# FortiGate to AWS: one CGW, two tunnels, then a route Source: https://ai.techclick.in/blog_vpn_fortigate_to_aws Markdown: https://ai.techclick.in/blog_vpn_fortigate_to_aws.md Publisher: Techclick Infosec Pvt Ltd FortiGate to AWS Site-to-Site. Customer Gateway 203.0.113.10. Two tunnels for HA. Dummy VGW 203.0.113.60. ## The ticket EC2 in hub VPC 10.50.0.0/16 cannot reach 10.20.30.80. Junior built one FortiGate Phase-1 to “the VGW” and called HA done. AWS gave two tunnel outside IPs in the download file. Tunnel 2 was never configured. One ISP blip and the VPN is gone. Quick interview answer AWS S2S: Customer Gateway = your device (IP 203.0.113.10, optional BGP ASN), target gateway = VGW attached to one VPC or TGW for many VPCs, VPN connection = two IPsec tunnels. Routing is Static (prefix 10.20.30.0/24) or Dynamic (BGP). FortiOS: two route-based IKEv2 tunnels, two routes or BGP, policies on both tunnel interfaces. Download the vendor file from the AWS console and use those outside IPs and PSKs. This dummy lab’s VGW public identity is 203.0.113.60 - still configure both tunnels from the file. Hero · two tunnels One CGW. Two IKE SAs. That is the HA unit AWS actually gives you. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model AWS object Job This lab Customer Gateway Tells AWS your public IP 203.0.113.10, device fgt-hq Virtual private gateway VPN endpoint on one VPC Attached to 10.50.0.0/16, dummy public 203.0.113.60 Transit gateway Hub for many VPCs + VPN Use when spokes exist; same two-tunnel VPN VPN connection Two tunnels + PSKs + inside /30s Copy from AWS download - do not invent inside CIDRs Static or BGP How AWS learns 10.20.30.0/24 Static prefix or BGP if you have an ASN to use HA is the second tunnel, not a second wizard Two IPsec tunnels from FortiGate to AWS fgt-hq CGW 203.0.113.10 - Tunnel 1 IKE vpn-aws-t1 Tunnel 2 IKE vpn-aws-t2 VGW / TGW 203.0.113.60 id Hub VPC 10.50.0.0/16 AWS assigns the two tunnel outside IPs. The lab VGW label is not a license to configure only one Phase-1. https://console.aws.amazon.com/vpc/home#CustomerGateways: Training mock · not live AWS console VPC Site-to-Site VPN Customer Gateways VPC → Site-to-Site VPN → Customer Gateways ### Customer gateway cgw-fgthq Name cgw-fgthq IP Address 203.0.113.10 Certificate ARN (blank - PSK from the VPN connection) Device fgt-hq Target gateway type Virtual private gateway (or Transit gateway) Routing options Static · Static IP Prefixes 10.20.30.0/24 Tunnels Two - copy Outside IP / PSK from the AWS configuration download Cancel Save AWS Site-to-Site VPN. Training mock. Dummy account, not yours. ## How to choose Single VPC, simple prefixes: VGW + static 10.20.30.0/24. Many VPCs: TGW attachment , still two tunnels. BGP when you already run BGP on the FortiGate and have an ASN you are allowed to use - do not invent an ASN in the interview. Always two FortiGate tunnels. ## Runbook #### Side A - AWS objects CGW 203.0.113.10. VGW attached to 10.50.0.0/16 (or TGW). VPN connection: static prefix 10.20.30.0/24. Download the Fortinet configuration. Note Tunnel 1 and Tunnel 2 outside IP + PSK. - #### Side B - two FortiGate tunnels vpn-aws-t1 and vpn-aws-t2, IKEv2, route-based, those outside IPs, those PSKs. Routes to 10.50.0.0/16 on both (or BGP). Policies LAN ↔ each tunnel if, NAT off. - #### Side C - prove Both IKE SAs up. AWS tunnel status UP/UP (or UP/DOWN while you finish tunnel 2). Sourced ping to a hub test IP. Disable tunnel 1 in a change window and confirm tunnel 2 forwards. fgt-hq · AWS two-tunnel proof diagnose vpn ike gateway list # vpn-aws-t1 remote: (Tunnel 1 Outside IP from AWS file) IKE SA: established # vpn-aws-t2 remote: (Tunnel 2 Outside IP from AWS file) IKE SA: established diagnose vpn tunnel list name vpn-aws-t1 diagnose vpn tunnel list name vpn-aws-t2 get router info routing-table details 10.50.0.0 # 10.50.0.0/16 via vpn-aws-t1 (and/or vpn-aws-t2 / BGP) execute ping-options source 10.20.30.1 execute ping 10.50.0.10 # only if that dummy host exists - do not invent an ACS value ## Four failures ### 1 · Only one tunnel configured AWS still shows a VPN connection. You do not have the HA AWS documented. Build both Phase-1s. ### 2 · CGW IP is 203.0.113.60 Customer Gateway is on-prem 203.0.113.10. The VGW/TGW outside IPs come from the download. ### 3 · Static prefix missing 10.20.30.0/24 IKE up. AWS has no route back to Priya. Add the prefix or bring up BGP correctly. ### 4 · Invented inside /30 or second public Use the AWS file. Do not guess tunnel inside CIDRs or a second “VGW public.” ## How to prove it Close only when 1) CGW = 203.0.113.10. 2) Two IKE SAs from the AWS file. 3) 10.50.0.0/16 via a tunnel if. 4) Sourced ping works. 5) You can say what happens if tunnel 1 dies. ## Traps Symptom Look at Wrong fix One tunnel UP, one DOWN Second Phase-1 / second PSK “AWS is up” and walk away Both UP, no return Static prefix / VPC route table / SG New CGW with Azure’s IP Phase-2 selector fight Route-based 0/0 both sides Policy-based to “match AWS” ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 AWS Customer Gateway in this lab is… 203.0.113.10 203.0.113.60 203.0.113.50 10.50.0.0/16 Correct: a . CGW is on-prem. Q2 How many IPsec tunnels does one AWS S2S VPN connection include? One Two Four by default None - it is SSL-VPN Correct: b . AWS docs: two tunnels for HA. Q3 Where do Tunnel 1 / Tunnel 2 outside IPs come from? You invent 203.0.113.61 The AWS configuration download for that VPN connection RFC 5737 The SSL-VPN pool Correct: b . Do not invent tunnel IPs. Q4 Static routing on the AWS VPN connection must include… 10.20.30.0/24 so AWS can reach HQ LAN 8.8.8.8/32 only The FortiManager IP only 0.0.0.0/0 on a policy-based Azure GW Correct: a . Return path. Q5 VGW vs TGW as the target gateway? VGW attaches to one VPC; TGW hubs many VPCs - still two tunnels TGW removes IPsec VGW is SSL-VPN TGW is Azure-only Correct: a . AWS concepts. Q6 One FortiGate Phase-1 to “the VGW” means… AWS HA is complete You configured only half of the VPN connection BGP is mandatory Phase-2 is impossible Correct: b . Failure 1. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - What is AWS Site-to-Site VPN? . - AWS Site-to-Site VPN - how it works (CGW, VGW/TGW, two tunnels) . - AWS - Get started with AWS Site-to-Site VPN . - FortiOS 7.4 - IPsec VPN . - RFC 7296 - IKEv2 . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt