Fortinet black logo

AWS Administration Guide

CFT parameters

Copy Link
Copy Doc ID e129c4eb-867b-11eb-9995-00505692583a:530672
Download PDF

CFT parameters

The following sections provide descriptions of the available parameters. Some parameters are specific to certain templates, and are only displayed when that template is selected.

After entering required parameters, click Next.

Resource tagging configuration

Parameter label (name)

Default

Description

Resource tag prefix (ResourceTagPrefix)

Requires input

ResourceGroup Tag Key used on all resources and as the name prefix of all applicable resources. Can only contain uppercase letters, lowercase letters, numbers, ampersand (@), hyphens (-), period (.), and hash (#).

Maximum length is 50.

Resource name prefix (CustomIdentifier)

fgtASG

Alternative name prefix to be used on a resource that the Resource tag prefix cannot apply to. Can only contain uppercase letters, lowercase letters, and numbers.

Maximum length is 10.

Network configuration (New VPC, no Transit Gateway)

Parameter label (name)

Default

Description

Availability Zones (AvailabilityZones)

Requires input

List of Availability Zones to use for the subnets in the VPC. The FortiGate Autoscale solution uses two Availability Zones from your list and preserves the logical order you specify.

VPC CIDR (VpcCidr)

192.168.0.0/16

Classless Inter-Domain Routing (CIDR) block for the FortiGate Autoscale VPC.

Autoscale subnet 1 CIDR (PublicSubnet1Cidr)

192.168.0.0/24

CIDR block for the subnet located in Availability Zone 1 where FortiGate Autoscale instances will be deployed to.

Autoscale subnet 2 CIDR (PublicSubnet2Cidr)

192.168.1.0/24

CIDR block for the subnet located in Availability Zone 2 where FortiGate Autoscale instances will be deployed to.

Protected subnet 1 CIDR (PrivateSubnet1Cidr)

192.168.2.0/24

CIDR block for the private subnet located in Availability Zone 1 where it is protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Protected subnet 2 CIDR (PrivateSubnet2Cidr)

192.168.3.0/24

CIDR block for the private subnet located in Availability Zone 2 where it is protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Network configuration (Existing VPC, no Transit Gateway)

Parameter label (name)

Default

Description

VPC ID (VpcId)

Requires input

ID of the existing VPC where FortiGate Autoscale will be deployed. The VPC must have the option DNS hostnames enabled and each of the two Availability Zones in the VPC must have at least 1 public subnet and at least 1 private subnet.

VPC CIDR (VpcCidr)

Requires input

CIDR block of the selected existing VPC into which FortiGate Autoscale will be deployed. This can be found in parentheses in the VPC ID parameter selection.

Private VPC Endpoint (VpcEndpointId)

Requires input

ID of the Private VPC Endpoint associated with the existing VPC.

A Private VPC Endpoint is required for FortiGate Autoscale and is a VPC Endpoint that has enabled Private DNS names.

Autoscale subnet 1 ID (PublicSubnet1)

Requires input

ID of the public subnet 1 located in Availability Zone 1 of the selected existing VPC. The FortiGate Autoscale instances will be deployed here.

Autoscale subnet 2 ID (PublicSubnet2)

Requires input

ID of the public subnet 2 located in Availability Zone 2 of the selected existing VPC. The FortiGate Autoscale instances will be deployed here.

Private subnet 1 ID (PrivateSubnet1)

Requires input

ID of the private subnet 1 located in Availability Zone 1 of the selected existing VPC. This subnet will be protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Private subnet 2 ID (PrivateSubnet2)

Requires input

ID of the private subnet 2 located in Availability Zone 2 of the selected existing VPC. This subnet will be protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Private subnet route table (PrivateSubnetRouteTable)

Requires input

ID of the route table associated with the two private subnets.

