Verifying the deployment

FortiGate Autoscale for AWS creates two Auto Scaling groups with instances as specified in the CFT parameters. One of theses instances is the elected primary instance. Verify the following:

• the Auto Scaling groups
• the primary election

If deploying with Transit Gateway integration, you will also need to verify:

• the Transit Gateway

To verify the Auto Scaling groups:

1. In the AWS console, select the Services > Compute > EC2.
2. In the left navigation tree, click AUTO SCALING > Auto Scaling Groups.
3. Click the filter box and look up the Auto Scaling groups using the Unique ID.
4. The name of each group will start with the prefix you specified in Resource tag prefix. Confirm that the number in the Instances column is equal to or greater than the Desired capacity you specified.

   

5. In the left navigation tree, click INSTANCES > Instances.
6. Click the filter box and look up instances using the ResourceTagPrefix.
7. Instances will be listed with their current state.

   

To verify the primary election:

The primary instance is noted in the AutoscaleRole column:

If the AutoscaleRole column is not displayed, click the Preferences cog and locate the Tag columnsdropdown. Select AutoscaleRole and then click Confirm.

To verify the Transit Gateway:

1. In the AWS console, select the Services > Network & Content Delivery > VPC.
2. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateways.
3. Filter by the Tag Key ResourceGroup. There should be one result.

   

4. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Customer Gateways.
5. Filter by the Tag Key ResourceGroup. There should be one customer gateway per running FortiGate-VM instance (2 at the start).

   

6. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Site-to-Site VPN Connections.
7. Filter by the Tag Key ResourceGroup. There should be two items, 1 per FortiGate-VM instance, each with a corresponding Transit Gateway attachment.

   

8. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Attachments.
9. Filter by the Tag Key ResourceGroup. There should be one VPC, and one VPN per running FortiGate-VM instance in the Auto Scaling group. (2 at the start, one primary and one secondary). The VPN name will contain the public IP address of the VPN.

   

10. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Route Tables.
11. Filter by the Tag Key ResourceGroup. There should be two items, one for inbound and one for outbound. For diagrams, refer to the Appendix.