AWS Fortigate instance incommunicado...

[kadey]

I have a Fortigate instance in AWS that I cannot get to with ssh or https. It was accessible since creation (months), then all of a sudden it was not. I can ping it, and (by using nmap) can see that ports 22, 443, 500 and 4500 are accessible and listening. Security is wide open to this instance. Any ideas what could be wrong?

The console image shows the following:

System is starting...
Serial number is FGTAWS000133210D


FGTAWS000133210D login: 
AWS instance-id: i-0133210d2e0c26da

[emnoc]

Have you check

trusthost ?

security-group?

Ken Felix

[kadey]

Wouldn't the fact that I can scan the relevant ports mean there's nothing blocking the traffic?

I looked at the flow logs for the WAN interface, and the traffic is being accepted ok.

[kadey]

I did more comprehensive scanning, and it's only finding tcp port 541 open.

Port 541 is used by FortiManager. Could my FortiGate have been somehow put into remote management mode?

[emnoc]

What changes did you make in AWS and fortiOS? If it was working and now not working, undo or revert any changes. I would also not over look any local-in policies.

Ken Felix

[kadey]

I made no changes prior to this issue cropping up.

Can you elaborate on "local-in policies"? Are these in AWS or on the FortiGate?

[emnoc]

You have 3 or 4 things to check

1: route 

2: trusthost for any allowaccess

https://kb.fortinet.com/kb/documentLink.do?externalID=10868

3: local-in policy

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Security%20Policies/...

4: proper SG in AWS 

https://docs.fortinet.com/vm/aws/fortigate/6.2/aws-cookbook/6.2.0/228062/opening-ports-in-the-securi...

If your not getting a login prompt, I would research all of the above. if you did not change the fortios-cfg than the logical step is to look at the SG in AWS. Also I had a client that change the elastic ip and so he was trying to access the Fortigateinstance with the wrong EIP address.

Ken Felix

Ken Felix

[kadey]

Thanks for those links.

Routing is not an issue, since, like I previously said, I can ping the instance and perform a port scan on it.

I did not enable "Restrict login to trusted hosts" nor configure local-in policies to restrict access.

The AWS Security Group for the instance is wide open, and I have confirmed that the traffic is getting to the instance by looking at the VPC flow logs of the WAN interface.

I believe the problem is that it's in some weird state, because the port scan shows nothing is listening on the usual access ports 22 and 443. The only port open is 541, the FortiManager access port.

[James_G]

Have you tried a reboot?

[kadey]

Yes, I have stopped and restarted the instance multiple times.