FortiGate Routing Service Data over HA management interface

 Problem

Each cluster has its own HA management interface via which each individual member can be managed. Now it is required that the connection to FortiAnalyzer, SNMP etc. should be done via the respective HA management should be done.

Solution

With the ha-direct option it is achieved that services (e.g. syslog, FortiAnalyzer, SNMP, Netflow) are routed over this interface.

The detail configuration looks as follows:

FortiGate Primary HA Member

config system ha
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface mgmt1
            set gateway 192.169.80.1
        next
    end
    set ha-direct enable
end

• ha-mgmt-statuts: Activate dedicated management interface
• ha-mgmt-interfaces: Configure the dedicated management interfaces
• interface: linked physical interface
• gateway: default gateway to route traffic over the dedicated management interface
• ha-direct: enable direct HA management interface for FortiGate system services (e.g. FortiAnalyzer, SNMP, usw.)

config system interface
    edit mgmt1
        set ip 192.168.80.253/24
        set allowaccess https ssh snmp
        set dedicated-to management
    next
end

• dedicated-to: Declare this interface use for management traffic

FortiGate Secondary HA Member

config system interface
    edit mgmt1
        set ip 192.168.80.253/24
        set allowaccess https ssh snmp
        set dedicated-to management
    next
end

• dedicated-to: Declare this interface use for management traffic

Source IP Configuration for System services

There is no more configuration needed. With the ha-direct and the dedicated-to commands the FortiGate use the mgmt1 interface automaticlly.

Verify