- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Subnets in hub architecture and spokes in OCI
Hello community.
We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.
My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW.
I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.
Solved! Go to Solution.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Fortigate community. We have found the solution in the following article because the problem was that the traffic was entering and exiting through the same interface and did not make policy check:
In summary if you can have more than one subnet per VCN in OCI if you want to deploy a Fortigate FW.
Guide to deploy Fortigate FW:
https://apexapps.oracle.com/pls/apex/dbpm/r/livelabs/view-workshop?wid=846
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello GIAdmin, Good day!
I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.
Could you please confirm if the traffic is hitting the firewall using sniffer?
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sn...
If the traffic is hitting the firewall, please run a debug flow to validate the traffic flow.
https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/54688/debugging-the-packet-flow
Other reference:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...
Thank you!
-lgupta
If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Some of these responses come across as being dogmatic. Hub of network only, then DNS should be in its own Spoke? Where do you draw the line.
OP, it depends on what works for the organisation. Some see share services as peer to a business app (thus a spoke), others view shared services as part of the underlying infrastructure fabric supporting businesses apps, thus part of the Hub.
Just don't develop tunnel vision.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Fortigate community. We have found the solution in the following article because the problem was that the traffic was entering and exiting through the same interface and did not make policy check:
In summary if you can have more than one subnet per VCN in OCI if you want to deploy a Fortigate FW.
Guide to deploy Fortigate FW:
https://apexapps.oracle.com/pls/apex/dbpm/r/livelabs/view-workshop?wid=846
