I am trying to setup a scheduled backup on some vFW's running on our VSX cluster which should be sent to a linux based backup server. I use the same configuration on a few hardware FGT's which works fine.
I use the following config rule for this :
add backup-scheduled name "Daily" scp ip x.x.x.x path /home/username/firewall-name/ username "xxxxxxxx" password xxxxxxxx
When entering this command on one of the vFWs on the VSX cluster, it tries to connect but fails and doesn't save the backup configuration. I checked the firewall logging to see what went wrong. This traffic is coming from the mgmt interface and is being being blocked by a rule number 705 ??
Our last rule is rule 620, 705 doesn't exist. I checked the connection details and clicked on the rule 705. This redirects me to rule 620 which is a drop Any Any Any rule.
We have rules in place to allow this traffic, which work just fine for our other firewalls. Those rules aren't hit for the backups from the vFW's. I have tried pinging the backup server from the vFW, which gives the same result: Blocked by rule 705 ?
I suspect that the rules that work for the other firewalls aren't hit because of the fact that the mgmt interface of the vFWs are not in the firewall zones being used to allow this traffic but can't change the zone of the mgmt interfaces. I also vaguely remember something about routing mgmt traffic from the vsx nodes and/or vFW's through a vFW on that cluster is not possible ?
