Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sharris
New Contributor II

Unable to add cluster to FortiManager using WAN interface

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method.

 

We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP over the VPN tunnel but not using the WAN IP which implies it is not a problem with the global config on the device. Just to test we have tried setting the enc-algorithm to default, low, and high with no change in the result. We have compared the configurations of the problem cluster and other connected clusters and can't find any relevant differences.

 

I have been Googling my brains out trying to find a solution to this but am flummoxed. Does anyone have any ideas for where else I can look?

 

TIA

1 Solution
sharris
New Contributor II

After taking another look with fresh eyes I found the problem. There was a policy blocking the traffic from the FortiManager VM itself for all but a handful of objects. Once that was updated I was able to successfully add the cluster again.

View solution in original post

3 REPLIES 3
AEK
SuperUser
SuperUser

For security it is recommended to avoid any management access on WAN interface.

The management through the VPN tunnel is much preferred.

AEK
AEK
sharris
New Contributor II

I appreciate the feedback and am aware of the recommendation but I am not the one who makes these decisions and your response does not address my actual question.

sharris
New Contributor II

After taking another look with fresh eyes I found the problem. There was a policy blocking the traffic from the FortiManager VM itself for all but a handful of objects. Once that was updated I was able to successfully add the cluster again.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the ā€œNominate to Knowledge Baseā€ button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors