Remote (TFTP) Full Configuation backups from Reserved HA Management interfaces

[Fern-X]

Hello!

Seemingly, 'Reserved HA Management' interfaces (config ha-mgmt-interfaces) are meant for incoming administrative connections, however, Fortinet makes an exception with 'ha-direct' for some outgoing connections.

Is it possible to use these interface for remote (esp. TFTP) backups using "execute backup full-config tftp ..."?

R's, Fern.

[pjawalekar]

Hi fern-X,

When HA-direct is enabled, FortiGate uses the HA management interface to send log messages to FortiAnalyzer and remote syslog servers, sending SNMP traps, access to remote authentication servers (for example, RADIUS, LDAP), and connecting to FortiManager, FortiSandbox, or FortiCloud.

For tftp backups the traffic will not be pushed from ha management interface but firewall will use its routing table to forward the traffic.

Regards,

Pratik

[Fern-X]

Hi Pratic,

thank you, however, your reply is already well covered by Fortinet documentation. My question was: "Is it possible to use these interface for remote (esp. TFTP) backups using "execute backup full-config tftp ..."?" - is the answer Yes or No? If No, can you suggest alternative method?

R's, Fern

[pjawalekar]

Hi Fern-X,

In case of HA management interface, in the background, FortiGate creates a hidden VDOM named vsys_hamgmt.
Can you please try to run the configuration backup command from it. Sharing one KB regarding the hidden VDOM named vsys_hamgmt:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface-s-hidden-...

exe enter vsys_hamgmt
execute backup full-config tftp ----

Regards,

Pratik

[Fern-X]

Hi Pratik,

I know about that hidden VDOM, but if you look at its Routing Table, there's no default route, so, how can it be used to send to a remote (ie. non-directly-connected) network - here's proof:

fg200f (root) # execute enter
current vdom=vsys_hamgmt

fg200f (root) # get router info routing-table details censored_gwy_ip
% Network not in table

To prove you wrong, I tried 'execute backup config tftp ...' - and.. it worked! Obviously, 'gateway' defined in "config ha-mgmt-interfaces" is somehow in this VDOM. I then looked at FIB, and noticed:
fg200f (root) # execute enter
current vdom=vsys_hamgmt
fg200f (root) # get router info kernel
:
tab=254 vf=6 scope=0 type=1 proto=17 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=censored_gwy_ip dev=3(mgmt)
:

So, there's a Kernel Route for egress for HA1 traffic!!

If your response was based on expertise/experience (and not guesswork), then I thank you and apologise for doubting you.

Since we're here, can you please elaborate on the meaning of 'scope' field in the above printout?

R's, Fern

[leathaleonel]

Hey! To solve the Fortinet exception you must know about the exception handling.