Configuring Hub Spoke on Oracle Cloud Infrastructure with FortiGate

Forum|Forum|2 years ago
February 4, 2024
4 replies
2874 views

As per the architecture explanation, the traffic from the ON-Premise Data center routes to the Fortinet FortiGate VM in through the untrust subnet. However, in the diagram (North-south inbound traffic) if we look at the Hub VCN Ingress route table, the traffic coming from on premise is routed to Secondary IP of Port 3 which is a trust subnet. Can someone clarify here ?

https://docs.oracle.com/en/solutions/secure-oci-workloads-fortigate/index.html#GUID-40CF25A9-E13A-4C92-8E21-D395920BB46A

FortiGate

Stephen_G

Moderator

Hello saikrishnatallam09,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Stephen_G - Fortinet Community Team

Stephen_G

Moderator

Hello saikrishnatallam09,

We are still looking for someone to answer your query and will respond to you as soon as possible.

Thanks,

Stephen_G - Fortinet Community Team

Stephen_G

Moderator

Hello saikrishnatallam09,

It seems that this is because the architecture in place in the diagram consists of an A-P cluster, which is why the RT points to a secondary IP. I hope that clarifies things.

Kind regards,

Stephen_G - Fortinet Community Team

sbaugh_FTNT

Staff

Hi,

Secondary IP's are used for the failover mechanism and are moved between A-P members, so the RT needs to point to the secondary IP.

Failure of the active firewall is detected by the passive firewall.
The passive firewall makes an API call from the management interface.
Changes to OCI are made:
1. Secondary IP’s is moved from firewall one untrust interface to firewall two untrust interface.
2. Secondary IP’s is moved from firewall one trust interface to firewall two trust interface.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded