AWS FortiGate route between 2 availability zone

[danielt]

Hi,

I deployed forti in aws.

the forti deployed in az 1a.

I have 2 subnets, 1a and 1b.

I attached to forti 2 eni
1 eni for the wan traffic.
1 eni in 1a az.

in the subnets route table, I route 0.0.0.0/0 traffic to eni that is attached to forti.

I attached the relevant security groups for the eni and for the ec2 machines.

I facing with problem that subnet 1b don't have outbout connection and I cant connect directly to the ec2 machines in subnet 1b, I can connect only from the 1a ec2 machines.

What I configured not correctly?

Thanks 

Daniel

[issa00]

Hi Daniel,

Check the below from your end. Hopefully one of them should solve the issue.

1. Can you confirm that the route table associated with subnet 1b has a route for 0.0.0.0/0 pointing to the correct ENI of the FortiGate firewall?
2. Have you checked the outbound rules of the Network ACL associated with subnet 1b? Are there any rules that might be blocking outbound traffic to the internet (0.0.0.0/0)?
3. Have you verified the outbound rules of the security groups attached to the EC2 instances in subnet 1b? Do these rules allow outbound traffic to the internet or necessary destinations?
4. Can you confirm that the ENI attached to the FortiGate firewall in AZ 1a is correctly configured to handle outbound traffic for subnet 1b?

Let me know if above configurations are correct and still cannot directly conect to EC2s in 1b.

[danielt]

Hi  @issa00 ,

The first three sections are correctly defined.

I didn`t understand the 4 section, how can I verify it can handle traffic from 1b?
if you mean if I disable the source/dest check, I disable it.

Thanks

[danielt · Accepted solution]

Hi @issa00 ,

I solved the issue.

For subnets on another AZ that route to Internal ENI, you need to set the gateway IP for the first IP in the ENI subnet. The first IP of the subnet is to the internal AWS route.

For example Test-1b subnet is on 1b AZ so the "Gateway IP" will be the first IP in subnet 1a attached to subnet because the eni is on 1a AZ.