AWS Administration Guide

• About FortiGate-VM for AWS
  • Instance type support
  • Region support
  • Models
  • Licensing
    • Order types
    • Creating a support account
      • BYOL
      • On-demand
    • FortiCloud-generated license adoption for AWS on-demand variant
    • Migrating a FortiGate-VM instance between license types
• Deploying FortiGate-VM on AWS
  • Launching FortiGate-VM on AWS
  • Security best practices
    • Opening ports in the security group
    • Administrative access
    • IAM roles
    • Login credentials
  • AWS services and components
  • Bootstrapping the FortiGate-VM at initial bootup using user data
    • Setting up IAM roles
    • Creating S3 buckets with license and firewall configurations
    • Launching the instance using roles and user data
  • Deploying from BYOL AMI
  • Deploying on AWS China
    • Creating a VPC and subnets
    • Attaching the new VPC Internet gateway
    • Launching the instance with shared FortiGate-VM AMI
    • Connecting to the FortiGate-VM
  • Upgrading the FortiGate-VM
  • Backing up and restoring configuration
• Deploying auto scaling on AWS
  • Planning
  • Obtaining the deployment package
  • Deploying the CloudFormation templates
    • CFT parameters
    • Optional settings
    • Completing the deployment
  • Locating deployed resources
  • Verifying the deployment
  • Connecting to the primary FortiGate-VM
  • Attaching a VPC to the TGW
  • Troubleshooting
  • Appendix
    • FortiGate Autoscale for AWS features
    • Deployment templates
    • Cloud-init
    • Architectural diagrams
    • Upgrading the deployment
    • FortiGate Autoscale for AWS document history
• Single FortiGate-VM deployment
  • Determining your licensing model
  • Creating a VPC and subnets
  • Attaching the new VPC Internet gateway
  • Subscribing to the FortiGate
  • Creating routing tables and associate subnets
  • Connecting to the FortiGate-VM
  • Setting up a Windows Server in the protected network
• HA for FortiGate-VM on AWS
  • Deploying FortiGate-VM A-P HA on AWS within one zone
  • Deploying FortiGate-VM active-passive HA AWS between multiple zones
  • Deploying FortiGate-VM active-passive HA AWS between multiple zones manually with Transit Gateway integration
    • Creating VPCs and subnets
    • Creating a Transit Gateway and related resources
    • Creating an Internet gateway
    • Creating VPC route tables
    • Deploying FortiGate-VM from AWS marketplace
    • Adding network interfaces and elastic IP addresses to the FortiGate-VMs
    • Configuring the FortiGate-VMs
    • Updating the route table and adding an IAM policy
    • Testing FortiGate-VM HA failover
• Deploying FortiGate-VM using Terraform
• Deploying FortiGate-VM on Snowball Edge
  • Ordering an Snowball Edge device
  • Getting connected to the Snowball Edge device
  • Configuring the Snowball Edge networking
  • Configuring Snowball Edge via AWS OpsHub
  • Generating a raw image and registering it in OpsHub
  • Creating the FortiGate-VM Snowball Edge
  • Creating a DNI
  • Licensing the FortiGate-VM on Snowball Edge
  • Accessing and configuring the FortiGate-VM
  • FortiManager
    • Creating a FortiManager on Snowball Edge
    • Configuring the FortiManager as a licensing server for the FortiGate-VM
  • Use case: Traffic inspection with DNI and VLANs
  • Troubleshooting
• SDN connector integration with AWS
  • Access key-based SDN connector integration
  • Configuring an AWS SDN connector using IAM roles
  • SDN connector support for alternate resources
  • AWS EKS SDN connector
  • Populating threat feeds with GuardDuty
    • Security implications
    • Parameters
    • Installation
      • Prerequisites
      • Preparing the deployment package
      • Setting up the S3 bucket
      • Setting up the DynamoDB table
      • Setting up the IAM role and policies
      • Creating the Lambda function
      • Setting up the DynamoDB stream trigger
    • Setting up CloudWatch
    • Testing the setup
    • (Optional) Generating sample findings in GuardDuty
    • Setting up the FortiGate(s)
    • Cleanup
  • Pipelined automation using AWS Lambda
    • Creating an automation stitch
    • Configuring an example automation stitch
  • Configuring FortiGate-VM load balancer using dynamic address objects
  • Accessing a cloud server using an SDN connector via VPN
  • SDN connector support for AWS STS
• VPN for FortiGate-VM on AWS
  • Connecting a local FortiGate to an AWS VPC VPN
  • Connecting a local FortiGate to an AWS FortiGate via site-to-site VPN
• SD-WAN
  • SD-WAN cloud on-ramp
  • SD-WAN Transit Gateway Connect
    • Creating the TGW and related resources
    • Configuring BGP
    • Verifying the configuration
  • Cloud WAN
• Security inspection with GWLB integration
  • North-south security inspection to customer VPC
    • Creating the GWLB and registering targets
    • Creating the LB endpoint
    • VPC route tables
    • Post-deployment configuration
    • Validating the configuration
  • East-west security inspection between two customer VPCs
    • Creating the GWLB and registering targets
    • Creating the LB endpoint
    • Creating the transit gateway
    • Route tables
      • East-west egress route table
      • Configuring TGW route tables
    • Post-deployment configuration
    • Validating the configuration
  • Multitenancy support with AWS GWLB
• Multiregion FortiGate-VM deployment with FortiSASE