Creating the TGW and related resources

A transit gateway (TGW) is a transit hub that connects two virtual private clouds (VPC) or a VPC to an on-premise network. This scenario connects multiple Application VPCs to the Security VPC via a TGW. This ensures that any access to and from the Application VPC is routed via the Security VPC, where the FortiGates can inspect it.

To create the TGW and related resources:

1. Create the TGW:
   1. In the AWS management console, go to VPC Dashboard > Transit Gateways > Transit Gateways.
   2. Click Create Transit Gateway.
   3. Configure the Name tag and Amazon side ASN fields with the desired values.
   4. Enable DNS support, VPN ECMP support, Default route table association, and Default route table propagation.
   5. In the CIDR field, enter the desired CIDR. In this example, the value is 10.100.0/16.

   

2. Creating a TGW creates a TGW default route table. You can use this table as the default association and propagation route table for the TGW. Confirm that the table was created by going to VPC Dashboard > Transit Gateways > Transit Gateway Route Tables.
3. You must create a TGW attachment to link separate VPCs and subnets to the newly created TGW. The two resources can belong to the same or different AWS accounts. This example assumes that both VPCs are in the same AWS account. Create the TGW attachment:
   1. Go to VPC Dashboard > Transit Gateways > Transit Gateway Attachments.
   2. Click Create Transit Gateway Attachment.
   3. From the Transit Gateway ID dropdown list, select the TGW you created in step 1.
   4. From the Attachment type dropdown list, select VPC.
   5. From the VPC ID dropdown list, select the VPC to attach to the TGW.
   6. In the Subnet IDs field, select the required subnet in the correct AZ.
   7. Configure other fields as desired.
   8. Click Create Attachment.
4. Repeat step 3 for the remaining three attachments. For the Security VPC attachment, ensure that you select the TGW subnet in both AZs.
5. You must create a TGW connect attachment to help form a Generic Routing Encapsulation (GRE) tunnel on top of a VPC attachments. You then create Border Gateway Protocol (BGP) peers for each FortiGate in each AZ. By BGP peering the TGW and the FortiGate, you can send Customer VPC routes to the FortiGates in the Security VPC. Create the TGW connect attachment:
   1. Go to VPC Dashboard > Transit Gateways > Transit Gateway Attachments.
   2. Click Create Transit Gateway Attachment.
   3. From the Transit Gateway ID dropdown list, select the TGW you created in step 1.
   4. From the Attachment type dropdown list, select Connect.
   5. Configure the Attachment name tag field as desired.
   6. From the Transport Attachment ID dropdown list, select the TGW attachment over which to create the Connect attachment. This example selects the Security VPC attachment.
   7. Click Create Attachment.
6. You must add peering connections for each AZ. Create the peers:
   1. Go to VPC Dashboard > Transit Gateways > Transit Gateway Attachments.
   2. Select the newly created connect attachment.
   3. On the Connect peers tab, click Create Connect peer.
   4. In the Peer GRE address field, enter the FortiGate port 2 IP address. You must create new connect peers for FortiGates in other AZs.
   5. In the BGP Inside CIDR blocks IPv4 field, configure a unique /29 block in the 169.254.x.x /16 CIDR range for each connect peer.
   6. In the BGP Inside CIDR blocks IPv6 field, configure a unique /125 block in the fd00: : /8 CIDR range for each connect peer if applicable.
   7. In the Peer ASN field, enter an existing ASN assigned in the network, or assign a private ASN in the range 64512-65534. This setup uses eBGP and the peer ASN must differ from the AWS default.
   8. Click Create.