aws internet traffic and aws

[toan2552]

Hi,

I have an IPsec connection set up from AWS to Fortigate.

In AWS, there's a private subnet containing various services, including EC2 instances.

Within my Fortinet, there are two networks - a DMZ network and an internal network, and they can communicate with the EC2 instances without any issues.

However, I'm currently facing a challenge: I want to enable internet access for the EC2 instances through the IPsec connection, following this path:

EC2 ===> Fortigate 1 ===> Internet

To achieve this, I've configured the AWS route table to have a route with destination 0.0.0.0/0 pointing to the virtual private gateway (VGW) to handle internet-bound traffic.

On the Fortigate side, I've implemented two policies. The first policy is to allow traffic from the WAN to AWS IPsec, and the second policy is to allow traffic from AWS IPsec to the WAN.

Unfortunately, despite these configurations, the setup isn't functioning as expected. When capturing traffic on the Fortigate, the results show:

1 0.000000 192.168.16.44 8.8.8.8 ICMP 60 Echo (ping) request id=0x0001, seq=51820/27850, ttl=128 (no response found!)

This suggests that the ping request from 192.168.16.44 (presumably one of the EC2 instances) to 8.8.8.8 (Google's DNS server) did not receive a response.

I'd appreciate any guidance or suggestions to troubleshoot and resolve this issue.

Thank you.

[toan2552]

Hi, I solved the problem. It was on AWS ACL rules. It was necessary to input rule 0.0.0.0/0

And now fortigate controller the input traffic with policy.

The next step will be virtual ip for EC2 machines

Thank you so much for your help.

[stevediaz]

Hello

Check your outbound security group rules on AWS for the EC2 instances to ensure internet access is allowed. Also, verify the NAT settings and ensure proper routing on both AWS and Fortigate sides.