Fortinet black logo

AWS Administration Guide

Validating the configuration

Copy Link
Copy Doc ID f4e6f33e-6876-11ea-9384-00505692583a:187755
Download PDF

Validating the configuration

Since traffic between the Internet and the application EC2 instance flows through the FortiGate Geneve interface, this example creates a FortiOS firewall policy that allows communication from the Geneve interface to the Geneve interface. The following shows an example policy.

Caution

This policy facilitates easy debugging. You should not configure this policy in a production environment.

To configure the policy:

config firewall policy

edit 1

set name "test_policy"

set srcintf "az2"

set dstintf "az2"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

next

end

To run a packet sniffer on the Geneve interface created to handle GWLB traffic:

In this example, the VDOM name is FG-traffic. When multiple VDOM mode (available only on BYOL instances) is enabled, substitute the name of your VDOM here for FG-traffic.

  1. Run a packet sniffer:

    config vdom

    edit FG-traffic

    diagnose sniffer packet awsgeneve

  2. While the packet capture is running, attempt to access/ping a resource in customer B VPC from a resource in customer A VPC. The ping should succeed. The following shows the FortiGate packet capture for this access attempt:

Validating the configuration

Since traffic between the Internet and the application EC2 instance flows through the FortiGate Geneve interface, this example creates a FortiOS firewall policy that allows communication from the Geneve interface to the Geneve interface. The following shows an example policy.

Caution

This policy facilitates easy debugging. You should not configure this policy in a production environment.

To configure the policy:

config firewall policy

edit 1

set name "test_policy"

set srcintf "az2"

set dstintf "az2"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

next

end

To run a packet sniffer on the Geneve interface created to handle GWLB traffic:

In this example, the VDOM name is FG-traffic. When multiple VDOM mode (available only on BYOL instances) is enabled, substitute the name of your VDOM here for FG-traffic.

  1. Run a packet sniffer:

    config vdom

    edit FG-traffic

    diagnose sniffer packet awsgeneve

  2. While the packet capture is running, attempt to access/ping a resource in customer B VPC from a resource in customer A VPC. The ping should succeed. The following shows the FortiGate packet capture for this access attempt: