FortiGate 2-ARM Mode integration with AWS GWLB

this is a training session for system engineers that would like to deploy FortiGate on AWS and integrate with AWS GWLB in 2-ARM design

1. Fortigate 2-arM MODE WITH aws gwlb Yitao Cen Head of Product Marketing, APAC, AWS Ambassador

2. One-arm firewall deployment with Gateway Load Balancer The firewall appliance uses only one network interface to inspect the traffic . Ingress and egress traffic use the same port In this scenario , for outbound traffic , customer needs an additional service such as a NAT Gateway to forward traffic to Internet. In FortiGate deployment a second nic is highly recommended for out - of -band Management purposes . https://aws.amazon.com/es/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/

3. T wo-arm firewall deployment modes for egress traffic inspection Two-arm mode:  As shown in figure, the firewall is deployed in two-arm mode and performs both inspection as well as NAT. For GWLB integration there’s no need fo r special configuration other than the regular GENEVE tunnel using port 6081. Firewall networking: One network interface - private subnet Second network interface – public subnet GWLB supports two-arm mode where the firewall can also perform NAT. https://aws.amazon.com/es/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/

4. Configuration example

5. Topology Traffic from EC2 to Internet is routed to the GWLB endpoint Traffic sent to the GWLB Traffic goes through the GENEVE tunnel between GWLB and fg-eni-port2 FortiGate handles traffic and send it to fg-eni-port1 applying NAT Returning traffic arrives at FortiGate Returning traffic sent back to the GENEVE tunnel Returning traffic is sent to the GWLB endpoint in customer VPC Returning traffic arrives EC2 from the GWLB endpoint

6. FortiGate configurations GENEVE tunnel

7. FortiGate configurations Static routes Primary default route to 0.0.0.0/0 via ‘port1’. In case of having a route to 0.0.0.0/0 via ‘ awsgeneve ’, this needs to be configured with a higher priority to avoid connectivity issues . This route is necessary for one-arm deployments .

8. FortiGate configurations Policy routes With policy route 3 we force traffic coming from the public interface that is destined to customer VPC is sent to the GENEVE tunnel . Policy route 2 is disabled , as this one would allow the traffic from EC2 to return back to the GENEVE tunnel and then be forwarded to the local IGW ( or NAT Gateway). Policy route 2 is necessary for one-arm deployments .

9. FortiGate configurations Firewall policies Firewall policy “ geneve-to-public ” allows outbound traffic through FG port1 applying NAT and security profiles .

10. FortiGate acting as NGFW and NAT Traffic coming from EC2 through the GENEVE tunnel is forwarded to port1 ( public ) applying NAT.

11. FortiGate acting as NGFW and NAT This topology only works for egress traffic , as we are using a Gateway Load Balancer . This scenario doesn’t work for DNAT, for example , using a VIP in the FG to expose resources “ behind ” the Gateway Load Balancer . If the session doesn’t exist in the GWLB traffic will be dropped . Caveats