Aviatrix Gateway to FortiGate

1. Configure a Site2Cloud tunnel in Aviatrix CoPilot.
2. Configure a VPN tunnel and related components in the FortiGate Firewall.

​

Setting up External (S2C) Connection

1. In Aviatrix CoPilot, launch an Aviatrix Transit Gateway.
2. Navigate to Networking > Connectivity > External Connections (S2C) and click Add New to create a Site2Cloud connection using the values for one of the below options (for either you can select either PSK or certificate-based authentication).

• Static Route-Based
• Static Policy-Based

3. After the connection is created, select the vertical ellipsis menu for that connection and select Download Configuration.
4. Select Generic from the Vendor dropdown list and click the Download to download the external (S2C) configuration. Use this configuration file to configure the tunnels and interfaces in your Fortinet FortiGate firewall.

​

FortiGate Configuration

• There are two interfaces on the FortiGate:
  • Interface port1 is an externally facing interface.
  • Interface port2 is an internally facing interface.
• You have a subnet in AWS, Azure, or GCP in a VPC/VNet that has an Aviatrix Gateway. This subnet is defined as “10.0.0.0/16” for the examples below but it can be any valid CIDR range.
  In the examples below this range is referred to as AWS_Cloud.
• You have a subnet behind your FortiGate firewall that will be accessible in the cloud. This subnet is defined as “172.16.0.0/20” in the examples below but it can be any valid CIDR range.
  In the examples below, this range is referred to as Shared_With_AWS.

​

Configuring Named Address Ranges in FortiGate

​

AWS_Cloud

​

Shared_With_AWS

​

Creating an IPsec Tunnel on FortiGate

1. Log in to the FortiGate and access the Dashboard.
2. In the VPN menu, select IPsec Wizard.
3. Change the Template Type to “Custom.”
4. Enter any value as the Name. For this example, we are using “aviatrix-gatew.”
5. Click Next >.
6. Fill out the Network fields as recommended below:

   Field	Expected Value
   Name	aviatrix-gatew (for example)
   Template Type	Custom

​

New VPN Tunnel Tab

7. Click OK.
8. Navigate to Network > Interfaces.
9. Click on the Tunnel created above (e.g. aviatrix-gatew) and assign the IP address from the downloaded configuration file.

​

Configure IPv4 Policy

1. Go to Policy & Objects > IPv4 DoS Policy.
2. Create two new IPv4 policies:

• Outbound traffic from FortiGate (Shared_With_AWS) to Aviatrix (AWS_Cloud)
• Inbound traffic from Aviatrix (AWS_Cloud) to FortiGate (Shared_With_AWS)

​

Adding a Static Route

If Named Address is disabled, be sure that you enabled Static Route Configuration on the Address configuration.

​

IPsec Monitor

1. In the Fortigate UI, navigate to Dashboard > Network and click the IPsec widget.
2. Select the Aviatrix tunnel, and click Bring Up.
3. You can then check the tunnel status in CoPilot under Diagnostics > Cloud Routes.

​

Troubleshoot

config system global
    set ipsec-asic-offload disable
end

configure system global
    set ipsec-hmac-offload disable
end

​

Related Topics

• About External Connection Settings