Network configuration (Transit Gateway integration)

Parameter label (name)

Default

Description

Availability Zones (AvailabilityZones)

Requires input

The list of Availability Zones to use for the subnets in the VPC. The FortiGate Autoscale solution uses two Availability Zones from your list and preserves the logical order you specify.

VPC CIDR (VpcCidr)

192.168.0.0/16

The Classless Inter-Domain Routing (CIDR) block for the FortiGate Autoscale VPC.

Autoscale subnet 1 CIDR (PublicSubnet1Cidr)

192.168.0.0/24

The CIDR block for the subnet located in Availability Zone 1 where FortiGate Autoscale instances will be deployed to.

Autoscale subnet 2 CIDR (PublicSubnet2Cidr)

192.168.1.0/24

The CIDR block for the subnet located in Availability Zone 2 where FortiGate Autoscale instances will be deployed to.

FortiGate configuration

Parameter label (name)

Default

Description

Instance type (FortiGateInstanceType)

c5.large

Instance type for the FortiGate-VMs in the Auto Scaling group. There are t2.small and compute-optimized instances such as c4 and c5 available with different vCPU sizes and bandwidths. For more information about instance types, see Instance Types.

FortiOS version (FortiOSVersion)

7.0.1

FortiOS version supported by FortiGate Autoscale for AWS.

Note

Requires one or more subscriptions to Fortinet FortiGate on-demand or BYOL AMIs.

FortiGate PSK secret (FortiGatePskSecret)

Requires input

Secret preshared key used by the FortiGate-VM instances to securely communicate with each other. Must contain numbers and letters and may contain special characters.

Maximum length is 128.

Note

Changes to the PSK secret after FortiGate Autoscale for AWS has been deployed are not reflected here. For new instances to be spawned with the changed PSK secret, this environment variable will need to be manually updated.

Admin port (FortiGateAdminPort)

8443

A port number for FortiGate administration. Minimum is 1. Maximum is 65535. Do not use the FortiGate reserved ports 443, 541, 514, or 703.

Admin CIDR block (FortiGateAdminCidr)

Requires input

CIDR block for external administrator management access.

Warning

0.0.0.0/0 accepts connections from any IP address. Use a constrained CIDR range to reduce the potential of inbound attacks from unknown IP addresses.

Key pair name (KeyPairName)

Requires input

Amazon EC2 Key Pair for admin access.

BGP ASN (BgpAsn)

65000

The Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the Customer Gateway of each FortiGate-VM instance in the Auto Scaling group. This value ranges from 64512 to 65534.

Note

Only for deployments with Transit Gateway integration.

FortiGate Auto Scaling group configuration

Parameter label (name)

Default

Description

Desired capacity (BYOL) (FgtAsgDesiredCapacityByol)

2

Number of FortiGate-VM instances the BYOL Auto Scaling group should have at any time. For High Availability in BYOL-only and Hybrid use cases, ensure at least 2 FortiGate-VMs are in the group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing.

Minimum group size (BYOL) (FgtAsgMinSizeByol)

2

Minimum number of FortiGate-VM instances in the BYOL Auto Scaling group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing.

Note

For BYOL-only and hybrid licensing deployments, this parameter must be at least 2. If it is set to 1 and the instance fails to work, the current FortiGate-VM configuration will be lost.

Maximum group size (BYOL) (FgtAsgMaxSizeByol)

2

Maximum number of FortiGate-VM instances in the BYOL Auto Scaling group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing. This number must be greater than or equal to the Minimum group size (BYOL).

Desired capacity (On-demand instances) (FgtAsgDesiredCapacityPayg)

0

Number of FortiGate-VM instances the On-demand Auto Scaling group should have at any time. For High Availability in an On-demand-only use case, ensure at least 2 FortiGate-VMs are in the group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing.

Minimum group size (On-demand instances) (FgtAsgMinSizePayg)

0

Minimum number of FortiGate-VM instances in the On-demand Auto Scaling group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing.

Note

For On-demand-only deployments, this parameter must be at least 2. If it is set to 1 and the instance fails to work, the current FortiGate-VM configuration will be lost.

