Configuring the FortiGate-VMs

To configure the FortiGate-VMs:

1. Log in to the primary FortiGate-VM:
   1. In the browser, enter https:// followed by the by the port1 (eth0) public IP address.
   2. Click Advanced, then proceed with the warning.
   3. Enter admin and the instance ID as the username and password, respectively, for the primary FortiGate-VM, and proceed to change the default password.
2. Configure the primary FortiGate-VM:
   1. Go to Network > Interfaces. Confirm all four port IP address settings.
   2. Go to Network > Static Routes. Set the static route for port1 and port2 to the corresponding gateway on each FortiGate-VM. Usually the last number is 1 for the same subnet (i.e. 10.0.0.1) on AWS.
   3. Ensure that the 10.2.1.0/24 and 10.1.1.0/24 (or your internal subnet CIDR) route has been created to forward internal traffic out of port2.
   4. Go to System > HA. Configure high availability (HA) settings. After enabling active-passive mode, you can only access the FortiGate-VM through the HA management port (elastic IP address on port4).
      1. From the Mode dropdown list, select Active-Passive.
      2. In the Device priority field, enter a value that will be higher than the one you configure for the secondary node.
      3. Configure the Group name and Password fields.
      4. Enable Session pickup.
      5. For Heartbeat interfaces, select port3.
      6. Enable Management Interface Reservation. From the Interface dropdown list, select port4. Specify the gateway for the same subnet.
      7. Enable Unicast Heartbeat. Specify the port3 IP address of the peer FortiGate.
3. Log in to and configure the secondary FortiGate-VM by repeating steps 1-2. When configuring device priority in HA settings, set a lower value than that of the primary node.
4. Configure policies to forward internal traffic out from port1. You only need to configure such policies on the primary FortiGate-VM, as the policy configuration will synchronize between the FortiGate-VMs.

   

5. You must configure a VDOM exception to prevent interface synchronization between the two FortiGates. Run the following commands in the FortiOS CLI:

   config system vdom-exception

   edit 1

   set object system.interface

   next

   edit 2

   set object router.static

   next

   edit 3

   set object firewall.vip

   next

   end

6. (Optional) You an configure an AWS SDN connector to allow population of dynamic objects such as policy objects. See Access key-based SDN connector integration.