Fortinet Document Library

Version:


Table of Contents

AWS Cookbook

Resources

Upgrade Path Tool

AWS Cookbook

6.2.0
Download PDF
Copy Link

Configuring the FortiGate-VMs

To configure the FortiGate-VMs:
  1. Log in to the primary FortiGate-VM:
    1. In the browser, enter https:// followed by the by the port1 (eth0) public IP address.
    2. Click Advanced, then proceed with the warning.
    3. Enter admin and the instance ID as the username and password, respectively, for the primary FortiGate-VM, and proceed to change the default password.
  2. Configure the primary FortiGate-VM:
    1. Go to Network > Interfaces. Confirm all four port IP address settings.
    2. Go to Network > Static Routes. Set the static route for port1 and port2 to the corresponding gateway on each FortiGate-VM. Usually the last number is 1 for the same subnet (i.e. 10.0.0.1) on AWS.
    3. Ensure that the 10.0.0.0/8 route has a lower admin distance to avoid local traffic being forwarded to port1.
    4. Go to System > HA. Configure high availability (HA) settings. After enabling active-passive mode, you can only access the FortiGate-VM through the HA management port (elastic IP address on port4).
      1. From the Mode dropdown list, select Active-Passive.
      2. In the Device priority field, enter a value that will be higher than the one you configure for the secondary node.
      3. Configure the Group name and Password fields.
      4. Enable Session pickup.
      5. For Heartbeat interfaces, select port3.
      6. Enable Management Interface Reservation. From the Interface dropdown list, select port4. Specify the gateway for the same subnet.
      7. Enable Unicast Heartbeat. Specify the port3 IP address of the peer FortiGate.

  3. Log in to and configure the secondary FortiGate-VM by repeating steps 1-2. When configuring device priority in HA settings, set a lower value than that of the primary node.
  4. Configure policies to forward internal traffic out from port1. You only need to configure such policies on the primary FortiGate-VM, as the policy configuration will synchronize between the FortiGate-VMs.

  5. (Optional) You an configure an AWS SDN connector to allow population of dynamic objects such as policy objects. See Configuring the SDN connector to populate dynamic objects.

Resources

Configuring the FortiGate-VMs

To configure the FortiGate-VMs:
  1. Log in to the primary FortiGate-VM:
    1. In the browser, enter https:// followed by the by the port1 (eth0) public IP address.
    2. Click Advanced, then proceed with the warning.
    3. Enter admin and the instance ID as the username and password, respectively, for the primary FortiGate-VM, and proceed to change the default password.
  2. Configure the primary FortiGate-VM:
    1. Go to Network > Interfaces. Confirm all four port IP address settings.
    2. Go to Network > Static Routes. Set the static route for port1 and port2 to the corresponding gateway on each FortiGate-VM. Usually the last number is 1 for the same subnet (i.e. 10.0.0.1) on AWS.
    3. Ensure that the 10.0.0.0/8 route has a lower admin distance to avoid local traffic being forwarded to port1.
    4. Go to System > HA. Configure high availability (HA) settings. After enabling active-passive mode, you can only access the FortiGate-VM through the HA management port (elastic IP address on port4).
      1. From the Mode dropdown list, select Active-Passive.
      2. In the Device priority field, enter a value that will be higher than the one you configure for the secondary node.
      3. Configure the Group name and Password fields.
      4. Enable Session pickup.
      5. For Heartbeat interfaces, select port3.
      6. Enable Management Interface Reservation. From the Interface dropdown list, select port4. Specify the gateway for the same subnet.
      7. Enable Unicast Heartbeat. Specify the port3 IP address of the peer FortiGate.

  3. Log in to and configure the secondary FortiGate-VM by repeating steps 1-2. When configuring device priority in HA settings, set a lower value than that of the primary node.
  4. Configure policies to forward internal traffic out from port1. You only need to configure such policies on the primary FortiGate-VM, as the policy configuration will synchronize between the FortiGate-VMs.

  5. (Optional) You an configure an AWS SDN connector to allow population of dynamic objects such as policy objects. See Configuring the SDN connector to populate dynamic objects.