Unable to add cluster to FortiManager using WAN interface

[sharris]

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method.

We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP over the VPN tunnel but not using the WAN IP which implies it is not a problem with the global config on the device. Just to test we have tried setting the enc-algorithm to default, low, and high with no change in the result. We have compared the configurations of the problem cluster and other connected clusters and can't find any relevant differences.

I have been Googling my brains out trying to find a solution to this but am flummoxed. Does anyone have any ideas for where else I can look?

TIA

[AEK]

For security it is recommended to avoid any management access on WAN interface.

The management through the VPN tunnel is much preferred.

[sharris]

I appreciate the feedback and am aware of the recommendation but I am not the one who makes these decisions and your response does not address my actual question.

[sharris · Accepted solution]

After taking another look with fresh eyes I found the problem. There was a policy blocking the traffic from the FortiManager VM itself for all but a handful of objects. Once that was updated I was able to successfully add the cluster again.

[Leogeorge2]

It sounds like the issue may be related to routing or NAT settings. Since the cluster can be accessed via the LAN interface over the VPN but not through the WAN IP, ensure that there are no firewall rules, NAT settings, or routing configurations preventing FortiManager from reaching the WAN IP over the VPN tunnel.