- Introduction: FortiGate SDN Connector (supported natively by FortiOS).
- Overview of Alternatives:
| | Solution | Pros | Cons |
|---|---------------------------------|----------------------------------------------|-------------------------------------------|
| 1 | SDN Connector | • Fortinet‑native, no extra services | • Requires FortiOS ≥6.4 |
| | | • Moves EIPs and routes automatically | • Needs IAM role with broad perms |
- Detailed Implementation Plans:
Prerequisites
- FortiOS upper v6.4 under Fabric → Connectors → Public Cloud.
- Active Support entitlement: BYOL (Bring Your Own License) or PAYG (Pay As You Go), including SDN connector features.
- IAM role attached to both instances with the following minimum actions:
"Describe*", "AssociateAddress", "DisassociateAddress", "ModifyNetworkInterfaceAttribute", "CreateRoute", "ReplaceRoute", "AssignPrivateIpAddresses", "UnassignPrivateIpAddresses", "DescribeCluster", "ListClusters", "BatchGetResourceConfig".
- HA pair deployed in different Availability Zones using 'stand‑alone config‑sync' (interfaces and routes are not synchronized).
Step‑by‑Step:
- Confirm FortiOS version.
get system status | grep Version
- Attach/validate IAM role: Use AWS Console under EC2 → Actions → Security → Modify IAM Role.
- Create the SDN Connector (CLI).
config system sdn-connector
edit "aws-ha"
set type was
set use-metadata-iam enable <----- Rely on instance profile.
set update-interval 30 <----- Poll every 30 s.
set update-elastic-ip enable <----- Move ALL EIPs.
set update-route enable <----- Flip routes to new ENI.
next
end
- Verify discovery.
diagnose sys sdn-connector list
Ensure all ENIs (Elastic Network Interface) and EIPs (Elastic IP Address) appear.
- Adjust HA settings.
config system ha
set unicast-hb enable
set standalone-config-sync disable
end
- Functional test in the laboratory.
diagnose system ha reset‑uptime.
- Run 'aws ec2 describe-addresses' to confirm re-association in 30 s.
- Generate external traffic to each EIP to verify continuity.
- Enable logging/monitoring: FortiOS Event Log filter: "message_id=0100042005".
- Production rollout: Schedule a maintenance window; repeat the validation; monitor.
- Rollback Procedure.
config system sdn-connector
edit "aws-ha"
set update-elastic-ip disable
set update-route disable
next
end
- Re-associate EIPs manually if needed:
"aws ec2 associate-address --allocation-id eipalloc-xxxx --network-interface-id eni-yyyy"
Related articles:
|
