Dedicated / out-of-band management

Author
jmlux
Bronze Member
  • Total Posts : 53
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/07/30 01:33:49
  • Status: offline
2015/08/05 10:37:33 (permalink)
0

Dedicated / out-of-band management

Hi,
 
On a 100D, we'd love to have a "real" mgmt interface (really out-of-band, not tied into any "production" routing table).
 
We have come across several things:
 
With VDOMs disabled, what are the differences between:
- config system interface: dedicated-to management ?
- config system interface: edit mgmt: set vdom dmgmt-vdom ?
- config system dedicated-management (can someone explain what the second part of "This port is in the hidden VDOM dmgmt-vdom, which cannot be made the management VDOM" means) ?
 
Do you need to set these 3 things, or only part of them, or...?
In any case we couldn't make it work that the firewall was still reachable on mgmt when these things were configured.
 
config system ha
set group-name "fn"
set mode a-p
set password ........
set hbdev "ha1" 50
set session-pickup enable
set ha-mgmt-status enable
set ha-mgmt-interface "mgmt"
set ha-mgmt-interface-gateway 172.22.112.1
set override enable
set priority 250
set monitor "dmz" "port1"
end

config system dedicated-mgmt
set status enable
set interface "mgmt"
set default-gateway 172.22.112.1
end

config system interface
edit "mgmt"
set ip 172.22.112.11 255.255.255.0
set allowaccess ping https ssh snmp http fgfm
set type physical
set dedicated-to management
set snmp-index 8
next
end
 
Now, with VDOMs enabled, it seems you can have a mgmt vdom
- config system global: mangement-vdom
- but only if ha-mgmt-enable is disabled.... because otherwise the mgmt port is assigned some internal vsys_ha VDOM
 
Then there is the reserved manamagent interface feature when HA is used. We currently use that with VDOMs disabled as we find that comes closest to what we want, and also closest to a working config. (I believe this case also uses the hidden vsys_ha VDOM).
 
When accessing the firewall over the management IP (thus the o-o-b management interface) it should reply using that address and on the mgmt interface, always.
Same for local originating outgoing traffic like "execute backup", traceroute, ping etc. which are managements actions IMHO.
At least you should be able to choose. "execute ping-options source" however even bails out with "binding source interface address error" when you tell it to use the mgmt source address. Traceroute clearly takes the "production" network route too. But "execute backup" is what troubles me most.
 
Can someone please enlighten me why having the o-o-b mgmt is always this complicated, and how to make it run smoothly? :)
 
Thanks,
 
Marki
post edited by jmlux - 2015/08/05 10:38:40
#1

6 Replies Related Threads

    hallodri
    New Member
    • Total Posts : 6
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/07/28 01:41:51
    • Status: offline
    Re: Dedicated / out-of-band management 2015/08/06 02:44:36 (permalink)
    0
    Hi,
     
    I'm not familiar with management vdoms, but we have fortigate 1500D in ha a-a mode with vdoms and dedicated management of each node.
    The way we achieved this was by:
    config global
    config system interface
    edit mgmt1
    set ip x.x.x.x/yy (each node has its own IP)
    set allowaccess ping https ssh snmp fgfm
    set dedicated-to management
    end
    config system ha
    [...]
    set ha-mgmt-status enable
    set ha-mgmt-interface "mgmt1"
    set ha-mgmt-interface-gateway z.z.z.z
    [...]
    end
     
    BTW:
    mgmt1 Interface is not assigned to any vdom in this case
    I think that's all. I assume that there is not much difference when not using vdoms.
    I hope this helps...
     
    Greetings, hallodri
    post edited by hallodri - 2015/08/06 02:46:36
    #2
    jmlux
    Bronze Member
    • Total Posts : 53
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/07/30 01:33:49
    • Status: offline
    Re: Dedicated / out-of-band management 2015/09/11 01:30:05 (permalink)
    0
    Hi again,
     
    This is still not clear to me. Can someone tell me exactly what the following does and what the nuances are? (Support is unable to)
     
    1)
    config system dedicated-mgmt    <-------------------
      set status enable
      set interface "mgmt"
      set default-gateway ip.add.re.ss
    end

     
    2)
    config system interface
       edit "mgmt"
    ...
       set dedicated-to management   <-------------------
    ...
      next
    end

     
    3) Why is it that FortiGateVMs don't seem to have dedicated-mgmt capability? Why would you not need that capability in the VM?
     