Maximum group size (On-demand instances) (FgtAsgMaxSizePayg)

0

Maximum number of FortiGate-VM instances in the On-demand Auto Scaling group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing. This number must be greater than or equal to the Minimum group size (On-demand instances).

Scale-out threshold (FgtAsgScaleOutThreshold)

80

Threshold (in percentage) for the FortiGate Auto Scaling group to scale out (add) 1 instance. Minimum is 1. Maximum is 100.

Scale-in threshold (FgtAsgScaleInThreshold)

25

Threshold (in percentage) for the FortiGate Auto Scaling group to scale in (remove) 1 instance. Minimum is 1. Maximum is 100.

Primary election timeout (PrimaryElectionTimeout)

300

Maximum time (in seconds) to wait for the election of the primary instance to complete. Minimum is 30. Maximum is 3600.

Get license grace period (GetLicenseGracePeriod)

600

Minimum time (in seconds) permitted before a distributed license can be revoked from a non-responsive FortiGate-VM and re-distributed. Minimum is 300.

Health check grace period (FgtAsgHealthCheckGracePeriod)

300

Length of time (in seconds) that Auto Scaling waits before checking an instance's health status.

Minimum is 60.

Scaling cooldown period (FgtAsgCooldown)

300

Auto Scaling group waits for the cooldown period (in seconds) to complete before resuming scaling activities. Minimum is 60. Maximum is 3600.

Instance lifecycle timeout (LifecycleHookTimeout)

480

Amount of time (in seconds) that can elapse before the FortiGate Autoscale lifecycle hook times out. Minimum is 60. Maximum is 3600.

Transit Gateway configuration (Transit Gateway integration)

Parameter label (name)

Default

Description

Transit Gateway support (TransitGatewaySupportOptions)

create one

Create a Transit Gateway for the FortiGate Autoscale VPC to attach to, or specify to use an existing one.

Transit Gateway ID (TransitGatewayId)

Conditionally requires input

ID of the Transit Gateway that the FortiGate Autoscale VPC will be attached to. Required when Transit Gateway support is set to "use an existing one".

Load balancing configuration (no Transit Gateway integration)

Parameter label (name)

Default

Description

Traffic protocol (LoadBalancingTrafficProtocol)

HTTPS

Protocol used to load balance traffic.

Traffic port (LoadBalancingTrafficPort)

443

Port number used to balance web service traffic if the internal web service load balancer is enabled.

Minimum is 1. Maximum is 65535.

Health check threshold (LoadBalancingHealthCheckThreshold)

3

Number of consecutive health check failures required before considering a FortiGate-VM instance unhealthy.

Minimum 3.

Internal ELB options (InternalLoadBalancingOptions)

add a new internal load balancer

(Optional) Predefined Elastic Load Balancer (ELB) to route traffic to web service in the private subnets. You can optionally use your own one or decide to not need one.

Health check path (InternalTargetGroupHealthCheckPath)

/

(Optional) Destination path for health checks. This path must begin with a forward slash (/) and can be at most 1024 characters in length.

Internal ELB DNS name (InternalLoadBalancerDnsName)

Requires input

(Optional) DNS name of an existing internal load balancer used to route traffic from a FortiGate-VM to targets in a specified target group. Leave it blank if you don't use an existing load balancer.

Failover management configuration

Parameter label (name)

Default

Description

Heart beat interval (HeartBeatInterval)

30

Length of time (in seconds) that a FortiGate-VM instance waits between sending heartbeat requests to the Autoscale handler. Minimum is 30. Maximum is 90.

Heart beat loss count (HeartBeatLossCount)

10

Number of consecutively lost heartbeats. When the Heartbeat loss count has been reached, the FortiGate-VM is deemed unhealthy and failover activities will commence.

Heart beat delay allowance (HeartBeatDelayAllowance)

2

Maximum amount of time (in seconds) allowed for network latency of the FortiGate-VM heartbeat arriving at the FortiGate Autoscale handler. Minimum is 0.

