Post-deployment configuration

You must create a Geneve interface on the FortiGate to handle traffic between the FortiGate and GWLB.

To create the Geneve interface:

1. Go to EC2 Dashboard > Network & Security > Network Interfaces. Copy the Primary private IPv4 address value for the GWLB interface created in the security VPC.
2. This example creates separate VDOMs via the split VDOM feature to handle traffic from the application VPC. Enable probe response on port 2 on both FortiGate instances. This allows LB health check to function:

   config system global

   config system interface

   edit "port2"

   set vdom "FG-traffic"

   set alias private

   set mode dhcp

   set allowaccess ping https ssh fgfm probe-response

   set defaultgw disable

   next

   end

   end

3. Create Geneve interfaces:

   config vdom

   edit "FG-traffic"

   config system geneve

   edit "awsgeneve"

   set interface "port2"

   set type ppp

   set remote-ip <GWLB_interface_ip (from step 1)>

   next

   end

   next

   end

4. Setting a higher priority on static routes for Geneve interfaces is recommended to avoid unintended functionality:

   config router static

   edit 2

   set priority 100

   set device "awsgeneve"

   next

   end

5. In a scenario where the load balancer is in a different subnet than the FortiGate interface, configure the following static route to avoid health check failures:

   config router static

   edit 3

   set device port2

   set dst <loadbal_subnet>

   set gateway <local_gateway>

   next

   end

To configure egress routes:

If the current VDOM has multiple interfaces, you must add egress routes to ensure that traffic entering through the Geneve interfaces egress through the same interface.

config router policy

edit 1

set input-device "awsgeneve"

set src "0.0.0.0/0.0.0.0"

set dst "10.10.2.0/255.255.254.0"

set output-device "awsgeneve"

next

end