AWS Administration Guide

• About FortiGate-VM for AWS
  • Instance type support
  • Region support
  • Models
  • Licensing
    • Order types
    • Creating a support account
    • FortiCare-generated license adoption for AWS on-demand variant
• Deploying FortiGate-VM on AWS
  • Launching FortiGate-VM on AWS
  • Security best practices
    • Opening ports in the security group
    • Administrative access
    • IAM roles
    • Login credentials
  • AWS services and components
  • Bootstrapping the FortiGate-VM at initial boot-up using user data
    • Setting up IAM roles
    • Creating S3 buckets with license and firewall configurations
    • Launching the instance using roles and user data
  • Deploying from BYOL AMI
  • Deploying on AWS China
    • Creating a VPC and subnets
    • Attaching the new VPC Internet gateway
    • Launching the instance with shared FortiGate-VM AMI
    • Connecting to the FortiGate-VM
  • Upgrading the FortiGate-VM
  • Backing up and restoring configuration
• Deploying auto scaling on AWS
  • Planning
  • Obtaining the deployment package
  • Deploying the CloudFormation templates
    • CFT parameters
    • Optional settings
    • Completing the deployment
  • Locating deployed resources
  • Verifying the deployment
  • Connecting to the primary FortiGate-VM
  • Attaching a VPC to the Transit Gateway
  • Troubleshooting
  • Appendix
    • FortiGate Autoscale for AWS features
    • Deployment templates
    • Cloud-init
    • Architectural diagrams
    • FortiGate Autoscale for AWS document history
• Single FortiGate-VM deployment
  • Determining your licensing model
  • Creating a VPC and subnets
  • Attaching the new VPC Internet gateway
  • Subscribing to the FortiGate
  • Creating routing tables and associate subnets
  • Connecting to the FortiGate-VM
  • Setting up a Windows Server in the protected network
• HA for FortiGate-VM on AWS
  • Deploying and configuring FortiGate-VM active-active HA
  • Deploying and configuring ELB-based HA/load balancing
    • Creating two subnets on your Amazon VPC
    • Creating a security group for the FortiGate-VM
    • Allocating EIPs for the FortiGate-VM and for public access
    • Deploying the FortiGate-VM
    • Assigning an IP address to the FortiGate-VM
    • Creating a default route
    • Configuring the FortiGate-VM
    • Deploying the Windows Server
    • Creating a second subnet and deploying a second FortiGate-VM
    • Creating an ELB between the FortiGate-VMs
    • Results
  • Deploying FortiGate-VM active-passive HA on AWS within one zone
  • Deploying FortiGate-VM active-passive HA AWS between multiple zones
  • Deploying FortiGate-VM active-passive HA AWS between multiple zones manually with Transit Gateway integration
    • Creating VPCs and subnets
    • Creating a Transit Gateway and related resources
    • Creating an Internet gateway
    • Creating VPC route tables
    • Deploying FortiGate-VM from AWS marketplace
    • Adding network interfaces and elastic IP addresses to the FortiGate-VMs
    • Configuring the FortiGate-VMs
    • Updating the route table and adding an IAM policy
    • Testing FortiGate-VM HA failover
• Deploying FortiGate-VM using Terraform
• Security Fabric connector integration with AWS
  • Certificate-based Security Fabric connector integration
    • Configuring the SDN connector to populate dynamic objects
    • Creating an address
      • Creating an address using the GUI
      • Creating an address using the CLI
      • (Connectivity test) Adding an EC2 instance to test automatic population
    • Creating a firewall policy
  • Configuring an AWS Fabric connector using IAM roles
  • AWS Kubernetes (EKS) Fabric connector
  • Populating threat feeds with GuardDuty
    • Security implications
    • Parameters
    • Installation
      • Prerequisites
      • Preparing the deployment package
      • Setting up the S3 bucket
      • Setting up the DynamoDB table
      • Setting up the IAM role and policies
      • Creating the Lambda function
      • Setting up the DynamoDB stream trigger
    • Setting up CloudWatch
    • Testing the setup
    • (Optional) Generating sample findings in GuardDuty
    • Setting up the FortiGate(s)
    • Cleanup
  • Pipelined automation using AWS Lambda
    • Creating an automation stitch
    • Configuring an example automation stitch
  • Accessing a cloud server using a Fabric connector via VPN
• VPN for FortiGate-VM on AWS
  • Connecting a local FortiGate to an AWS VPC VPN
  • Connecting a local FortiGate to an AWS FortiGate via site-to-site VPN
• SD-WAN cloud on-ramp