Autoscale notifications subscriber email (AutoscaleNotificationSubscriberEmail)

-

The email address (AWS SNS Topic subscriber) to receive Autoscale notifications. If provided, the template can only accept one email address. An email will be sent to the address to confirm the subscription.

Terminate unhealthy VM (TerminateUnhealthyVm)

no

Set to yes to terminate any VM that is deemed unhealthy by FortiGate Autoscale.

Autoscale sync recovery count (SyncRecoveryCount)

3

Number of consecutive on-time heartbeats required for a VM to become healthy again. This parameter is only used when Terminate unhealthy VM is set to no and allows for the VM to recover from an unhealthy state.

FortiAnalyzer integration

Parameter label (name)

Default

Description

FortiAnalyzer integration (FortiAnalyzerIntegrationOptions)

yes

Set to no if you do not want to incorporate FortiAnalyzer into FortiGate Autoscale to use extended features that include storing logs into FortiAnalyzer.

FortiAnalyzer version (FortiAnalyzerVersion)

6.4.6

FortiAnalyzer version supported by FortiGate Autoscale.

Note

Requires a subscription to the "Fortinet FortiAnalyzer Centralized Logging/Reporting (10 managed devices)" AMI.

FortiAnalyzer instance type (FortiAnalyzerInstanceType)

m5.large

Instance type to launch as FortiAnalyzer on-demand instances. There are compute-optimized instances, such as m4 and c4, available with different vCPU sizes and bandwidths. For more information about instance types, see Instance Types.

Autoscale admin user name (FortiAnalyzerAutoscaleAdminUsername)

Requires input

Name of the secondary administrator-level account in the FortiAnalyzer, which FortiGate Autoscale uses to connect to the FortiAnalyzer to authorize any FortiGate device in the Auto Scaling group. To conform to the FortiAnalyzer naming policy, the user name can only contain numbers, lowercase letters, uppercase letters, and hyphens. It cannot start or end with a hyphen (-).

Autoscale admin password (FortiAnalyzerAutoscaleAdminPassword)

Requires input

Password for the "Autoscale admin user name." The password must conform to the FortiAnalyzer password policy and have a minimum length of 8 and a maximum length of 128. If you need to enable KMS encryption, refer to the documentation.

FortiAnalyzer private IP address (FortiAnalyzerCustomPrivateIpAddress)

Requires input

Custom private IP address to be used by the FortiAnalyzer. Must be within the public subnet 1 CIDR range. Required if "FortiAnalyzer integration" is set to yes. If "FortiAnalyzer integration" is set to no, any input will be ignored.

Custom asset location configuration

Parameter label (name)

Default

Description

Use custom asset location (UseCustomAssetLocation)

no

Set to yes to use a custom S3 location for custom assets such as licenses and customized configsets.

Custom asset S3 bucket (CustomAssetContainer)

Requires input

Name of the S3 bucket that contains your custom assets. Required if 'Use custom asset location' is set to yes. Can only contain numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).

Custom asset folder (CustomAssetDirectory)

Requires input

The sub path within the 'custom asset container' that serves as the top level directory of all your custom assets. If 'Use custom asset location' is set to yes, and this value is left empty, the 'custom asset container' will serve as the top level directory. Can only contain numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). If provided, it must end with a forward slash (/).

Deployment resources configuration

Parameter label (name)

Default

Description

S3 bucket name (S3BucketName)

Requires input

Name of the S3 bucket (created in step 4 of Obtaining the deployment package) that contains the FortiGate Autoscale deployment package. Can only contain numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).

S3 resource folder (S3KeyPrefix)

Requires input

Name of the S3 folder (created in step 5 of Obtaining the deployment package) that stores the FortiGate Autoscale deployment resources. Can only contain numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). If provided, it must end with a forward slash (/).

