Prepare the AWS environment
Before deploying a FortiSandbox instance, some basic steps are required to set up and run the AWS environment.
Start by logging into the AWS management console with a user account that has enough privileges to create a new Virtual Private Cloud (VPC).
Set up the basic AWS environment for FortiSandbox
Create a Virtual Private Cloud (VPC)
- Go to VPC Dashboard > Your VPCs and click Create VPC.
Create a new VPC even though there is a default VPC.
- Enter the following information, then click Create VPC.
Create network subnets for FortiSandbox instance
On AWS, FortiSandbox uses Port1 or any other administrative port set through the CLI command set admin-port as reserved for device management, and Port2 be reserved to communicate with local Windows VM or Linux clones. The other ports are used for file inputs from client devices and inter-communication among cluster nodes. Each port should be on its dedicated subnet.
In a regular setup, these two subnets should be created:
- Management subnet on which FortiSandbox management interface listens. Client devices can also connect to this subnet to submit files. We will use IPv4 CIDR 10.0.0.0/24 as an example in the following sections.
- Local VM clones communication subnet which FortiSandbox instances use to communicate with local Windows or Linux clones. If you choose to use Windows cloud clones located in Fortinet Data Center, this subnet is not required. We will use IPv4 CIDR 10.0.1.0/24 as an example in the following sections.
If needed, you can create more subnets, such as for client devices to submit files, or inter-communications between HA Cluster nodes, or for dedicated internet access subnet for installed customized VMs.
To create a subnet:
- Click Subnets > Create Subnet.
- In the Create Subnet dialog box, enter the following information, then click Create subnet.
- For Name tag, enter a meaningful name. For example, Public_FortiSandbox.
- For VPC, select the VPC you just created.
- For IPV4 CIDR block, enter a valid block such as
10.0.0.0/24.
Create an internet gateway
If VPC needs to communicate with the Internet, for example, for FortiSandbox instance to get FortiGuard updates from Fortinet, or to access FortiSandbox instance from the Internet, an Internet gateway is needed.
To create an Internet gateway:
- Under Virtual Private Cloud > Internet Gateways, click Create Internet Gateway.
- For Name tag, enter a name. For example, vpc-gw and click Create internet gateway.
- When the Internet Gateway is created, click Attach to VPC.
- Select the VPC and click Attach internet gateway.
Create a NAT gateway
A NAT gateway is used by instances in a private subnet to communicate with the internet. A NAT gateway is required if you need to install a customized VM in AWS.
To create a NAT gateway:
- In the left navigation pane, under Virtual private cloud > NAT gateways, click Create NAT gateway.
- In the NAT gateway settings window, enter the following information, then click Create NAT gateway.
Name
Enter a name that will allow you to easily recognize the object type.
Subnet
Select the public subnet you created.
Connectivity type
Select Public.
Elastic IP allocation ID
Select an existing available EIP or click Allocate Elastic IP to allocate a new one
Create two route tables
Appropriate route table entries are needed for the FortiSandbox instance to communicate with other network entities.
To create route table and entries:
- Under Virtual Private Cloud > Route Tables, click Create Route Table.
- In the Create Route Table dialog box, enter the following information, then click Create route table.
- For Name tag, enter a name. For example, route_FortiSandboxTest.
- For VPC, select the VPC you created.
- Go to Subnet Associations > Edit subnet associations, select the management subnet you created, then click Save associations..
- After the route table is created, you can add static route entries to define how the FortiSandbox instance communicates with others. For example, to access FortiSandbox instance from the Internet:
Go to Routes > Add Route, enter the following information, then click Save changes.
- For Destination, enter
0.0.0.0/0. - For Target, select the internet gateway for the management subnet you created.
- For Destination, enter
- Create a second route table:
- Repeat steps 1-4 to create a second route table, and associate all the private subnets to it.
- Go to Routes > Add Route. Enter the following information, and click Save changes.
Destination
Enter 0.0.0.0/0.
Target
Select the NAT gateway for the private subnet you created.
Create two security groups
It's important to limit only valid network traffic to and from FortiSandbox instances. To do that, you will need to create security groups and security rules for traffic.
- Under Virtual Private Cloud > Security Groups, click Create security group.
- Enter the following information for the Basic details settings.
- For Security group name, enter a name.
- For Description, enter a description.
- For VPC, select the VPC you just created.
- Add the following Inbound rules:
Details
Value
Type
Custom TCP.
Protocol
TCP
Port Range
Allow the following ports to be accessible:
- 443 (HTTPS)
- 22 (if SSH access is needed)
- 514 (if Fortinet Fabric devices such as FortiGate and FortiMail need to submit jobs)
- 9833 (for on-demand interactive scans)
21 (FortiSandbox hardcoded port2 to communicate with custom VM clones via FTP)
More rules can be added. For example, you can add a rule to allow access to FortiSandbox's MTA adapter. For more port information, see Port Information section of the FortiSandbox Administration Guide.
Source
Custom.
For the SourceIP, enter a trusted IP range that can access the FortiSandbox instance.
- Allow all traffic for outbound rules, then click Create security group.
- Follow steps 1-4 to create a second security group for your private subnet. You can set both inbound and outbound rules to allow all traffic.