Dedicated / out-of-band management

[jmlux]

Hi,

On a 100D, we'd love to have a "real" mgmt interface (really out-of-band, not tied into any "production" routing table).

We have come across several things:

With VDOMs disabled, what are the differences between:

- config system interface: dedicated-to management ?

- config system interface: edit mgmt: set vdom dmgmt-vdom ? - config system dedicated-management (can someone explain what the second part of "This port is in the hidden VDOM dmgmt-vdom, which cannot be made the management VDOM" means) ?

Do you need to set these 3 things, or only part of them, or...?

In any case we couldn't make it work that the firewall was still reachable on mgmt when these things were configured.

config system ha set group-name "fn" set mode a-p set password ........ set hbdev "ha1" 50 set session-pickup enable set ha-mgmt-status enable set ha-mgmt-interface "mgmt" set ha-mgmt-interface-gateway 172.22.112.1 set override enable set priority 250 set monitor "dmz" "port1" end config system dedicated-mgmt set status enable set interface "mgmt" set default-gateway 172.22.112.1 end config system interface edit "mgmt" set ip 172.22.112.11 255.255.255.0 set allowaccess ping https ssh snmp http fgfm set type physical set dedicated-to management set snmp-index 8 next end

Now, with VDOMs enabled, it seems you can have a mgmt vdom

- config system global: mangement-vdom

- but only if ha-mgmt-enable is disabled.... because otherwise the mgmt port is assigned some internal vsys_ha VDOM

Then there is the reserved manamagent interface feature when HA is used. We currently use that with VDOMs disabled as we find that comes closest to what we want, and also closest to a working config. (I believe this case also uses the hidden vsys_ha VDOM).

When accessing the firewall over the management IP (thus the o-o-b management interface) it should reply using that address and on the mgmt interface, always.

Same for local originating outgoing traffic like "execute backup", traceroute, ping etc. which are managements actions IMHO.

At least you should be able to choose. "execute ping-options source" however even bails out with "binding source interface address error" when you tell it to use the mgmt source address. Traceroute clearly takes the "production" network route too. But "execute backup" is what troubles me most.

Can someone please enlighten me why having the o-o-b mgmt is always this complicated, and how to make it run smoothly? :)

Thanks,

Marki

[hallodri]

Hi,

I'm not familiar with management vdoms, but we have fortigate 1500D in ha a-a mode with vdoms and dedicated management of each node.

The way we achieved this was by:

config global

config system interface

edit mgmt1

set ip x.x.x.x/yy (each node has its own IP) set allowaccess ping https ssh snmp fgfm set dedicated-to management

end

config system ha [...]

set ha-mgmt-status enable

set ha-mgmt-interface "mgmt1" set ha-mgmt-interface-gateway z.z.z.z [...] end

BTW:

mgmt1 Interface is not assigned to any vdom in this case

I think that's all. I assume that there is not much difference when not using vdoms.

I hope this helps...

Greetings, hallodri

[jmlux]

Hi again,

This is still not clear to me. Can someone tell me exactly what the following does and what the nuances are? (Support is unable to)

1)

config system dedicated-mgmt    <-------------------
  set status enable
  set interface "mgmt"
  set default-gateway ip.add.re.ss
end

2)

config system interface
   edit "mgmt"
...
   set dedicated-to management   <-------------------
...

  next
end

3) Why is it that FortiGateVMs don't seem to have dedicated-mgmt capability? Why would you not need that capability in the VM?

Bye

Marki

[aagrafi]

1) This CLI enables the so called OOB management in the mgmt port of the FortiGate. Thus, the "set default-gateway" command is need to set the default gateway to be used by the management traffic. e.g. not use the gateway that is been set through the static route (config router static).

2) This is a different story. With this command, you dedicate the management port for management only, e.g. not participate in the routing process. If you unset the mgmt port from dedicated, then this port becomes interface, e.g. it does routing and you can use it in firewall policies. This way you get an extra interface, but this interface is not ASIC accelerated.

3) This is my question too. I guess this is because the VM uses general purpose hardware and cannot do this.

[lijo_joseph1]

Hi,

We same issue with our 100D device. Have followed all the above steps and still getting the below errod when we try to add command "set ha-mgmt-interface mgmt.".

FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt

value parse error before 'mgmt' Command fail. Return code -23

Attaching complete configurations as well.

FW01 (ha) # show config system ha     set group-id 10     set group-name "FW-HA"     set mode a-p     set password ENC +Fbws9H6Vq9J0lEtMRiMSk1H5mWhbLSfTdKgXEs4r23f1TiHw98FVsXFileusW730cvfDQ==     set session-pickup enable     set override enable     set priority 100     set monitor "Admin-VPC" "SAM-VPC" end

FW01 (ha) #

FW01 (mgmt) # show config system interface     edit "mgmt"         set vdom "dmgmt-vdom"         set ip 172.29.8.27 255.255.252.0         set allowaccess https ssh         set type physical         set dedicated-to management         set description "For Unit Management"         set snmp-index 6     next end

FW01 (mgmt) #

FW01 (dedicated-mgmt) # show config system dedicated-mgmt     set status enable     set interface "mgmt"     set default-gateway 172.29.8.1 end

FW01 (dedicated-mgmt) #

FW01 (ha) # set ha-mgmt-status enable

FW01 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt

[Pacolo]

Hello guys,

I suppose that lijo.joseph would have fixed the issue about the error when adding the command "set ha-mgmt-interface mgmt.", but I have faced today this same problem and I haven't found any tip to fix that on the forum neither searching on Google. I have found what the problem was so I think it will save some time to the next admin that face that problem to have this info.

Fortigate (ha) # set ha-mgmt-interface mgmt1 node_check_object fail! for ha-mgmt-interface mgmt1

value parse error before 'mgmt1' Command fail. Return code -23

The actual problem in my case, which is a default configuration, is that the interface mgmt1 has a reference on the dhcp server...

config system dhcp server edit 1 ... set interface "mgmt1"

...

...then I deleted the reference and I have been able to add the command "set ha-mgmt-interface mgmt1".

I hope this will be useful for somebody.

Regards,

Paco.

[lijo_joseph1]

Thanks Paco,

That was exactly my issue as well and its been visible with 

fw # show | grep -f mgmt1

Once I deleted the reference from DHCP config was able to add MGMT1 as dedicated HA Management ( aka unit management ) interface 

Regards,

Lijo