High Availability for FortiGate-VM on AWS

[aallisonftnt]

FortiGate-VM for AWS offers high availability (HA) and a variety of security features to protect your workloads on AWS.

High Availability (HA) can be set up in two ways:

• Active/Passive: If the main firewall fails, a secondary one automatically takes over.
• Active/Active: Traffic is distributed between multiple firewalls for redundancy.

Security Features:

• Protects against threats with stateful inspection and security features.
• IPS technology safeguards against network-level threats.
• Docker application control secures containerized environments. 

The following topics provide an overview of different HA configurations when using FortiGate-VM for AWS.

• Deploying FortiGate-VM A-P HA on AWS within one zone
• Deploying FortiGate-VM active-passive HA AWS between multiple zones
• Deploying FortiGate-VM active-passive HA AWS between multiple zones manually with Transit Gateway in...

[rupert5646]

I have followed the Deploying FortiGate-VM A-P on AWS within one zone and I cannot get HA to fully work.  I think there is something missing from the IAM role.  What must the IAM role contain?

The FortiGate's fail over but the Public IP assigned to the secondary private IP is never reachable.

[Gallego]

Hi Rupert, this is an example of policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "ec2:AssociateAddress",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses",
                "ec2:ReplaceRoute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}