mgmt interface configuration

[echo]

I have used mgmt ports on fgt's in the past without problems: I have two HA clusters, each one of them has their own IP in one and the same network and I used NAT in the firewall rule to get access to the other cluster which was not the main cluster. In this configuration I could manage every one of the four devices separately and this has been useful and needed to get the HA fixed when it has broken sometimes. That was so in 5.4.

After upgrading to 6.4 I see that something has changed. Recently I restored a broken HA cluster and noted that the mgmt1 interface shows its address with red background and mentioning there an overlapping address. Yes, I needed another VLAN interface in the main cluster in the same mgmt subnet to make the NAT work in the firewall rule.

Is it possible to get the management working without a NAT-rule? There's information here: https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/313152/out-of-band-managemen...

But one thing is unclear and even confusing: what is the gateway in "management interface reservation" configuration? Where is it? It is not shown in the diagram. A random IP in the same network which doesn't even have to exist? If overlapping of subnets is not allowed, it can't be in the same unit/VDOM if it is meant to be a real address. (Do I need a separate FGT to manage the cluster?...) Also, there is no explanation of how the 10.11.101.100 works in that diagram that is common to both units and that is used to configure the new separate addresses for units. And the explanation for "Destination subnet", which is "Optionally, enter a Destination subnet to indicate the destinations that should use the defined gateway.", doesn't really tell me anything what is it really and what is it used for. Then there is "set ha-direct enable" option but no good explanation, what is this and for what purpose is it needed.

Has anybody got working the mgmt of HA cluster members without overlapping subnets (in one of the VDOMs of the same device) and without a firewall rule with NAT? What is the secret here?

[Toshi_Esumi]

You're talking about only management subnet routing through your switches. Why does it have to do anything with other user traffic? Why do you need to touch a default route?

That's the purpose of "out-of-band" management interfaces to separate management traffic from user traffic.

Toshi

[echo]

My purpose is not to get it out of band because I don't need it, it will make it more complex although more reliable in general. I only want to have separate IP's for management and in band. It looks like out of band mgmt requires everything doubled: the router (for mgmt), internet connection, cabling... and that I don't want.

Currently I manage the routers in just one of the networks that's bound to it and I am a bit surprised that to "split" those IP's, that is, get each member their own and use the already working infrastructure is so difficult. There should be a way for this in band too in a simpler way. My current NATted solution can be done even with new devices because when adding the VLAN after having set the IP's for cluster members gives no warning.

But about routing in switches: I just don't have experience. Theory is one thing and practice is another. If I enable routing there then I don't know the consequences, be they general or device/vendor-specific. I am careful and want to test first.

Now when trying to find some other way I think this should work: add the very same VLAN that I use for management-separately-IPs to virtual server environment and add another NIC to the management terminal and put it in the same VLAN, then no routing is needed, there's direct access.