CFT parameters

The following sections provide descriptions of the available parameters. Some parameters are specific to certain templates, and are only displayed when that template is selected.

After entering required parameters, click Next.

Resource tagging configuration

Parameter label (name)

Default

Description

Resource tag prefix (ResourceTagPrefix)

Requires input

ResourceGroup Tag Key used on all resources and as the name prefix of all applicable resources. Can only contain uppercase letters, lowercase letters, numbers, ampersand (@), hyphens (-), period (.), and hash (#).

Maximum length is 50.

Resource name prefix (CustomIdentifier)

fgtASG

Alternative name prefix to be used on a resource that the Resource tag prefix cannot apply to. Can only contain uppercase letters, lowercase letters, and numbers.

Maximum length is 10.

Network configuration (New VPC, no Transit Gateway)

Parameter label (name)

Default

Description

Availability Zones (AvailabilityZones)

Requires input

List of Availability Zones to use for the subnets in the VPC. The FortiGate Autoscale solution uses two Availability Zones from your list and preserves the logical order you specify.

VPC CIDR (VpcCidr)

192.168.0.0/16

Classless Inter-Domain Routing (CIDR) block for the FortiGate Autoscale VPC.

Autoscale subnet 1 CIDR (PublicSubnet1Cidr)

192.168.0.0/24

CIDR block for the subnet located in Availability Zone 1 where FortiGate Autoscale instances will be deployed to.

Autoscale subnet 2 CIDR (PublicSubnet2Cidr)

192.168.1.0/24

CIDR block for the subnet located in Availability Zone 2 where FortiGate Autoscale instances will be deployed to.

Protected subnet 1 CIDR (PrivateSubnet1Cidr)

192.168.2.0/24

CIDR block for the private subnet located in Availability Zone 1 where it is protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Protected subnet 2 CIDR (PrivateSubnet2Cidr)

192.168.3.0/24

CIDR block for the private subnet located in Availability Zone 2 where it is protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Network configuration (Existing VPC, no Transit Gateway)

Parameter label (name)

Default

Description

VPC ID (VpcId)

Requires input

ID of the existing VPC where FortiGate Autoscale will be deployed. The VPC must have the option DNS hostnames enabled and each of the two Availability Zones in the VPC must have at least 1 public subnet and at least 1 private subnet.

VPC CIDR (VpcCidr)

Requires input

CIDR block of the selected existing VPC into which FortiGate Autoscale will be deployed. This can be found in parentheses in the VPC ID parameter selection.

Private VPC Endpoint (VpcEndpointId)

Requires input

ID of the Private VPC Endpoint associated with the existing VPC.

A Private VPC Endpoint is required for FortiGate Autoscale and is a VPC Endpoint that has enabled Private DNS names.

Autoscale subnet 1 ID (PublicSubnet1)

Requires input

ID of the public subnet 1 located in Availability Zone 1 of the selected existing VPC. The FortiGate Autoscale instances will be deployed here.

Autoscale subnet 2 ID (PublicSubnet2)

Requires input

ID of the public subnet 2 located in Availability Zone 2 of the selected existing VPC. The FortiGate Autoscale instances will be deployed here.

Private subnet 1 ID (PrivateSubnet1)

Requires input

ID of the private subnet 1 located in Availability Zone 1 of the selected existing VPC. This subnet will be protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Private subnet 2 ID (PrivateSubnet2)

Requires input

ID of the private subnet 2 located in Availability Zone 2 of the selected existing VPC. This subnet will be protected by the FortiGate-VMs in the public subnet of the same Availability Zone.

Private subnet route table (PrivateSubnetRouteTable)

Requires input

ID of the route table associated with the two private subnets.

Network configuration (Transit Gateway integration)

Parameter label (name)

Default

Description

Availability Zones (AvailabilityZones)

Requires input

The list of Availability Zones to use for the subnets in the VPC. The FortiGate Autoscale solution uses two Availability Zones from your list and preserves the logical order you specify.

