Fortinet black logo

AWS Administration Guide

Verifying the deployment

Copy Link
Copy Doc ID f4e6f33e-6876-11ea-9384-00505692583a:196673
Download PDF

Verifying the deployment

FortiGate Autoscale for AWS creates two Auto Scaling groups with instances as specified in the CFT parameters. One of theses instances is the elected primary instance. Verify the following:

If deploying with Transit Gateway integration, you will also need to verify:

To verify the Auto Scaling groups:
  1. In the AWS console, select the Services > Compute > EC2.
  2. In the left navigation tree, click AUTO SCALING > Auto Scaling Groups.
  3. Click the filter box and look up the Auto Scaling groups using the Unique ID.
  4. The name of each group will start with the prefix you specified in Resource tag prefix. Confirm that the number in the Instances column is equal to or greater than the Desired capacity you specified.

    Auto Scaling group

  5. In the left navigation tree, click INSTANCES > Instances.
  6. Click the filter box and look up instances using the ResourceTagPrefix.
  7. Instances will be listed with their current state.

    all instances

To verify the primary election:

The primary instance is noted in the AutoscaleRole column:

Items tab

If the AutoscaleRole column is not displayed, click the Preferences cog and locate the Tag columnsdropdown. Select AutoscaleRole and then click Confirm.

Adding the AutoscaleRole column

To verify the Transit Gateway:
  1. In the AWS console, select the Services > Network & Content Delivery > VPC.
  2. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateways.
  3. Filter by the Tag Key ResourceGroup. There should be one result.

    Filtered Transit Gateways

  4. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Customer Gateways.
  5. Filter by the Tag Key ResourceGroup. There should be one customer gateway per running FortiGate-VM instance (2 at the start).

    Filtered Customer Gateways

  6. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Site-to-Site VPN Connections.
  7. Filter by the Tag Key ResourceGroup. There should be two items, 1 per FortiGate-VM instance, each with a corresponding Transit Gateway attachment.

    Filtered Site-to-Site VPN Connections

  8. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Attachments.
  9. Filter by the Tag Key ResourceGroup. There should be one VPC, and one VPN per running FortiGate-VM instance in the Auto Scaling group. (2 at the start, one primary and one secondary). The VPN name will contain the public IP address of the VPN.

    Filtered Transit Gateway Attachments

  10. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Route Tables.
  11. Filter by the Tag Key ResourceGroup. There should be two items, one for inbound and one for outbound. For diagrams, refer to the Appendix.

    Filtered Transit Gateway Route Tables

Verifying the deployment

FortiGate Autoscale for AWS creates two Auto Scaling groups with instances as specified in the CFT parameters. One of theses instances is the elected primary instance. Verify the following:

If deploying with Transit Gateway integration, you will also need to verify:

To verify the Auto Scaling groups:
  1. In the AWS console, select the Services > Compute > EC2.
  2. In the left navigation tree, click AUTO SCALING > Auto Scaling Groups.
  3. Click the filter box and look up the Auto Scaling groups using the Unique ID.
  4. The name of each group will start with the prefix you specified in Resource tag prefix. Confirm that the number in the Instances column is equal to or greater than the Desired capacity you specified.

    Auto Scaling group

  5. In the left navigation tree, click INSTANCES > Instances.
  6. Click the filter box and look up instances using the ResourceTagPrefix.
  7. Instances will be listed with their current state.

    all instances

To verify the primary election:

The primary instance is noted in the AutoscaleRole column:

Items tab

If the AutoscaleRole column is not displayed, click the Preferences cog and locate the Tag columnsdropdown. Select AutoscaleRole and then click Confirm.

Adding the AutoscaleRole column

To verify the Transit Gateway:
  1. In the AWS console, select the Services > Network & Content Delivery > VPC.
  2. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateways.
  3. Filter by the Tag Key ResourceGroup. There should be one result.

    Filtered Transit Gateways

  4. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Customer Gateways.
  5. Filter by the Tag Key ResourceGroup. There should be one customer gateway per running FortiGate-VM instance (2 at the start).

    Filtered Customer Gateways

  6. In the left navigation tree, click VIRTUAL PRIVATE NETWORK (VPN) > Site-to-Site VPN Connections.
  7. Filter by the Tag Key ResourceGroup. There should be two items, 1 per FortiGate-VM instance, each with a corresponding Transit Gateway attachment.

    Filtered Site-to-Site VPN Connections

  8. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Attachments.
  9. Filter by the Tag Key ResourceGroup. There should be one VPC, and one VPN per running FortiGate-VM instance in the Auto Scaling group. (2 at the start, one primary and one secondary). The VPN name will contain the public IP address of the VPN.

    Filtered Transit Gateway Attachments

  10. In the left navigation tree, click TRANSIT GATEWAYS > Transit Gateway Route Tables.
  11. Filter by the Tag Key ResourceGroup. There should be two items, one for inbound and one for outbound. For diagrams, refer to the Appendix.

    Filtered Transit Gateway Route Tables