Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
albaker1
Contributor

Manage secondary firewall in HA pair independently of primary

We are configuring a two firewall HA pair using 2600-series and want to be able to log into each separately. This documentation appears to describe the configuration (https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/313152/out-of-band-managemen...), but when I go to System > HA > Primary Firewall, under the Management Interface Reservation, port17 isn't available to be selected, which is the management interface. It's on a different VRF than the other ports; however, I put another port into that particular VRF, and it shows up. I'm currently logged into the firewall using port17, so is that the problem? Could there be something else? Thank you.

1 Solution
srajeswaran

Yes,need to remove the static route.  You may configure the mgmt subnet route under HA settings under destination subnet.

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/1901...

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

View solution in original post

3 REPLIES 3
srajeswaran
Staff
Staff

Can you run "show | grep port17 -f", this will show if port17 is referenced in any other hierarchy other than "config system interface" and if it is referenced it cannot be configured as dedicated management interface.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

albaker1

Thanks for your response srajeswaran. Does that include routes?

 

FTG2600 # show | grep port17 -f
config system interface
edit "port17" <---
set vdom "root"
set vrf 1
set ip 10.2.66.115 255.255.255.0
set allowaccess ping https ssh snmp fgfm
set type physical
set mediatype sr
set snmp-index 17
set speed 10000full
next
end
config router static
edit 67
set dst 172.16.0.0 255.255.0.0
set gateway 10.2.66.1
set device "port17" <---
next
edit 22
set dst 10.5.19.20 255.255.255.255
set gateway 10.2.66.1
set device "port17" <---
next
end

FTG2600 #

srajeswaran

Yes,need to remove the static route.  You may configure the mgmt subnet route under HA settings under destination subnet.

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/1901...

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

Labels
Top Kudoed Authors