Configure a redundant manager access data interface

This task configures a redundant manager access data interface to ensure continuous management connectivity. The secondary interface provides automatic failover capabilities when the primary management interface becomes unavailable, maintaining device management functionality.

When you use a data interface for manager access, you can configure a secondary data interface to take over management functions if the primary interface goes down. You can configure only one secondary interface. The device uses SLA monitoring to track the viability of the static routes and an ECMP zone that contains both interfaces so management traffic can use both interfaces.

Before you begin

  • The secondary interface needs to be in a separate security zone from the primary interface.

  • All of requirements apply to the primary interface also apply to the secondary interface.

Follow these steps to configure a redundant manager access data interface:

Procedure

Step 1

On the Devices > Device Management page, click Edit (edit icon) for the device.

Step 2

Enable manager access for the secondary interface.

This setting is in addition to standard interface settings such as enabling the interface, setting the name, setting the security zone, and setting a static IPv4 address.

  1. Choose Interfaces > Edit Physical Interface > Manager Access.

  2. Check Enable management on this interface for the Manager.

  3. Click OK.

Both interfaces show (Manager Access) in the interface listing.

Interface listing
Interface Listing

Step 3

Add the secondary address to the Management settings.

  1. Click Device, and view the Management area.

  2. Click Edit (edit icon).

    Edit management address
    Edit Management Address

  3. In the Management dialog box, modify the name or IP address in the Secondary Address field

    Management IP address
    Management IP Address

  4. Click Save.

Step 4

Create an ECMP zone with both interfaces.

  1. Click Routing.

  2. From the virtual router drop-down, choose the virtual router in which the primary and secondary interfaces reside.

  3. Click ECMP, and then click Add.

  4. Enter a Name for the ECMP zone.

  5. Select the primary and secondary interfaces under the Available Interfaces box, and then click Add.

    Add an ECMP zone
    The diagram illustrates the process of adding an Equal-Cost Multi-Path (ECMP) zone, highlighting the necessary configuration steps and components involved in establishing redundancy for the manager access data interface.

  6. Click OK, and then Save.

Step 5

Add equal-cost default static routes for both interfaces and enable SLA tracking on both.

The routes should be identical except for the gateway and should both have metric 1. The primary interface should already have a default route that you can edit.

Add/Edit static route
The interface configuration screen displays fields for adding or editing a static route, including options for gateway and metric settings.

  1. Click Static Route.

  2. Either click Add Route to add a new route, or click Edit (edit icon) for an existing route.

  3. From the Interface drop-down, choose the interface.

  4. For the destination network, select any-ipv4 from the Available Networks box and click Add.

  5. Enter the default Gateway.

  6. For Route Tracking, click Add (add icon) to add a new SLA monitor object.

  7. Enter the required parameters including the following:

    • The Monitor Address as the Cloud-Delivered Firewall Management Center IP address.

    • The zone for the primary or secondary management interface in Available Zones; for example, choose the outside zone for the primary interface object, and the mgmt zone for the secondary interface object.

    See Configure an SLA monitor for more information.

    Add SLA monitor
    The image illustrates the process of adding an SLA monitor to a management interface, highlighting the configuration options for primary and secondary zones.

  8. Click Save, then choose the SLA object you just created in the Route Tracking drop-down list.

  9. Click OK, and then Save.

    Repeat for the default route for the other management interface.

Step 6

Deploy configuration changes.

To deploy this feature, the Cloud-Delivered Firewall Management Center enables the secondary interface for management traffic, including auto-generated policy-based routing configuration for management traffic to get to the right data interface. The Cloud-Delivered Firewall Management Center also deploys a second instance of the configure network management-data-interface command. Note that if you edit the secondary interface at the CLI, you cannot configure the gateway or otherwise alter the default route, because the static route for this interface can only be edited in the Cloud-Delivered Firewall Management Center.