Hot!Default gateway for Management Interface

Author
SaVen
Bronze Member
  • Total Posts : 25
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/27 07:03:03
  • Status: offline
2017/05/09 05:37:33 (permalink)
0

Default gateway for Management Interface

How do we set a default gateway for management interface that wont interfere with system routing table when VDOM's are enabled. I don't see dedicated-mgmt. option.
#1

11 Replies Related Threads

    aagrafi
    Gold Member
    • Total Posts : 173
    • Scores: 4
    • Reward points: 0
    • Joined: 2016/03/09 01:47:25
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 06:16:34 (permalink)
    0
    You can place the management port into a separate VDOM of its own. Then make this VDOM the management VDOM. This way:
    a. The default gateway of the mgmt VDOM won't interfere with the system's routing table and
    b. The mgmt traffic won't interfere with the real data traffic.
    #2
    emnoc
    Expert Member
    • Total Posts : 5209
    • Scores: 339
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 07:13:12 (permalink)
    0
    I would not waste a vdom for  this imho
     
    If you want OOB management and have aux or mgt interface just configured these for mgmt use
     
    e.g
     
    config sys interface
       
     edit "mgmt"
            set ip 11.1.1.1 255.255.255.0
            set allowaccess ping https ssh snmp fgfm
            set type physical
            set dedicated-to management
            set description "MANAGEMENT OOB ACCES"
            set device-identification enable
           next
    end
     
    Now under the  HA cfg
     
    config sys ha
        set ha-mgmt-status enable
        set ha-mgmt-interface "mgmt"
        set ha-mgmt-interface-gateway 11.1.1.254
    end
     
     
    That interface will not be in any vdom RIB table.
     
     

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #3
    Kenundrum
    Gold Member
    • Total Posts : 147
    • Scores: 15
    • Reward points: 0
    • Joined: 2008/05/15 10:25:50
    • Location: Rhode Island, US
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 07:33:04 (permalink)
    0
    The problem is that if the management interface is in the same subnet as the traffic interfaces, it would interfere with the routing and possibly send some traffic out the management interface instead of an accelerated interface. The set dedicated to management only worked if the ip was in a different subnet. So it was not possible to have the FGT processing traffic at 192.168.1.10 and have out of band management only interface at 192.168.1.12, for example.
    I opened a case about this some years ago running some version of 5.2.x and was told this was by design.
    I was told (not by fortinet) it has been tweaked in more recent firmware where there is a quasi-hidden vdom that separates the routing of dedicated management interfaces and doesn't eat a vdom license, but my configurations already include a separate management only vdom so i can't readily test it.
    post edited by Kenundrum - 2017/05/09 07:35:47

    NSE4
    Some FGT500Es, 500Ds, 60Ds at work
    FWF60E, FWF80CM at home
    #4
    HA
    Gold Member
    • Total Posts : 149
    • Scores: 6
    • Reward points: 0
    • Joined: 2010/09/19 07:10:45
    • Location: Luxembourg
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 07:45:04 (permalink)
    0
    Hello,
     
    config system settings
    set allow-subnet-overlap enable
     
    Regards,
     
    HA
    #5
    SaVen
    Bronze Member
    • Total Posts : 25
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/27 07:03:03
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 08:40:39 (permalink)
    0
    So looks like I cannot configure mgmt. interface with an overlapping IP address without a separate mgmt. vdom ?
    #6
    emnoc
    Expert Member
    • Total Posts : 5209
    • Scores: 339
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 09:18:53 (permalink)
    0
    the paused quasi  vdom is known as dmg-vdom btw. You have a interesting  challenge, but my 1st question is what do you need the  mgmt interface in the same network as non-mgmt  interfaces?
     
    I just check  a new  FGT3240C deployment  that we have going on,  and we have the mgmt interface address in the same  range of a VDOM interface btw and that interface is the GW for the mgt traffic.
     
    Not how I would design it but it is what it is ;)
     
    ken
     
     
    post edited by emnoc - 2017/05/09 09:19:56

    Attached Image(s)


    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #7
    SaVen
    Bronze Member
    • Total Posts : 25
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/27 07:03:03
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 09:30:15 (permalink)
    0
    Just a small correction /24 subnet about to use for mgmt. interface is non-overlapping and it is a standalone firewall(vdom enabled)so I cannot use ha-mgmt.
     
