Skip to main content
MrJingles
MrJingles
New Member
June 11, 2020
Question

AWS EC2 Instance

  • June 11, 2020
  • 1 reply
  • 8855 views

Hi Guys

 

Hope this is the correct section to post in.

 

We are testing a fortigate VM64-AWS. We also have a mikrotik cloud hosted router in AWS on EC2 as well within the same VPC and same subnet.

 

I have done the basic config but can't seem to pass traffic to the internet going through the fortigate.

 

I have set my mikrotik as connected on the LAN interface of the Fortigate and they are both in the same subnet. As a test, I just routed 8.8.8.8 from the mikrotik to the fortigate LAN IP but I am not getting internet breakout. 

 

I have done a diag sniffer and can only see the ping from the mik to the forti but not the ping from the mik to google.

 

I have never worked with fortigate previously so not sure if i'm doing something wrong.

 

I have a default route configured on the forti.

 

not sure what I am doing wrong.

 

We basically want to run the forti as the firewall that sits between our mik(where our customers live) and the internet.

 

Please let me know what other info you need.

    1 reply

    Patel
    Patel
    New Member
    June 12, 2020

    Hi,

     

    I think you are missing a policy from what you just explained in the post. You might want to create a policy on FortiGate with NAT enabled if configured the WAN interface in that way. You can refer to the link below to setup basic Internet connectivity.

     

    https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/421070/installing-a-fortigate-in-nat-mode

     

    Kind Regards,

    Patel

    MrJingles
    MrJinglesAuthor
    New Member
    June 12, 2020

    Hi Patel

    I already have the NAT rule in place. It is set up exactly as in the cookbook. I've tried everything and I don't know what I am missing. Not sure if it something on the AWS config that could be wrong?

     

    I've disabled the security profiles and spun up a new router vm and new forti just to test with two new instances but I still can't find the problem.

     

    The forti has internet access because I'm accessing it from the WAN side so it must be something small I'm missing.

    Patel
    Patel
    New Member
    June 14, 2020

    Hi MrJingles,

     

    Apply the debug commands below and see the output. It should show you the message why FortiGate is dropping the packets. If FortiGate is doing that.

     

    # diag debug reset

    # diag debug flow filter clear

    # diag debug flow filter proto 1

    # diag debug flow filter addr 8.8.8.8

    # diag debug console tim en

    # diag debug flow show function-name enable

    # diag debug flow show ip enable

    # diag debug flow trace start 999

    # diag debug enable

     

    After that, try pinging 8.8.8.8 from the internal network

    You will be able to see flow of the packets.

     

    Let me know if if that works or not.

     

    Regards,

    Patel

     

    Terms & ConditionsAccessibility statement