D500 HA cluster and IP on interface

[gradius85]

I am trying to understand how to assign IP addresses to firewalls when in HA Cluster. Should I assign IP directly to physical interface or should I create a logical interface? I am looking to run in Active/Passive; however, I find it silly to create a IP on the physical interface, what would get mirror to the other unit. Due to the latter, a logical interface with IP sounds more beneficial.

Thank you

[ede_pfau]

Why silly?

In an a/p cluster, you treat the cluster as ONE machine. All configuration is synched from one member to the other (so you don't have to take care of that).

That is true for interface addresses as well. As the passive cluster member is not participating in your LANs' traffic the "duplicate" address does not matter.

To use a physical or a logical port (zone?) is up to you. Generally, you have all options available on physical ports, and only a subset on zones.

[gradius85]

ede_pfau wrote:

Why silly?

In an a/p cluster, you treat the cluster as ONE machine. All configuration is synched from one member to the other (so you don't have to take care of that).

That is true for interface addresses as well. As the passive cluster member is not participating in your LANs' traffic the "duplicate" address does not matter.

To use a physical or a logical port (zone?) is up to you. Generally, you have all options available on physical ports, and only a subset on zones.

This is what I was trying to detail - for what I wanted...

https://kb.fortinet.com/kb/documentLink.do?externalID=FD34744

[ede_pfau]

OK, I've read the KB article. This is one way how to manage a cluster. From experience, it's not really common to go into VDOM mode just for mgmt purposes, at least not in the scenarios I've managed.

Personally, I do not like VDOM mode, I'd only use it if I can't avoid it. As a CLI user, I constantly hop between global, root and xxx VDOM while debugging, and it just steals time.

Of course, there are valid reasons for using a VDOM (like the need for multiple default routes).

I get along quite well with mgmt ports alone, actually never needed to receive a slave's logs. YMMV.