network have IPs in the 192.168.0/24 subnet and use the .254 address as their gateway).  These devices are all contactable and work as desired.

Each FG currently has a HA Management Interface Gateway set and a management port IP set, but these IPs and gateway are incorrect and not used on our network (they were a typo or a misunderstanding when they were set up by a 3rd party).

Can I set the HA Management Interface Gateway as 192.168.0.254 (the same as the interface my management network connects to) and give the Management Interfaces each an IP on the 192.168.0/24 management subnet or does that cause a subnet overlap and a problem?  And if so what is the recommended way around it?

Thank you

[Markus]

Yes, this is possible and I've this setup with my boxes too. You have to enable overlap subnet...

config system settings     set allow-subnet-overlap enable

Then you can set the IPs within the same subnet config system interface

edit "mgmt1"         set ip "your IP address and mask"         set dedicated-to management

Login to your passive Box -> exe ha manage "node"

config system interface

edit "mgmt1"         set ip "your other IP Address and mask"         set dedicated-to management

Finally set the ha settings as follows config system ha     set ha-mgmt-status enable     set ha-mgmt-interface "mgmt1"     set ha-mgmt-interface-gateway "your gateway" Best

[Key76]

Thanks for the fast reply.

What are the consequences of allowing overlap that I should be aware of?

[Markus]

I could not say, not sure, but should not... ...never had any problem so far (> 1 year) and this setup was made from a Fortigate Pro.

[Key76]

Thanks.  We're not in production yet so I have a window to enable and do some testing.  Thanks for your advice.

[Markus]

thats a perfect situation, please if you find some issues, don't hesitate to contact me and it would be fine if you could share.

good luck

[Kenundrum]

Key76 wrote:

What are the consequences of allowing overlap that I should be aware of?

The main consequence is that you don't get a blaring alarm and config revert when you accidentally assign overlapping IPs to different interfaces. So you just have to pay attention when adding or modifying interface addresses. In general you may end up with a routing problem if you're not careful. Traffic may decide to go out an interface where a policy does not exist and gets blocked.

The biggest problem is from having your management interfaces in the same overlapping subnet as the production interfaces. Since management interfaces are typically not hardware accelerated, if traffic that would normally hit an SPU/NPU decides to go through a management interface, you can take a huge performance hit or saturate the system CPU.

[rdumitrescu]

well.... you can set a management ip that "overlap" with your port1 ip and maintain the parameter allow-subnet-overlap disabled The overlap warning is a glitch that the latest FortiOS has.

As a workaround you can save your config, modify the config file (management ip section) with the according ip and restore the config. Repeat the same on the other node.

The config restore implies a firewall reboot, so be careful if it is a production environment

Regards

Radu

[miguel_almeida]

mgrosni wrote:

Yes, this is possible and I've this setup with my boxes too. You have to enable overlap subnet...

config system settings    set allow-subnet-overlap enable

Then you can set the IPs within the same subnet config system interface

edit "mgmt1"        set ip "your IP address and mask"        set dedicated-to management

Login to your passive Box -> exe ha manage "node"

config system interface

edit "mgmt1"        set ip "your other IP Address and mask"        set dedicated-to management

Finally set the ha settings as follows config system ha    set ha-mgmt-status enable    set ha-mgmt-interface "mgmt1"    set ha-mgmt-interface-gateway "your gateway" Best

Hello,

I configured it this way and it works for the first fortigate (master), in the second fortigate I have no response to ping through the switch.

If I connect a cable directly to the port and put a static IP on my computer, I can connect to the fortigate slave.

Any idea what it might be?

In my case I have the configuration in HA (Active-Passive), the fortigate Slave is in passive mode, could this be the problem?

Thank you.