FortiGate CNF AWS Onboarding Tutorial | Cloud Security

# Overview This tutorial details the registration, initial account setup, and configuration process for FortiGate CNF (referred to in the transcript phonetically as 40K CNF / 40 OS / 40 Cloud). FortiGate CNF is a managed next-generation firewall (NGFW) offering that delivers network security for AWS Cloud environments, powered by FortiOS and FortiGuard Labs threat intelligence services.

# Key Topics - Subscribing to FortiGate CNF through the AWS Marketplace. - Creating and verifying a management account and registering user credentials. - Linking an AWS account to FortiGate CNF using an AWS CloudFormation template stack. - Creating a CNF instance and logging traffic to an Amazon S3 bucket. - Configuring endpoints, subnets, and subnet tags within the AWS Virtual Private Cloud (VPC). - Establishing VPC route tables to direct north-south traffic through Gateway Load Balancer endpoints for inspection.

# Technical Details 1. **Marketplace & Registration**: Access the FortiGate CNF page on the AWS Marketplace, subscribe, and proceed to set up an account. Registration requires an email address, CAPTCHA verification, an email verification code, setting a secure password, submitting account details, and accepting contract terms before signing in. 2. **AWS Account Linking**: Inside the CNF management console, navigate to the AWS account menu to add an account by supplying the AWS Account ID. Launch the AWS Quick Create CloudFormation stack, acknowledge IAM resource creation, and wait for the stack status to reach `CREATE_COMPLETE`. 3. **Instance Creation**: In CNF Instances, create a new instance by specifying the CNF name, region, log type, and configuring traffic logging to an S3 bucket. Wait until the instance status transitions to active. 4. **Endpoint Configuration**: Under endpoints, create a new endpoint specifying the name, account, and VPC ID. Copy the key name `fortigate_subnet_type` (rendered phonetically as `for the gay _ subnet _ type` in transcript). In AWS VPC Subnet settings, add a tag with this key name and the value set to `endpoint`. Back in the CNF endpoint dialog, select the tagged subnet, finish configuration, and verify that the endpoint status changes to active in both the console and AWS. 5. **North-South Routing Deployment**: To inspect traffic, three dedicated route tables are created in the VPC: - `CNF-Ingress-workload`: Configured with destination `0.0.0.0/0` (represented as `0.0.0.0`) targeting the Gateway Load Balancer endpoint (VPCE). This directs all outbound workload traffic (except local traffic) to FortiGate CNF. - `cnf-Ingress-internet`: Configured with the workload subnet as destination targeting the Gateway Load Balancer endpoint (VPCE). This ensures incoming traffic from the internet passes through FortiGate CNF prior to reaching the VPC subnet. - `CNF-egress-igw`: Configured with destination `0.0.0.0/0` targeting the Internet Gateway (IGW) for external network traffic leaving the environment after traversing FortiGate CNF.

# Takeaways FortiGate CNF integrates natively with AWS networking constructs using CloudFormation and Gateway Load Balancer endpoints. Proper north-south inspection requires configuring specific ingress and egress route tables in the VPC so traffic seamlessly forwards through the firewall instance before reaching destinations or exiting via the internet gateway. Users can consult the admin guide for additional architectures and workload options.