Configuring the management address

Configure the management address setting on a FortiManager that is behind a NAT device so the FortiGate can initiate a connection to the FortiManager. By configuring the management address setting in the CLI, FortiManager knows the public IP and can configure it on the FortiGate.

When a FortiGate is discovered by a FortiManager that is behind a NAT device, the FortiManager does not automatically set the IP Address on the FortiGate. This prevents the FortiGate from pointing to the FortiManager's private IP address and initiating the FortiGate-FortiManager (FGFM) tunnel to the FortiManager.

You can use the CLI to configure the management address when the NAT device in front of the FortiManager has a static 1:1 NAT rule.

To configure the management address:

In the FortiManager CLI, enter the following command to define either the management IP address or FQDN.

config systems admin setting

set mgmt-addr <string>

set mgmt-fqdn <string>

Configuring multiple management addresses

Multiple IP addresses or FQDNs can be configured for FortiManager. When multiple addresses are listed, the FortiGate will attempt to establish the FGFM tunnel using the first IP/FQDN listed, and if it is unreachable will try each subsequent IP/FQDN until the tunnel is established. Only one address is ever used to establish the FGFM tunnel at a time.

In FortiManager-HA, when listing multiple management addresses, the first address defines the Primary device and the second address is the Secondary device.

To configure multiple management addresses:

1. In the FortiManager CLI, enter the following commands.

   config system admin setting

   set mgmt-fqdn <FQDN/IP 1> <FQDN/IP 2> ...

   The set mgmt-fqdn command can be used with FQDNs and IP addresses.

2. FortiManager automatically pushes the configuration to FortiGate, and on the FortiGate you can see both management addresses listed:

   config system central-management

   set type fortimanager

   set fmg <FQDN/IP 1> <FQDN/IP 2> ...

   end

   Alternatively, you can configure these settings directly on FortiGate devices.