Remote (TFTP) Full Configuation backups from Reserved HA Management interfaces
Seemingly, 'Reserved HA Management' interfaces (config ha-mgmt-interfaces) are meant for incoming administrative connections, however, Fortinet makes an exception with 'ha-direct' for some outgoing connections.
Is it possible to use these interface for remote (esp. TFTP) backups using "execute backup full-config tftp ..."?
When HA-direct is enabled, FortiGate uses the HA management interface to send log messages to FortiAnalyzer and remote syslog servers, sending SNMP traps, access to remote authentication servers (for example, RADIUS, LDAP), and connecting to FortiManager, FortiSandbox, or FortiCloud.
For tftp backups the traffic will not be pushed from ha management interface but firewall will use its routing table to forward the traffic.
thank you, however, your reply is already well covered by Fortinet documentation. My question was: "Is it possible to use these interface for remote (esp. TFTP) backups using "execute backup full-config tftp ..."?" - is the answer Yes or No? If No, can you suggest alternative method?
I know about that hidden VDOM, but if you look at its Routing Table, there's no default route, so, how can it be used to send to a remote (ie. non-directly-connected) network - here's proof:
fg200f (root) # execute enter current vdom=vsys_hamgmt
fg200f (root) # get router info routing-table details censored_gwy_ip % Network not in table
To prove you wrong, I tried 'execute backup config tftp ...' - and.. it worked! Obviously, 'gateway' defined in "config ha-mgmt-interfaces" is somehow in this VDOM. I then looked at FIB, and noticed: fg200f (root) # execute enter current vdom=vsys_hamgmt fg200f (root) # get router info kernel : tab=254 vf=6 scope=0 type=1 proto=17 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=censored_gwy_ip dev=3(mgmt) :
So, there's a Kernel Route for egress for HA1 traffic!!
If your response was based on expertise/experience (and not guesswork), then I thank you and apologise for doubting you.
Since we're here, can you please elaborate on the meaning of 'scope' field in the above printout?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.