East-West traffic inspection between VPC with GWLB in AWS

[AnandS]

Hello all,

I am implementing east-west traffic inspection between VPCs with GWLB in AWS.

I have implemented Transit Gateway and I am able to get the traffic between the VPCs without any issues. But, I am struggling to get the traffic to use GWLB and pass the traffic to the firewall using Geneve protocol. I believe that I have followed the steps given in the Administration Guide and I am still not able to get this working.

1) Does anyone have a step-by-step detailed procedure that they can share?

2) How is the routing table implemented in the Transit Gateway and inside the security VPC to route the traffic to the firewall?

3) I wish to use the same firewall for north-south traffic inspection, SD-WAN, and third-party IPSec VPN terminations. Am I too ambitious in using the same firewall for multiple functions although all these can be achieved in a normal on-prem firewall?

4) What additional information do you need to help me in this implementation?

5) Is this possible to achieve with Fortigate CNF instead of BYOL implementation?

Any guidance and websites where I can get relevant information are highly appreciated.

Regards,

Anand

[gfleming]

This should help you: https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration-guide/185298/east...

[kvimaladevi]

Hi Anand,

The post deployment configuration part in the provided link should help you handle traffic between the FortiGate and GWLB:

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration-guide/360322/post...

Regards,

Vimala

[Netadmin-Japfa]

I suggest to you do not implement anything with gwlb + fortigate aws.

It still not good.

I implement for north south with gwlb using fortigate aws, Fortigate having bug, all traffic https been blocking by ssl inspection, ssl blocking with probe-cert-failed, if you using policy proxy mode.

Already using command probe-cert-failed ALLOW. The traffic not block, but very slow!

[Netadmin-Japfa]

Geneve is not working with fortios 6.4.12 and with fortios 7.4.0, working with 7.0.x and 7.2.x, even this having an issue with policy with proxy mode, https traffic will be block by ssl, ssl anomaly. Using probe-cert-failed allow command in the utm ssl profile, for ssl blocking, no ssl blocking, but, the traffic of https is slow.

[indramaulana]

hi @Netadmin-Japfa we are facing a problem with Fortios 7.4.x when deploying North-south security inspection to customer VPC, its that confirmed there is a bug?

[Netadmin-Japfa]

Hi last year we try with Forti os 7.4 with AWS GLWB using geneve in that forti os, it is not working. No traffic tunnel in the gevene.

But there is no issue with 7.0.x and 7.2.x. The tunnel with Geneve with AWS GWLB, is working (north south topology). But there is a bugs using proxy mode in the firewall policy, that still now, our case is still not being resolved. So we using flow based mode policy instead.

And also there is bugs with the web filter, when using regex. When we allow traffic https using web filter with regex, sometimes is work, sometimes is not. But it is being fixed by upload another version of ips engine.

I do not know what your case is. 

[indramaulana]

Hi @Netadmin-Japfa thank you for sharing us, One last question for the East-West security inspection between two customer VPCs still working for FortiOS 7.0.x and 7.2.x or not?

[Netadmin-Japfa]

we are not doing east west inspection yet, right now, only north south inspection with gwlb aws + geneve fortigate ec2. We can not answer your question.

[indramaulana]

Hi, @Netadmin-Japfa Today I tried using OS version v7.2.6 build1575 (Feature), but the issue is still the same. can you tell me a more complete OS version?