Problem with Fortigate on AWS

Forum|Forum|3 years ago
May 31, 2023
12 replies
8201 views

Hi please i have a huge problem.
I have an EC2 instance on AWS with IP address 172.31.X.X that I want to communicate with another remote instance of a customer always on AWS with IP address 172.33.X.X through a fortigate IPsec VPN tunnel on both sides else.
For the fortigate 1 we have LAN: 172.31.X.Y, WAN: 172.31.Y.Z and the pubilc IP
For the fortigate 2 we have LAN: 172.33.X.Y, WAN: 172.33.Y.Z and the public IP

the vpn tunnel is UP but when I ping from the ec2 172.31.X.X to the remote ec2 172.33.X.X the ping does not go through and when I try to get out of the network I cannot. From the servers we can't ping the internet. Apparently it's a routing problem but I don't know which side.

Here is the architecture

EC2 ===> Fortigate 1 ===> tunnel ===> Fortigate 2 ===> EC2

But the traffic is blocked internally (between EC2 and Fortigate) and does not go out

Please i want some help

FortiGate

Best answer by gfleming

Do you have a FW Policy that allows the traffic from LAN interface to WAN interface?

gfleming

Staff

What does your VPC route table look like on either side?

Alex2Author

New Member

Hello and thank you for your answer.

Here is the routing table at each point

- Private Subnet 1 routing table

Destination Target

172.31.X.X/16 local

0.0.0.0/0 ENI-LAN fortigate 1

-Public Subnet 1 routing table

Destination Target

0.0.0.0/0 IGW (Internet Gateway)

-Public subnet 2 routing table

Destination Target

0.0.0.0/0 IGW

-Private Subnet 2 routing table

Destination Target

172.31.X.X/16 local

172.32.X.X/16 local

172.33.X.X/16 local

0.0.0.0/0 ENI - LAN Fortigate 2

I hand over the architecture

EC2=======>Fortigate1=======>Fortigate2=======>EC2

172.31.X.X LAN: 172.31.X.Y LAN: 172.33.X.Y 172.33.X.X

Wan: 172.31.Y.Z Wan: 172.33.Y.Z

Public IP: 18.215.Z.Z Public IP : 52.5.Z.Z

gfleming

Staff

Private subnet 2 route table looks problematic. You have remote subnet 172.31.X.X/16 listed as local.

Alex2Author

New Member

Thanks for update, i remove it now but i have this problem.

An ec2 instance behind a fortigate 1 and when I ping the LAN address 172.31.X.Y of the fortigate 1 and the ping goes through but when I ping the WAN address the ping does not go through. What are the ways to make them communicate. I have already configured access to fortigate 1 from the instance in the fortigate 1 security group and the routing table in the private subnet is redirecting all traffic to the LAN interface of the fortigate 1