AWS/Fortigate. Placing Website's admin panel behind Fortigate in AWS

[varias]

Good Evening,

I was hoping to get some advice on how to best complete a project. Being pointed to KBAs and resources would be incredibly helpful as well. This is what I have outlined so far.

Summary of Requirements
I have a website hosted on Amazon Web Services (AWS), and would like to protect its admin panel by placing it behind a Fortinet FortiGate firewall. I want to restrict access to the admin panel so that it is only accessible via a FortiClient VPN. I specifically want the full feature set that a FortiGate firewall can offer.

I was thinking of spinning up a Fortigate EC2 instance that will let me use all the features of a normal fortigate, specifically so I can set up VPN access from machines to be able to access the site's admin panel.

High-level Steps:
Deploy FortiGate VM on AWS
Configure FortiGate Firewall Rules
Set up FortiClient VPN
Route Admin Panel Traffic through FortiGate VM

This was my plan:

1. Deploy FortiGate VM on AWS

(For this is there a Fortigate Product already available in AWS in that will do the job?)
Launch the FortiGate VM into the same VPC as the website or a different VPC based on requirements.

2. Configure FortiGate Firewall Rules

I can configure everything here like a normal fortigate?

Configure Security Policies to allow only necessary traffic.
For the admin panel, create rules that allow traffic only from the internal VPN network.

3. Set up FortiClient VPN

Configure an SSL-VPN or IPsec VPN according to needs: Making sure to specify that the VPN should grant access to the network where admin panel resides.

4. Route Admin Panel Traffic through FortiGate VM

Update the route tables or Security Groups in AWS to ensure that access to the admin panel is only possible through the FortiGate VM.

Is this the best way to do it? or do you recommend a different way

Thank you!

[saneeshpv_FTNT · Accepted solution]

Hi @varias ,

1.) You can deploy Fortigate using the AWS Cloud Formation Template or from the Market place depending on the License model you are going to use.

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/287546

2. Configure FortiGate Firewall Rules

I can configure everything here like a normal fortigate? Configure Security Policies to allow only necessary traffic.
For the admin panel, create rules that allow traffic only from the internal VPN network.

Yes You can configure everything like normal Fortigate. Please refer to datasheet.

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_VM_AWS.pdf

3. Set up FortiClient VPN

Configure an SSL-VPN or IPsec VPN according to needs: Making sure to specify that the VPN should grant access to the network where admin panel resides.

Kindly review the reference architecture for Fortigate AWS deployment for the recommended setup.

https://www.fortinet.com/content/dam/fortinet/assets/white-papers/wp-aws-reference-architecture.pdf

4. Route Admin Panel Traffic through FortiGate VM

Update the route tables or Security Groups in AWS to ensure that access to the admin panel is only possible through the FortiGate VM.

Please refer to similar configuration below.

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/367547/acce...

Please also refer the below article for additional deployment details.

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/367547/

Hope this helps. Please reply if any additional help required and someone from the community could reply as well.

Best Regards,

[varias]

Thank you!