Technical Tip: How to add an SDN connector in FortiGate VM deployed in AWS VPC

JaskiratM · ‎05-16-2023

Description

This article describes on adding an SDN connector in FortiGate VM deployed in AWS VPC and its use cases along with troubleshooting steps.

Scope

FortiGate VM deployed in AWS VPC. If it is not already deployed, follow the steps in Deploying FortiGate-VM from AWS marketplace - FortiGate Public Cloud AWS administration guide to set it up.

Solution

For the FortiGate to change the AWS environment, an IAM role with appropriate policies (depending on use cases) needs to be assigned to the FortiGate VM. Go to IAM -> Roles and Create Role. Select AWS Service, check the EC2 box, and select Next.

Create a policy to set the allowed permissions for the IAM role. Select 'Create Policy' at the top right.

Create a policy using JSON to give permissions to the IAM role that will be later assigned to the FortiGate VM.

The JSON rules can be added according to user needs, either by adding it manually or using the 'Edit statement' section at the right:

{

"Version": "2012-10-17",

"Statement": [

{

"Action": [

"ec2:Describe*",

"ec2:AssociateAddress",

"ec2:AssignPrivateIpAddresses",

"ec2:UnassignPrivateIpAddresses",

"ec2:ReplaceRoute",

"config:BatchGetResourceConfig",

"eks:DescribeCluster",

"eks:ListClusters"

],

"Resource": "*",

"Effect": "Allow"

}

]

}

The 'ACTION' field is responsible for providing various kinds of access FortiGate needs to be given to make changes in the AWS environment.

The 'Resource' field is responsible for what kind of resources is the FortiGate allowed to alter/Get.

Note: Both action 'eks' are optional for normal operation, but if they are removed, an error message will appear while debugging:

"curl response err, 403"

"not authorized to perform: eks:ListClusters on resource: arn:aws:eks:xyz"

If there is no such permission, the API will fail with an error message. However, this will not impact other dynamic address collection. See AWS Administration Guide - AWS EKS SDN connector.

After picking the appropriate JSON rules, select Create policy. Provide a name and add it to the IAM role, then select Next:

Provide a name to the role and select 'Create Role':

Attach the ROLE to the FortiGate VM deployed in AWS. Navigate to the EC2 Dashboard and select the FortiGate VM, right-click it, select Security, and select Modify IAM role:

Select the IAM Role created in step 3 and select Update IAM role.

The next step is to add the SDN connector in FortiGate. Go to Security Fabric -> External Connectors -> Create-New -> Choose AWS-SDN:

Now grab the VPC-id from the AWS EC2 dashboard:

Fill that information into the FortiGate SDN wizard and select 'OK':

Verification and Troubleshooting:

To verify it is working, confirm that the GUI page of the external connectors in FortiGate shows the AWS-SDN connection is up:

If this does not show as green or if there is an error in the functionality of the SDN, use the following debug commands:

diagnose debug application awsd -1
diag debug en

The debug outputs and the JSON policies defined in the ROLE allow the FortiGate to learn the VPC endpoints, and additionally provide access to alter the AWS environment using the API.

Moreover, diag test commands can be used to troubleshoot issues in the SDN connector:

Usage:

There can be many use cases for AWS-SDN depending upon requirements, but some of the most common ones are listed below:

Address updates: Addresses in the AWS environment can be learned and changed dynamically in the FortiGate.

This can be achieved by referring to the following documents:

HA failover: SDN can also be used to move the Floating ELASTIC IP from the primary to slave in case of failover, and also make changes to the Route tables. For this, a specific JSON policy needs to be configured as follows:

{