Configuring EMS HA using AWS RDS Microsoft SQL Server

This document provides information about deploying FortiClient EMS using AWS Relational Database Service (RDS) Microsoft SQL Server. It aims to provide a step-by-step guide on EMS high availability (HA) with some basic coverage of AWS services. There may be some inaccuracies as regards to AWS services. Do not use this guide for AWS architectural design.

The example deployment that this document describes uses the following components:

• Two EC2 instances for EMS primary and secondary nodes
• Amazon FSx file system for network file share
• RDS Microsoft SQL Server

Before deploying virtual machine (VM) instances in AWS, review the following:

• Virtual private clouds (VPC)
• Control traffic to resources using security groups

This deployment consists of the following steps:

1. Deploy VMs in AWS. See To deploy VMs in AWS:.
2. Launch RDS Microsoft SQL Server. See To launch RDS Microsoft SQL Server:.
3. Set up an FSx file system. See To set up an FSx file system:.
4. Install EMS. See To install EMS:.
5. Set up health check and Route53 DNS for failover. See To set up health check and Route 53 DNS for failover:.
6. Restore a database (DB). See To restore a DB:.

This example configures EMS nodes in the same zone. You can also deploy the EMS nodes in different zones.

To deploy VMs in AWS:

1. In the AWS console, search for EC2.
2. Select Launch Instance.
3. Configure the basic configuration fields as follows:
   1. For Application and OS Images, select Windows server and Machine Image.
   2. Select the desired instance type. See Management capacity.
   3. Create a key pair if you need to be able to access the machine via RDP. See Create a key pair using Amazon EC2.
4. Configure Network Settings as follows:
   1. Assign the desired VPC and subnet.
   2. Enable Auto-assign public IP.
   3. Select the desired security group.
5. Configure other settings as desired, then launch the instance. This example uses default settings.
6. Repeat steps 2-5 to launch the secondary EMS instance.
7. For both EMS instances, configure security group inbound ports and allow access to the following ports:

   Port	Usage
   8013	Endpoint connection
   443	EMS web access
   8015	FortiGate Fortinet Security Fabric connection
   10443	FortiClient package deployment
   8443	Chromebook connection

To launch RDS Microsoft SQL Server:

1. In the AWS console, search for RDS.
2. Select Create Database. This example uses Standard create.
3. For Engine options, select Microsoft SQL Server. This example uses SQL Server Standard Edition.
4. Configure settings as follows:
   1. Set the DB instance identifier.
   2. Set the desired master username and password.
   3. For SQL instance compute configuration, see Management capacity. This example uses Standard classes.
5. Configure Storage settings and Availability & Durability as required.
6. Configure Connectivity Settings as follows:
   1. Select Don't connect to an EC2 compute resource.
   2. Assign a VPC and subnet to the instance. This example enables public access.
   3. Assign a security group with inbound access enabled for the SQL port. In this example, the port is 1433.
7. Configure other settings as desired, and create the DB.

To set up an FSx file system:

Sharing files between EMS nodes relies on network fileshares. AWS FSx uses Active Directory (AD) for setup. This example uses a self-managed Microsoft AD and an EC2 AD instance set up on AWS which also acts as a DNS server. Both EMS nodes can reach AD and resolve FQDN. Ensure that the AD domain controller and DNS server are reachable from FSx. Before setup, see Prerequisites for using a self-managed Microsoft AD.

Both EMS nodes should be able to reach the FSx fileshare. In this example, FSx and the EMS nodes are in the same VPC and subnet. If they are in different VPCs, establish VPC peering for reachability. See .Create a VPC peering connection.

1. In the AWS console, search for FSx.
2. Create a new file system:
   1. Select Amazon FSx for Windows File Server.
   2. Configure a desired name for the file system. This example uses Single-AZ 2.
   3. For Storage type, select SSD.
   4. Enter the desired storage capacity.
   5. Configure Network & Security as follows:
      1. Assign a VPC and subnet to the file system.
      2. Select the desired security group. Ensure that the inbound ports are opened as Prerequisites for using a self-managed Microsoft AD describes.
   6. Configure Windows authentication as follows:
      1. For user authentication, select Self-managed Microsoft Active Directory.
      2. In the Active Directory domain name field, enter the AD domain name.
      3. In the DNS server IP addresses field, enter the DNS server IP address.
      4. In the Service account username and Service account password fields, enter credentials for the desired account with delegated permissions. See Prerequisites for using a self-managed Microsoft AD for service account permissions.

         

   7. Configure other settings as desired, then create the file system.
3. To obtain the fileshare URL, highlight the FSx and select Attach. In this example, the URL is file:////amznfsxbgatdbyn.aws-emsha.com/share. You use this URL during EMS installation.

   

To install EMS:

During EMS installation, the installer mounts fileshares as the W:\ drive. Ensure that the W:\ drive is free on all EMS nodes.

