AWS Fortigate instance incommunicado...

[kadey]

I have a Fortigate instance in AWS that I cannot get to with ssh or https. It was accessible since creation (months), then all of a sudden it was not. I can ping it, and (by using nmap) can see that ports 22, 443, 500 and 4500 are accessible and listening. Security is wide open to this instance. Any ideas what could be wrong?

The console image shows the following:

System is starting...
Serial number is FGTAWS000133210D


FGTAWS000133210D login: 
AWS instance-id: i-0133210d2e0c26da

[emnoc]

SSHD should be running. You can double check by finding the pid

e.g

FIREWALLFGT # fnsysctl ls /var/run/sshd.pid/var/run/sshd.pid   FIREWALLFGT # fnsysctl ls -ltr /var/run/sshd.pidls: invalid option -- 't'usage: ls [-aAl] [file ...] FIREWALLFGT # fnsysctl ls -l /var/run/sshd.pid-rw-r--r--    1 0        0       Thu Dec 26 22:57:33 2019                3 /var/run/sshd.pid FIREWALLFGT # fnsysctl cat  /var/run/sshd.pid85 FIREWALLFGT # diag sys process  dump 85Status:Name: sshdState: S (sleeping)Tgid: 85Pid: 85 You can also use diag sys top -p  If you have a pid than diag sniffer the interface and monitore.g   diag sniffer packet wan1 "dst port 22" Ken Felix 

[emnoc]

Also run debug on sshd 

e.g

diag debug en

diag debug reset 

diag debug application  sshd -1 That might shed some light also and ensure that the sshd tcp.port is known if it's not #22 Ken Felix

[kadey]

How am I supposed to do this if I can't access the instance?

[emnoc]

You don't have an inside host that can access or is it all external-facing hosts that has problems ( i.e mgt access from the internet )  ? I still believe you either have 1> SG ( Sec-group 2> or wrong instance public-ip 3> maybe you release the ip and gather a new one 

If nothing changes on fortios , then your problem is elsewhere. How did you determine ssh/https is NOT running as you mentioned previously? if you have no access and the image is "truly" up, your problem might be somewhere else and has nothing todo with FortiOS or the Virt-image

"been there done that before"

if your problem is only mgt traffic and EC2 instances are working through the unit, then that can be a clue as to what is happen or happening.

Ken Felix

[kadey]

I performed a port scan on the instance, and the only tcp port that came back as open was 541. UDP 500/4500 (the IKE/ISAKMP IPsec ports) are open.