Dedicated / out-of-band management
On a 100D, we'd love to have a "real" mgmt interface (really out-of-band, not tied into any "production" routing table).
We have come across several things: With VDOMs disabled
, what are the differences between:
- config system interface: dedicated-to management
- config system interface: edit mgmt: set vdom dmgmt-vdom ?
- config system dedicated-management
(can someone explain what the second part of "This port is in the hidden VDOM dmgmt-vdom, which cannot be made the management VDOM
" means) ?
Do you need to set these 3 things, or only part of them, or...?
In any case we couldn't make it work that the firewall was still reachable on mgmt when these things were configured.
config system ha Now, with VDOMs enabled
set group-name "fn"
set mode a-p
set password ........
set hbdev "ha1" 50
set session-pickup enable
set ha-mgmt-status enable
set ha-mgmt-interface "mgmt"
set ha-mgmt-interface-gateway 172.22.112.1
set override enable
set priority 250
set monitor "dmz" "port1"
config system dedicated-mgmt
set status enable
set interface "mgmt"
set default-gateway 172.22.112.1
config system interface
set ip 172.22.112.11 255.255.255.0
set allowaccess ping https ssh snmp http fgfm
set type physical
set dedicated-to management
set snmp-index 8
, it seems you can have a mgmt vdom
- config system global: mangement-vdom
- but only
if ha-mgmt-enable is disabled.... because otherwise the mgmt port is assigned some internal vsys_ha VDOM
Then there is the reserved manamagent interface feature
when HA is used. We currently use that with VDOMs disabled as we find that comes closest to what we want, and also closest to a working config. (I believe this case also uses the hidden vsys_ha VDOM).
When accessing the firewall over the management IP (thus the o-o-b management interface) it should reply using that address and on the mgmt interface, always.
Same for local originating outgoing traffic like "execute backup", traceroute, ping etc. which are managements actions IMHO.
At least you should be able to choose. "execute ping-options source" however even bails out with "binding source interface address error" when you tell it to use the mgmt source address. Traceroute clearly takes the "production" network route too. But "execute backup" is what troubles me most.
Can someone please enlighten me why having the o-o-b mgmt is always this complicated, and how to make it run smoothly? :)
post edited by jmlux - 2015/08/05 10:38:40