How to deploy FortiGate in AWS

FortiGate devices can be seamlessly deployed in Amazon Web Services (AWS) to protect your cloud infrastructure. By combining the scalability of AWS with FortiGate robust security features, you can secure your workloads, implement advanced threat protection, and create site-to-site VPNs for hybrid deployment.

In this guide, we will carry on with our previous post on setting up an IPsec VPN Tunnel from On-Prem FortiGate to AWS. I would recommend you read that post before continuing, as we will be working from the same configuration from that post. You can find the post linked below.

Setting up an IPsec VPN Tunnel from On-Prem FortiGate to AWS

Setting up an IPsec VPN tunnel between an on-premises FortiGate device and AWS enables secure communication between your local network and resources hosted in the AWS cloud. This configuration is commonly used to extend an enterprise network to the cloud, allowing seamless and encrypted data exchange for hybrid environments. AWS

NetSec-InsightDylan Hughes

Objectives:

• Adding Private subnet and associating routes in the routing table.
• Deploy a FortiGate firewall in AWS via the Marketplace.
• Define and configure subnets for the FortiGate in AWS.

AWS Configuration

1. Log into AWS Management Console

At the moment, we have two Public and Private subnets.

 2. We need to create a Private route in our route table.

3. Create new route table called Private Route

4. Now we can rename the route that was in there from before to Public Route.

5. We need to subnet associate the Public subnet to the public route.

6. Now we need to set up our Key Pair for the VM, go to EC2 - Key Pairs > Create Key Pair.

7. Now we can go to the Launch section and launch are instance.

8. Click Browse more AMIs.

9. search for Fortinet and select the Fortinet FortiGate Next-Generation Firewall.

10. Press Subscribe now.

11. Make sure the OS has been selected in the options. You should see the FortiGate-VM64.

12. T2.small is the free version, lasts for 30 days. Set the key pair to AWS-LAB.

13. This is the network configuration section. We will configure it to what we have created beforehand.

• VPC: VPC AWS Subnet
• Subnet: Public Subnet
• Auto-assign public IP: Enable
• Create Security group:  Name: FortiGate Security Group, Description: FortiGate Security Group

14. All source types are custom and linked to 0.0.0.0/0 which is our internet gateway.

15. Add two new Security Group rules, one for RDP and one for All ICMP Ipv4. Linked to 0.0.0.0/0

16. Storage should be set to 2 and 30 by default.

17. Launch instance.

18. Rename the instance to FortiGate.

19. Now we need to go to Network & Security > Network Interfaces.

20. Rename the interface in there to FortiGate Public Subnet.

21. Now we need to create a new Network Interface.

22. Name the Interface FortiGate Private Subnet and link the Private subnet to it.

23. Click on the FortiGate Private subnet and then click on attach.

24. Choose the FortiGate Instance

25. Click the FortiGate Private Subnet and then Change Source/Dest Check.

26. Now disable the Source/Destination check and click save.

27. Do the same for the FortiGate Public Subnet.

28. Go back to the VPC and go to Route tables, click the private route and edit routes.

29. Add route 0.0.0.0/0 and select Network interface.

30. Select the Private subnet as the network interface. Click Save changes.

31. Now if we go back to the FortiGate instance, we can see the public IP address of the device, and the private address of the device. We can now right-click our public IP address to bring up are FortiGate VM in our browser.

FortiGate Configuration

1. Login in with the username admin and the instance ID

2. Change the password.

3. Now we are logged into the FortiGate, we can see our main dashboard.

4. We will now configure are port 2 on the FortiGate to be our LAN port. Port 1 on the device is being used for our external subnet back to the internet.
5. Go to Network > Interfaces > Click Port 2

6. We can now see our port 2 connected to our private subnet and setup as DHCP

Conclusion

In this guide, we demonstrated how to deploy a FortiGate firewall in AWS, configure its networking, and prepare it for integration with your on-premises network. From setting up public and private subnets to attaching network interfaces and configuring routing, each step was crucial in establishing a functional environment for secure connectivity.

Hope you enjoyed this guide and happy Networking!