VPC CIDR (VpcCidr)

192.168.0.0/16

The Classless Inter-Domain Routing (CIDR) block for the FortiGate Autoscale VPC.

Autoscale subnet 1 CIDR (PublicSubnet1Cidr)

192.168.0.0/24

The CIDR block for the subnet located in Availability Zone 1 where FortiGate Autoscale instances will be deployed to.

Autoscale subnet 2 CIDR (PublicSubnet2Cidr)

192.168.1.0/24

The CIDR block for the subnet located in Availability Zone 2 where FortiGate Autoscale instances will be deployed to.

FortiGate configuration

Parameter label (name)

Default

Description

Instance type (FortiGateInstanceType)

c5.large

Instance type for the FortiGate-VMs in the Auto Scaling group. There are t2.small and compute-optimized instances such as c4 and c5 available with different vCPU sizes and bandwidths. For more information about instance types, see Instance Types.

FortiOS version (FortiOSVersion)

7.0.1

FortiOS version supported by FortiGate Autoscale for AWS.

Note

Requires one or more subscriptions to Fortinet FortiGate on-demand or BYOL AMIs.

FortiGate PSK secret (FortiGatePskSecret)

Requires input

Secret preshared key used by the FortiGate-VM instances to securely communicate with each other. Must contain numbers and letters and may contain special characters.

Maximum length is 128.

Note

Changes to the PSK secret after FortiGate Autoscale for AWS has been deployed are not reflected here. For new instances to be spawned with the changed PSK secret, this environment variable will need to be manually updated.

Admin port (FortiGateAdminPort)

8443

A port number for FortiGate administration. Minimum is 1. Maximum is 65535. Do not use the FortiGate reserved ports 443, 541, 514, or 703.

Admin CIDR block (FortiGateAdminCidr)

Requires input

CIDR block for external administrator management access.

Warning

0.0.0.0/0 accepts connections from any IP address. Use a constrained CIDR range to reduce the potential of inbound attacks from unknown IP addresses.

Key pair name (KeyPairName)

Requires input

Amazon EC2 Key Pair for admin access.

BGP ASN (BgpAsn)

65000

The Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the Customer Gateway of each FortiGate-VM instance in the Auto Scaling group. This value ranges from 64512 to 65534.

Note

Only for deployments with Transit Gateway integration.

FortiGate Auto Scaling group configuration

Parameter label (name)

Default

Description

Desired capacity (BYOL) (FgtAsgDesiredCapacityByol)

2

Number of FortiGate-VM instances the BYOL Auto Scaling group should have at any time. For High Availability in BYOL-only and Hybrid use cases, ensure at least 2 FortiGate-VMs are in the group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing.

Minimum group size (BYOL) (FgtAsgMinSizeByol)

2

Minimum number of FortiGate-VM instances in the BYOL Auto Scaling group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing.

Note

For BYOL-only and hybrid licensing deployments, this parameter must be at least 2. If it is set to 1 and the instance fails to work, the current FortiGate-VM configuration will be lost.

Maximum group size (BYOL) (FgtAsgMaxSizeByol)

2

Maximum number of FortiGate-VM instances in the BYOL Auto Scaling group. For specific use cases, set to 0 for On-demand-only, and >= 2 for BYOL-only or hybrid licensing. This number must be greater than or equal to the Minimum group size (BYOL).

Desired capacity (On-demand instances) (FgtAsgDesiredCapacityPayg)

0

Number of FortiGate-VM instances the On-demand Auto Scaling group should have at any time. For High Availability in an On-demand-only use case, ensure at least 2 FortiGate-VMs are in the group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing.

Minimum group size (On-demand instances) (FgtAsgMinSizePayg)

0

Minimum number of FortiGate-VM instances in the On-demand Auto Scaling group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing.

Note

For On-demand-only deployments, this parameter must be at least 2. If it is set to 1 and the instance fails to work, the current FortiGate-VM configuration will be lost.

