system sdn-connector
Use this command to create external connectors for Amazon Web Services (AWS), Microsoft Azure, and OCI.
The AWS and Azure connectors authorize FortiWeb to automatically retrieve the IP addresses of the back-end servers deployed on AWS or Azure.
OCI Connector is available only when FortiWeb-VM is deployed on OCI. It is used to obtain FortiWeb HA member information in Active-Passive mode.
To use this command, your administrator account’s access control profile must have either w
or rw
permission to the sysgrp
area. For details, see Permissions.
Syntax
config system sdn-connector
edit <name>
set region <string>
setserver-region-type {commercial | government}
end
end
Variable | Description | Default |
<name>
|
Enter a name for the external connector object. | No default
|
status {enable | disable}
|
Enable or disable the external connector object. |
enable
|
type {azure | aws | oci}
|
Select the type of the connector. | No default
|
update-interval <int>
|
Specify the update interval for the connector to get AWS objects and dynamically populates the information in the server pool configuration. |
60
|
AWS connector settings |
|
|
access-key <string>
|
Specify the access key ID. An access key on AWS grants programmatic access to your resources. If you have security considerations, it's recommended to create an IAM role specially for FortiWeb and grant read-only access. See this article for how to get access key ID and secret access key on AWS: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html. |
No default
|
secret-key <string>
|
Specify the secret access key. |
No default
|
region <string>
|
Specify the region where your instances are deployed, for example, us-west-2. | No default
|
Azure connector settings You must create an Azure AD application to generate the Azure client ID and corresponding Azure client secret. This application must be a service principal. Otherwise, the Fabric connector cannot read the inventory. You can find the complete instructions at Use portal to create an Azure Active Directory application and service principal that can access resources.
|
|
|
tenant-id <string>
|
See instructions above for how to find the Tenant ID. | No default
|
subscription-id <string>
|
The ID of the subscription where your application server is deployed. | No default
|
client-id <string>
|
See instructions above for how to find the Client ID. | No default
|
client-secret <string>
|
See instructions above for how to find the Client Secret. | No default
|
resource-group <string>
|
The name of the resource group where your application server is deployed. Make sure that the service principal (app registration) is granted for the network contributor and VM contributor roles for the target resource group. | No default
|
azure-region <string>
|
The region where your application server is deployed. | No default
|
OCI Connector settings you need to generate the RSA key that will be used for authentication when FortiWeb-VM connects to the load balancer.
For a complete guide on the OCI connector settings, see Configuring OCI Connector. |
|
|
If your OCI server region is either “US Federal Cloud with DISA Impact Level 5 Authorization Regions” or “US Government Cloud with FedRAMP Authorization Regions”, please select |
|
|
server-region <region-id>
|
Enter the Region Identifier of your load balancer.
|
No default
|
To get the User OCID:
|
No default
|
|
To get the tenant OCID:
|
No default
|
|
To get the compartment OCID:
Note: If you don't have a compartment, you can leave this option empty. |
No default
|
|
private-key <userdef>
|
Upload the private key file you have generated when system sdn-connector. | No default
|
To apply the external connector, you need to select it in the server pool configurations so that FortiWeb can use the connector to automatically retrieve the IP addresses of the back-end servers deployed on AWS or Azure.
Here is an example:
config server-policy server-pool
edit pool
config pserver-list
edit 1
set server-type sdn-connector
set sdn-addr-type public
set sdn aws
set filter InstanceId=i-04d15747127e4f8fe
next
end
next
end