Monitoring Cluster Nodes via 'HA Reserved Management Interface'

[screenie]

Hello, I have a remote location deployed with an 81F active/passive cluster (v6.4.5). Now i'm trying to get both nodes into my monitoring - without luck so far. I have an VPN Tunnel to the cluster and according to KB FD32214 (https://kb.fortinet.com/kb/documentLink.do?externalID=FD32214) it should be possible with a dedicated HA management interface aka 'HA Reserved Management Interface' - for devices which do not have a dedicated out-of-band management interface like 4x/5x/6x/8x series. I configured the dedicated interface as described in the KB but i'm not able to access it. The management interface needs to have an different ip as any of the other interfaces and it's not possible to use that interface in an policy (not even in the cli). So, how to i connect to the nodes using those interfaces via VPN? The interface is up and admin access for PING & SNMP configured but not even pingable from the firewall itself when using it's own ip as ping-option source from that interface.... Have issues to understand how that should work in general...

[Toshi_Esumi]

The dedicated-management interface in HA works when it's reachable directly outside of user network. If you use a VPN, it's inside of user network so no bridge to the management interface.

[screenie]

I know what you mean, but that would require a separate internet connection or an additional router inside the network just to make this interface reachable. Don't hope Fortinet designed it that way as it would be usless.

[Toshi_Esumi]

My suggestion would be:

- set up a monitoring device locally, inside of the FGT, then create a vlan to connected to out-of-band management.

- remotely getting into the monitoring device over VPN to see/pull status, statistics, etc.

I think this is the intended design of dedicated management interfaces.

[screenie]

Sorry, but such a design cannot be intended - the monitoring system is located on a central data center and deploying a dedicated monitoring system for every remote location doesn't make sense at all. And connecting the management port to a separate VLAN also doesn't work - i've tried that already and it's not possible to use an ip on the management port that's also used on any other FW interface. It might be possible to deploy an additional L3 device and connect and route it there but this also doesn't make sense - it's just a waste of money and a poor design. It should be easily possible to monitor both fw members from remote - that's not something special - that's a standard use case.