1. Start the EMS installation on the primary node using the following command: FortiClientEndpointManagementServer_7.0.8._x64.exe SQLServer=<AWS_RDS_FQDN> SQLPort=<AWS_SQL_port> PaaS=aws SQLUser=<SQL_user> SQLUserPassword=<SQL_password> InstallSQL=0 ScriptDB=1 FileStorageNic= FileStorageNicUser= FileStorageNicPass=

   The following table describes the command parameters:

   Parameter	Description
   PaaS=aws	Informs EMS that it will connect to an AWS RDS.
   ScriptDB=1	Specifies that this is the primary node.
   FileStorageNic	Fileshare path.
   FileStorageNicUser	Fileshare username.
   FileStorageNicPass	Fileshare password.

   The FileStorageNicUser format is domain\username. The user should have read/write permissions to the share.

   The following provides an example command: SQLServer=mssqldb.awsmssql12345.us-east-1.rds.amazonaws.com SQLPort=1433 PaaS=aws SQLUser=awssql SQLUserPassword=Passowrd123! InstallSQL=0 ScriptDB=1 FileStorageNic= \\amznfsxbgatdbyn.aws-emsha.com\share FileStorageNicUser=aws-emsha.com\Administrator FileStorageNicPass=)J(Sz2W5RKAoA4.Hgq87GH=q

   When installation completes, a mapped drive for the fileshare is created.

   

2. Start the EMS installation on the secondary node using the following command: FortiClientEndpointManagementServer_7.0.8._x64.exe SQLServer= mssqldb.awsmssql12345.us-east-1.rds.amazonaws.com SQLPort=1433 PaaS=aws SQLUser= awssql SQLUserPassword=Password123! InstallSQL=0 ScriptDB=0 FileStorageNic= \\amznfsxbgatdbyn.aws-emsha.com\share FileStorageNicUser=aws-emsha.com\Administrator FileStorageNicPass=)J(Sz2W5RKAoA4.Hgq87GH=q

   ScriptDB=0 indicates that this is the secondary node.

To set up health check and Route 53 DNS for failover:

1. In AWS, search for and select Route 53.
2. From the navigation pane, select Health Checks.
3. Click Create health check.
4. Configure the following:
   1. For What to monitor, select Endpoint.
   2. For Specify endpoint by, select either option.
   3. Enter the EMS primary node domain name or IP address.
   4. From the Protocol dropdown list, select TCP.
   5. In the Port field, enter 8013.

      

   6. Create the health check.
5. Repeat steps 3-4 for the EMS secondary node.
6. Check the status on the health check page. The primary node status is healthy and the secondary node status is unhealthy.
7. You must configure the FQDN to use for EMS HA in a Route 53-hosted zone to effectively send traffic to the correct EMS based on availability. In this example, the FQDN is fctemsha.aws-emsha.com. You can configure this on EMS in System Settings > EMS Settings. For this example, configuration is as follows:
   1. Select to create a hosted zone, and enter the domain name.
   2. For Type, select Public hosted zone. Create the zone. You should register the domain before adding it to a hosted zone. You can use AWS domain registration services to register a domain if not already registered.
   3. After AWS creates the hosted zone, select the zone and create a record.
   4. Configure the record:
      1. From the Record type dropdown list, select CNAME.
      2. In the Value field, enter the primary EMS node domain name.
      3. From the Routing policy dropdown list, select Failover.
      4. From the Failover record type dropdown list, select Primary.
      5. In the Health check ID field, enter the EMS primary node health check ID.
      6. In the Record ID field, enter a unique record ID.
   5. Repeat steps c-i to create a record for the secondary EMS node. For Failover record type, select Secondary. In the Health check ID field, enter the EMS secondary node health check ID.

      

To restore a DB:

When using an AWS RDS, EMS cannot manage database backups or restore backups generated from another EMS instance. Therefore, these functionalities are disabled during EMS installation. Taking a database snapshot from the AWS console and restoring the snapshot is the preferred backup and restore method. This deployment does not support restoring EMS using a regular SQL Server backup or upgrading EMS from an existing SQL server installation to an EMS with AWS RDS.

1. In the AWS console, go to the RDS DB.
2. From the navigation pane, select Snapshots > Take snapshot.
3. Select the desired DB instance.
4. Enter the desired snapshot name.
5. Select Actions > Restore snapshot.
6. Restoring a snapshot requires a new RDS DB instance creation. Follow the steps in To launch RDS Microsoft SQL Server:.
7. Update EMS to point to the new RDS instance:
   1. On the primary EMS node, go to C:\Program Files (x86)\Fortinet\FortiClientEMS.
   2. Open das.conf in a text editor.
   3. Update the Server field to the new RDS instance.
   4. Save.
   5. Open db.conf in a text editor.
   6. Update the Server field to the new RDS instance.

      

   7. Save.
   8. Repeat steps a-g on the EMS secondary node.