    Bye
    Marki
    #3
    aagrafi
    Gold Member
    • Total Posts : 173
    • Scores: 4
    • Reward points: 0
    • Joined: 2016/03/09 01:47:25
    • Status: offline
    Re: Dedicated / out-of-band management 2017/02/03 04:27:07 (permalink)
    0
    1) This CLI enables the so called OOB management in the mgmt port of the FortiGate. Thus, the "set default-gateway" command is need to set the default gateway to be used by the management traffic. e.g. not use the gateway that is been set through the static route (config router static).
    2) This is a different story. With this command, you dedicate the management port for management only, e.g. not participate in the routing process. If you unset the mgmt port from dedicated, then this port becomes interface, e.g. it does routing and you can use it in firewall policies. This way you get an extra interface, but this interface is not ASIC accelerated.
    3) This is my question too. I guess this is because the VM uses general purpose hardware and cannot do this.
    #4
    lijo.joseph
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/04/04 23:37:07
    • Status: offline
    Re: Dedicated / out-of-band management 2017/04/05 02:34:37 (permalink)
    0
    Hi,
    We same issue with our 100D device. Have followed all the above steps and still getting the below errod when we try to add command "set ha-mgmt-interface mgmt.".
     
    FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt
    value parse error before 'mgmt' Command fail. Return code -23
     
    Attaching complete configurations as well.
     
    FW01 (ha) # show config system ha     set group-id 10     set group-name "FW-HA"     set mode a-p     set password ENC +Fbws9H6Vq9J0lEtMRiMSk1H5mWhbLSfTdKgXEs4r23f1TiHw98FVsXFileusW730cvfDQ==     set session-pickup enable     set override enable     set priority 100     set monitor "Admin-VPC" "SAM-VPC" end
    FW01 (ha) #
    FW01 (mgmt) # show config system interface     edit "mgmt"         set vdom "dmgmt-vdom"         set ip 172.29.8.27 255.255.252.0         set allowaccess https ssh         set type physical         set dedicated-to management         set description "For Unit Management"         set snmp-index 6     next end
    FW01 (mgmt) #
    FW01 (dedicated-mgmt) # show config system dedicated-mgmt     set status enable     set interface "mgmt"     set default-gateway 172.29.8.1 end
    FW01 (dedicated-mgmt) #
    FW01 (ha) # set ha-mgmt-status enable
    FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt
    #5
    Pacolo
    New Member
    • Total Posts : 15
    • Scores: 4
    • Reward points: 0
    • Joined: 2014/10/21 09:48:43
    • Status: offline
    Re: Dedicated / out-of-band management 2017/07/11 03:32:00 (permalink)
    5 (1)
    Hello guys,
     
    I suppose that lijo.joseph would have fixed the issue about the error when adding the command "set ha-mgmt-interface mgmt.", but I have faced today this same problem and I haven't found any tip to fix that on the forum neither searching on Google. I have found what the problem was so I think it will save some time to the next admin that face that problem to have this info.
     
    Fortigate (ha) # set ha-mgmt-interface mgmt1
    node_check_object fail! for ha-mgmt-interface mgmt1
    value parse error before 'mgmt1'
    Command fail. Return code -23
     
    The actual problem in my case, which is a default configuration, is that the interface mgmt1 has a reference on the dhcp server...
     
    config system dhcp server
    edit 1
    ...
    set interface "mgmt1"
    ...
     
    ...then I deleted the reference and I have been able to add the command "set ha-mgmt-interface mgmt1".
     
    I hope this will be useful for somebody.
     
    Regards,
    Paco.
     
    #6
    lijo.joseph
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/04/04 23:37:07
    • Status: offline
    Re: Dedicated / out-of-band management 2017/07/11 20:00:07 (permalink)
    0
    Thanks Paco,
     
    That was exactly my issue as well and its been visible with 
    fw # show | grep -f mgmt1
     
    Once I deleted the reference from DHCP config was able to add MGMT1 as dedicated HA Management ( aka unit management ) interface 
     
    Regards,
    Lijo
    #7
    Jump to:
    © 2019 APG vNext Commercial Version 5.5