Fortinet Document Library

Version:


Table of Contents

AWS Cookbook

Resources

Upgrade Path Tool

AWS Cookbook

6.4.0
Download PDF
Copy Link

Post-deployment configuration

You must create a Geneve interface on the FortiGate to handle traffic between the FortiGate and GWLB.

To create the Geneve interface:
  1. Go to EC2 Dashboard > Network & Security > Network Interfaces. Copy the Primary private IPv4 address value for the GWLB interface created in the security VPC.
  2. This example creates separate VDOMs via the split VDOM feature to handle traffic from the application VPC. Enable probe response on port 2 on both FortiGate instances. This allows LB health check to function:

    config system global

    config system interface

    edit "port2"

    set vdom "FG-traffic"

    set alias private

    set mode dhcp

    set allowaccess ping https ssh fgfm probe-response

    set defaultgw disable

    next

    end

    end

  3. Create Geneve interfaces:

    config vdom

    edit "FG-traffic"

    config system geneve

    edit "awsgeneve"

    set interface "port2"

    set type ppp

    set remote-ip <GWLB_interface_ip (from step 1)>

    next

    end

    next

    end

  4. Setting a higher priority on static routes for Geneve interfaces is recommended to avoid unintended functionality:

    config router static

    edit 2

    set priority 100

    set device "awsgeneve"

    next

    end

  5. In a scenario where the load balancer is in a different subnet than the FortiGate interface, configure the following static route to avoid health check failures:

    config router static

    edit 3

    set device port2

    set dst <loadbal_subnet>

    set gateway <local_gateway>

    next

    end

To configure egress routes:

If the current VDOM has multiple interfaces, you must add egress routes to ensure that traffic entering through the Geneve interfaces egress through the same interface.

config router policy

edit 1

set input-device "awsgeneve"

set src "0.0.0.0/0.0.0.0"

set dst "10.10.2.0/255.255.254.0"

set output-device "awsgeneve"

next

end

Resources

Post-deployment configuration

You must create a Geneve interface on the FortiGate to handle traffic between the FortiGate and GWLB.

To create the Geneve interface:
  1. Go to EC2 Dashboard > Network & Security > Network Interfaces. Copy the Primary private IPv4 address value for the GWLB interface created in the security VPC.
  2. This example creates separate VDOMs via the split VDOM feature to handle traffic from the application VPC. Enable probe response on port 2 on both FortiGate instances. This allows LB health check to function:

    config system global

    config system interface

    edit "port2"

    set vdom "FG-traffic"

    set alias private

    set mode dhcp

    set allowaccess ping https ssh fgfm probe-response

    set defaultgw disable

    next

    end

    end

  3. Create Geneve interfaces:

    config vdom

    edit "FG-traffic"

    config system geneve

    edit "awsgeneve"

    set interface "port2"

    set type ppp

    set remote-ip <GWLB_interface_ip (from step 1)>

    next

    end

    next

    end

  4. Setting a higher priority on static routes for Geneve interfaces is recommended to avoid unintended functionality:

    config router static

    edit 2

    set priority 100

    set device "awsgeneve"

    next

    end

  5. In a scenario where the load balancer is in a different subnet than the FortiGate interface, configure the following static route to avoid health check failures:

    config router static

    edit 3

    set device port2

    set dst <loadbal_subnet>

    set gateway <local_gateway>

    next

    end

To configure egress routes:

If the current VDOM has multiple interfaces, you must add egress routes to ensure that traffic entering through the Geneve interfaces egress through the same interface.

config router policy

edit 1

set input-device "awsgeneve"

set src "0.0.0.0/0.0.0.0"

set dst "10.10.2.0/255.255.254.0"

set output-device "awsgeneve"

next

end