Maximum group size (On-demand instances) (FgtAsgMaxSizePayg)

0

Maximum number of FortiGate-VM instances in the On-demand Auto Scaling group. For specific use cases, set to 0 for BYOL-only, >= 2 for On-demand-only, and >= 0 for hybrid licensing. This number must be greater than or equal to the Minimum group size (On-demand instances).

Scale-out threshold (FgtAsgScaleOutThreshold)

80

Threshold (in percentage) for the FortiGate Auto Scaling group to scale out (add) 1 instance. Minimum is 1. Maximum is 100.

Scale-in threshold (FgtAsgScaleInThreshold)

25

Threshold (in percentage) for the FortiGate Auto Scaling group to scale in (remove) 1 instance. Minimum is 1. Maximum is 100.

Primary election timeout (PrimaryElectionTimeout)

300

Maximum time (in seconds) to wait for the election of the primary instance to complete. Minimum is 30. Maximum is 3600.

Get license grace period (GetLicenseGracePeriod)

600

Minimum time (in seconds) permitted before a distributed license can be revoked from a non-responsive FortiGate-VM and re-distributed. Minimum is 300.

Health check grace period (FgtAsgHealthCheckGracePeriod)

300

Length of time (in seconds) that Auto Scaling waits before checking an instance's health status.

Minimum is 60.

Scaling cooldown period (FgtAsgCooldown)

300

Auto Scaling group waits for the cooldown period (in seconds) to complete before resuming scaling activities. Minimum is 60. Maximum is 3600.

Instance lifecycle timeout (LifecycleHookTimeout)

480

Amount of time (in seconds) that can elapse before the FortiGate Autoscale lifecycle hook times out. Minimum is 60. Maximum is 3600.

Transit Gateway configuration (Transit Gateway integration)

Parameter label (name)

Default

Description

Transit Gateway support (TransitGatewaySupportOptions)

create one

Create a Transit Gateway for the FortiGate Autoscale VPC to attach to, or specify to use an existing one.

Transit Gateway ID (TransitGatewayId)

Conditionally requires input

ID of the Transit Gateway that the FortiGate Autoscale VPC will be attached to. Required when Transit Gateway support is set to "use an existing one".

Load balancing configuration (no Transit Gateway integration)

Parameter label (name)

Default

Description

Traffic protocol (LoadBalancingTrafficProtocol)

HTTPS

Protocol used to load balance traffic.

Traffic port (LoadBalancingTrafficPort)

443

Port number used to balance web service traffic if the internal web service load balancer is enabled.

Minimum is 1. Maximum is 65535.

Health check threshold (LoadBalancingHealthCheckThreshold)

3

Number of consecutive health check failures required before considering a FortiGate-VM instance unhealthy.

Minimum 3.

Internal ELB options (InternalLoadBalancingOptions)

add a new internal load balancer

(Optional) Predefined Elastic Load Balancer (ELB) to route traffic to web service in the private subnets. You can optionally use your own one or decide to not need one.

Health check path (InternalTargetGroupHealthCheckPath)

/

(Optional) Destination path for health checks. This path must begin with a forward slash (/) and can be at most 1024 characters in length.

Internal ELB DNS name (InternalLoadBalancerDnsName)

Requires input

(Optional) DNS name of an existing internal load balancer used to route traffic from a FortiGate-VM to targets in a specified target group. Leave it blank if you don't use an existing load balancer.

Failover management configuration

Parameter label (name)

Default

Description

Heart beat interval (HeartBeatInterval)

30

Length of time (in seconds) that a FortiGate-VM instance waits between sending heartbeat requests to the Autoscale handler. Minimum is 30. Maximum is 90.

Heart beat loss count (HeartBeatLossCount)

10

Number of consecutively lost heartbeats. When the Heartbeat loss count has been reached, the FortiGate-VM is deemed unhealthy and failover activities will commence.

