Skip to main content
WalterW
WalterW
New Member
November 18, 2021
Solved

Fortigate on Cloud/AWS quirks

  • November 18, 2021
  • 2 replies
  • 5336 views

Hi,

 

we have deployed a Fortigate cluster on AWS cloud, mostly used as a VPN/NAT-Gateway.

 

Now as you usually have no network layer 2 on AWS, there is no ip/mac failover. As the cluster members are deployed in multiple subnets/availability zones, the interface config on each cluster member is unique, with different ip addresses and subnets. Failover is done by Fortigate using the AWS api and modifying route tables and elastic/public ip assignment. So far so good.

 

As a consequence of the above, you have to exclude some configuration items from the configuration sync with the ha peer, namely the interface config and router static config (by default also vip configuration is excluded).

 

As we will do definitely DNAT in our VPNs, I have removed the exclusion of the vip already. But interface config and static routes must kept excluded.

 

Now to the issue with this: For each VPN you have to configure some static routes pointing to the tunnel interface. But now with static routes excluded from ha sync, you have to do every change manually on the ha peer node from CLI by connecting to the ha peer and replicate the required route config.

 

If you have users which should mainly use the GUI to configure also VPNs, you're lost in this case.

 

Does anybody have an idea how to workaround this? Hopefully in some of the next releases it will be possible to still keep routes for VPN or other virtual interfaces synced with the ha peer.

 

Regards... Walter

 

Best answer by ncorreia

Hi,

 

I’m not sure if this what you’re looking for or how you’re managing your infra, but using Terraform, for example, can ease that burden.

All you’ll have to do after everything is implemented in TF, is update the vars for each node and apply the configuration.

2 replies

dchao_FTNT
Staff
dchao_FTNT
Staff
November 18, 2021

For FGTVM HA on aws, there should be a hamgmt port that user can access to each instance via it's public EIP address.   Should be able to use that EIP to do the configuration on each instance via GUI.

 

WalterW
WalterWAuthor
New Member
November 18, 2021

Yes, thanks, indeed. But it's still an extra step and it is a little bit error prone to keep the configs in sync like this. Not to say confusing for less experienced users, to have to do most of the configuration on the ha master, but to have an exception for routing.

 

I was thinking about some external triggered automation for syncing the vpn routes, should be doable, however it may introduce more issues than it solves :)

 

Do you know if there are any plans to improve this?

dchao_FTNT
Staff
dchao_FTNT
Staff
November 18, 2021

Don't know any plans on improving this.  As routing will be different especially in your setup is a cross-az. Hence, just make sure to do the configurations on both units when making any changes.   

WalterW
WalterWAuthor
New Member
December 10, 2021

Thanks for your suggestions, yes we are using terraform, but mostly for initial/base depoyments. I may consider something like this.

Terms & ConditionsAccessibility statement