    Looks like system dedicated-mgmt. auto disables after we enable vdoms.
    #8
    emnoc
    Expert Member
    • Total Posts : 5209
    • Scores: 339
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 10:49:05 (permalink)
    0
    FYI
     
    If your standalone than HA mgmt does not apply  as you figured out. So in your case you want to use mgmt interface that are dedicated and not part of a VDOM per-se
     
    Why don't you set mode A-P in HA and just ignore having a "peer cluster"
     
    Than enable the ha-mgmt 
     
    e.g
     
    config sys ha 
        set group-name "CLUSTER1"
        set mode a-p
        set password mybadA$$P@$$w0rd   
        set ha-mgmt-status enable
        set ha-mgmt-interface "mgmt"
        set ha-mgmt-interface-gateway 172.17.1.1
        set priority 250
        set sync-config enable
        set encryption enable
    end

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #9
    SaVen
    Bronze Member
    • Total Posts : 25
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/27 07:03:03
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/09 21:25:11 (permalink)
    0
    That will just be a work around,enabling HA when there is no requirement, i think we should be looking for a solution rather.
    Is there way to submit a feature request.?
    #10
    emnoc
    Expert Member
    • Total Posts : 5209
    • Scores: 339
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Default gateway for Management Interface 2017/05/10 07:29:06 (permalink)
    0
    You need a NFW ( new feature request ) but you do have solution as-is that's vetted, just enable A-P with
     
     
    or
     
    The other option would be to look at doing the  "dmgmt-vdom" which is also used for a dedicate  mgmt
    http://socpuppet.blogspot.com/2015/12/hidden-vdom-fortios-multi-vdom-mode.html
     
     
    config system interface
        edit "port3"
            set vdom "dmgmt-vdom"
            set ip 1.1.1.1 255.255.255.254
            set type physical      
        next
    end


     
    FYIW v5.2.11 is now generating  the following error when do exactly the above
     
     
    "Serious error happened. Please reboot"
     
    YMMV
     
     
    post edited by emnoc - 2017/05/10 07:30:14

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #11
    Phinestra200
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/02/13 00:53:44
    • Status: offline
    Re: Default gateway for Management Interface 2019/01/14 03:22:38 (permalink)
    0
    Hi Emnoc,
     
    i have a question please. in a ha Env, in your config proposition : what  11.1.1.254 represent ( switch which mgmt is connected?) or ?
     
    "config sys ha
        set ha-mgmt-status enable
        set ha-mgmt-interface "mgmt"
        set ha-mgmt-interface-gateway 11.1.1.254
    end"
     
    we have a 300E a-p cluster in 5.6.4.
     
    we're triying to configure access to cluster through a Virtual IP address and both individual IP of each cluster unit.
    the management subnet is 10.10.10.0/26
    the switch wich the 3 ports (mgmt,port2(unit1) port2(unit2))  is 10.10.10.10/26
    we reserved the IP 10.10.10.1/26 for "mgmt" port for the access to the cluster.
    we reserved port2 for dedicated access for each unit with IP 10.10.10.2/26 ( unit 1) and 10.10.10.3/26 for unit 2.
     
    in config sys ha,  we've enabled the option  "management interface reservation" and set the default gateway to 10.10.10.1 (the IP of the mgmt port). not sure about the Gateway
     
    IN CLI (extract from full config)
     
    set ha-mgmt-status enable
        config ha-mgmt-interfaces
            edit 1
                set interface "port2"
                set dst 0.0.0.0 0.0.0.0
                set gateway 10.10.10.1
                set gateway6 ::
            next
        end
     
    we are unable to access the second unit, only the master O.o
    it is a correct way to configure and individual cluster unit access?
    i've followed the online help but the didn't specify what the default gateway refered ....
     
    thanks in advance for your help.
     
    Phi.
    #12
    Jump to:
    © 2019 APG vNext Commercial Version 5.5