Centralized east-west, inter-VPC Example
Scenario objective
Traffic between two VPCs, VPC A
and VPC B
, is inspected by a FortiGate CNF instance.
Before deployment of FortiGate CNF
In this scenario, traffic is between two VPCs, VPC A
and VPC B
, through a transit gateway.
The Before deployment of FortiGate CNF traffic flow is as follows:
-
Traffic originates from
Private Subnet
(10.2.3.0/24) inVPC A
(10.2.0.0/16) and goes to theAWS Transit Gateway
located inTGW Subnet
(10.1.6.0/24) inInspection VPC
(10.1.0.0/16). -
AWS Transit Gateway
sends the traffic toPrivate Subnet
(10.3.3.0/24) inVPC B
(10.3.0.0/16).
Routing tables
The routing tables are defined as follows.
Private Subnet (VPC A) route table
Destination | Target |
---|---|
10.2.0.0/16 | Local |
0.0.0.0/0 |
AWS Transit Gateway |
Private Subnet AWS Transit Gateway (VPC A) route table
Destination | Target |
---|---|
0.0.0.0/0 |
Inspection VPC |
Private Subnet (VPC B) route table
Destination | Target |
---|---|
10.3.0.0/16 | Local |
0.0.0.0/0 |
AWS Transit Gateway |
Private Subnet AWS Transit Gateway (VPC B) route table
Destination | Target |
---|---|
0.0.0.0/0 |
Inspection VPC |
TGW Subnet route table
Destination | Target |
---|---|
10.1.0.0/16 | Local |
AWS Transit Gateway route table
Destination | Target |
---|---|
10.2.0.0/16 | VPC A |
10.3.0.0/16 | VPC B |
After deployment of FortiGate CNF
The After deployment of FortiGate CNF traffic flow is as follows:
-
Traffic originates from
Private Subnet
(10.2.3.0/24) inVPC A
(10.2.0.0/16) and goes to theAWS Transit Gateway
located inTGW Subnet
(10.1.6.0/24) inInspection VPC
(10.1.0.0/16). -
AWS Transit Gateway
sends the traffic to theGWLBe
located inCNF Endpoint Subnet
(10.1.1.0/24). -
Traffic is sent to the FortiGate CNF instance for inspection.
-
FortiGate CNF sends traffic back to the
GWLBe
. -
GWLBe sends the traffic to
AWS Transit Gatway
. -
AWS Transit Gateway
forwards the traffic on toPrivate Subnet
(10.3.3.0/24) inVPC B
(10.3.0.0/16).
To deploy the FortiGate CNF instance in this scenario:
-
In AWS, add a subnet
CNF Endpoint Subnet
inInspection VPC
along with the associated route table.Destination Target 10.1.0.0/16 Local 0.0.0.0/0 NAT Gateway 10.0.0.0/8
AWS Transit Gateway
-
In FortiGate CNF, deploy a GWLBe to this subnet.
-
In AWS, add a route to the
Transit Gateway Subnet
route table to route all traffic to the GWLBe.Destination Target 10.1.0.0/16 Local 0.0.0.0/8
GWLBe