LDAP and FSSO over dedicated OOB MGMT interface

[blazarov]

Hello,

i am trying to achieve something very common, but it seems there's no way to get it working.

Fortigate is deployed as external FW in L3 mode with inside and outside interface. Dedicated out-of-band management with separete default GW is a strict customer requirement. Fortigate needs to talk LDAP and FSSO to an internal server via the MGMT port - its data Interfaces are not allowed to reach the internal protected networks where AD lives.

Configuring the out of band management interface with separate default GW is easy - In fact I have found 3 different ways to do that:

1. Set "dedeicated to management" and default route in edit interface

2. config system dedicated-management

3. config system ha

    config ha-mgmt-interfaces

       edit 1

            set interface "MGMT-V13"             set gateway 10.11.13.1     set ha-direct enable 4. separate management VDOM

The problem comes to make LDAP and FSSO (and probably some other outbound connections that fortigate initiates) use the MGMT interface.

In options 1,2,3 you are not allowed to set MGMT interface IP in "config user ldap/fsso" -> "set source-ip" - error:

10.11.13.250 is not valid source ip. node_check_object fail! for source-ip 10.11.13.250 value parse error before '10.11.13.250' Command fail. Return code -8 Probably because OOB MGMT interface goes to a special VDOM.

I had best success with option 3. LDAP seems to be working, despite test from GUI fails. When doing PCAP i can see that when i do test from GUI it uses egress interface from VDOM, instead of MGMT interface. FSSO is definately not working.

Am i missing something? This is a pretty common feature, and it is very sad that with all these options and flexibility you cant achieve it.