Heart beat delay allowance (HeartBeatDelayAllowance)

2

Maximum amount of time (in seconds) allowed for network latency of the FortiGate-VM heartbeat arriving at the FortiGate Autoscale handler. Minimum is 0.

Autoscale notifications subscriber email (AutoscaleNotificationSubscriberEmail)

-

The email address (AWS SNS Topic subscriber) to receive Autoscale notifications. If provided, the template can only accept one email address. An email will be sent to the address to confirm the subscription.

Terminate unhealthy VM (TerminateUnhealthyVm)

no

Set to yes to terminate any VM that is deemed unhealthy by FortiGate Autoscale.

Autoscale sync recovery count (SyncRecoveryCount)

3

Number of consecutive on-time heartbeats required for a VM to become healthy again. This parameter is only used when Terminate unhealthy VM is set to no and allows for the VM to recover from an unhealthy state.

FortiAnalyzer integration

Parameter label (name)

Default

Description

FortiAnalyzer integration (FortiAnalyzerIntegrationOptions)

yes

Set to no if you do not want to incorporate FortiAnalyzer into FortiGate Autoscale to use extended features that include storing logs into FortiAnalyzer.

FortiAnalyzer version (FortiAnalyzerVersion)

6.4.6

FortiAnalyzer version supported by FortiGate Autoscale.

Note

Requires a subscription to the "Fortinet FortiAnalyzer Centralized Logging/Reporting (10 managed devices)" AMI.

FortiAnalyzer instance type (FortiAnalyzerInstanceType)

m5.large

Instance type to launch as FortiAnalyzer on-demand instances. There are compute-optimized instances, such as m4 and c4, available with different vCPU sizes and bandwidths. For more information about instance types, see Instance Types.

Autoscale admin user name (FortiAnalyzerAutoscaleAdminUsername)

Requires input

Name of the secondary administrator-level account in the FortiAnalyzer, which FortiGate Autoscale uses to connect to the FortiAnalyzer to authorize any FortiGate device in the Auto Scaling group. To conform to the FortiAnalyzer naming policy, the user name can only contain numbers, lowercase letters, uppercase letters, and hyphens. It cannot start or end with a hyphen (-).

Autoscale admin password (FortiAnalyzerAutoscaleAdminPassword)

Requires input

Password for the "Autoscale admin user name." The password must conform to the FortiAnalyzer password policy and have a minimum length of 8 and a maximum length of 128. If you need to enable KMS encryption, refer to the documentation.

FortiAnalyzer private IP address (FortiAnalyzerCustomPrivateIpAddress)

Requires input

Custom private IP address to be used by the FortiAnalyzer. Must be within the public subnet 1 CIDR range. Required if "FortiAnalyzer integration" is set to yes. If "FortiAnalyzer integration" is set to no, any input will be ignored.

Custom asset location configuration

Parameter label (name)

Default

Description

Use custom asset location (UseCustomAssetLocation)

no

Set to yes to use a custom S3 location for custom assets such as licenses and customized configsets.

Custom asset S3 bucket (CustomAssetContainer)

Requires input

Name of the S3 bucket that contains your custom assets. Required if 'Use custom asset location' is set to yes. Can only contain numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).

Custom asset folder (CustomAssetDirectory)

Requires input

The sub path within the 'custom asset container' that serves as the top level directory of all your custom assets. If 'Use custom asset location' is set to yes, and this value is left empty, the 'custom asset container' will serve as the top level directory. Can only contain numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). If provided, it must end with a forward slash (/).

Deployment resources configuration

Parameter label (name)

Default

Description

S3 bucket name (S3BucketName)

Requires input

Name of the S3 bucket (created in step 4 of Obtaining the deployment package) that contains the FortiGate Autoscale deployment package. Can only contain numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).

S3 resource folder (S3KeyPrefix)

Requires input

Name of the S3 folder (created in step 5 of Obtaining the deployment package) that stores the FortiGate Autoscale deployment resources. Can only contain numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). If provided, it must end with a forward slash (/).