AWS Fortigate Setup - possible routing issue.

Question

Hi, Note: This post was attempted earlier but seems not to have reach the forum. Am reposting with more detail. We've been evaluating the Fortigate appliance in AWS and followed setup guides (http://docs.fortinet.com/...e-aws-deployment.pdf). It's gone ok so far but we've hit an odd issue and were hoping for some pointers. We're not too experienced with with Fortigate so perhaps have overlooked something. Background [ul]AWS Routing:Two route tables created[ul]Public[ul]has 10.0.5.0 subnet associateddefault route is AWS Internet Gateway (IGW)[/ul]Internal[ul]has 10.0.217.0 subnet associateddefault route is Internal interface of Fortigate Appliance[/ul][/ul][/ul][ul]Fortigate Appliance [ul]Two interfaces: Public (10.0.5.93) & Internal (10.0.217.79)IPv4 Policies[ul]From: Internal, To: External, Source: All, Dest: All, Service: All_ICMP, NAT: EnabledFrom: Internal, To: External, Source: All, Dest: All, Service: HTTP/HTTPS, NAT: EnabledExplicit Deny in place[/ul]Can SSH into both Public & Internal interfaces and successfully ping external IP/FQDN[/ul][/ul][ul]Test servers: [ul]Test server 1: 10.0.217.215Test server 2: 10.0.210.77[/ul][/ul]Problem Description  [ul]Both Test Servers are unable:ping external IP/FQDNreach via HTTP/HTTPS any external IP/FQDNBoth ICMP and HTTP/HTTP IPv4 Policies show Statistic Counters increases when each Test Server attempts outbound connection. The Explicit Deny Policy show's zero statistical counters[/ul]   Troubleshooting [ul]Test 1: Explicit Proxy[ul]We enabled the Explicit Proxy FeatureEnabled Explicit Proxy on the Private interfaceNetwork->Explicit Policy: Default Settings.Created an Explicit Proxy Policy -  Source: All, Destination: AllConfigured Test Server 1 & 2 browser to use Fortigate Private IP as Proxy serverBoth Test Servers were able to successfully browse to external FQDNs[/ul][/ul][ul]Test 2: Different Route Table for Private Interface[ul]Associated Private interface subnet with an existing route tableExisting route table default route = an existing NAT server with public IPBoth Test Servers were able to successfully browse FQDNs via HTTP and HTTPSNote that the public IP seen as the source of the HTTP/HTTPS request is the NAT public IP, not the Fortigate public IP[/ul][/ul] Summary [ul]Can reach only reach external IP/FQDN from Test servers when Explicit Proxy or NAT server is used as internal interface route Seems to be an issue with routing??The only time we've seen something similar to this in AWS is when an internal server has no public IP or is not using a NAT instance. Effectively no route back from the internet. This seems to be confirmed by the fact that the IPv4 Policies work ok when routing via the existing NAT instance. It's as if the fortigate private interface isn't routing to/from the public interface, yet seems to be doing just then when Explicit Proxy is enabled.[/ul]   Any help appreciated.

ede_pfau · Answer

As noone else is responding...how about the routing on the FGT? At least it'll need a default route as it has to handle network addresses other than those directly on the interfaces.

Could you please post a 'get router info routing all' from the FGT?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded