Fortigate Management Interface in HA Mode

If you create a Fortigate HA Cluster, you got an option “Reserve Management Port for Cluster Member” which you can activate. If active you can select an interface for this option.

This is a nice feature.

Like that you can assign an IP address to an interface, which is not synchronized. Every machine got it’s own IP address. This is very helpful, if you got virtual clusters with different masters. It also helps to monitor the CPU and memory of a subordinate device.

Again, there is much more you can do on the command line, then on the GUI:

First you activate the feature:

config system ha
   set ha-mgmt-status enable
   config ha-mgmt-interfaces
      edit 1
         set interface wan2
         set gateway 192.168.147.254
      next
   end
end

Do not forget to set a default gateway. This interface is isolated and requires its own routing.

Then you assign an individual IP address to every node in the cluster:

System 1:

config system interface 
   edit wan2 
      set ip 10.11.101.101/24 
      set allowaccess https ping ssh snmp 
   next
end

System 2:

config system interface
   edit wan2
      set ip 10.11.101.102/24
      set allowaccess https ping ssh snmp
   next
end

That’s it. Now you can easily access every single machine in the cluster.

 

New since FortiOS 5.6:

Starting with FortiOS 5.6, there is a new way to access every machine directly. This method is In-Band and does not require a reserved interface.

Assign on any interface a management IP-address. This address will not be synchronised in the cluster.

System 1:

config system interface 
   edit mgmt1 
      set ip 10.11.101.254/24
      set management-ip 10.11.101.251/24
      set allow access https ping ssh snmp 
   next
end

System 2:

config system interface
   edit mgmt1 
      set ip 10.11.101.254/24 
      set management-ip 10.11.101.252/24 
      set allow access https ping ssh snmp 
   next 
end

Every device can be accessed individually now. The regular routing table applies.

Tags: