Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kadey
New Contributor II

AWS Fortigate instance incommunicado...

I have a Fortigate instance in AWS that I cannot get to with ssh or https. It was accessible since creation (months), then all of a sudden it was not. I can ping it, and (by using nmap) can see that ports 22, 443, 500 and 4500 are accessible and listening. Security is wide open to this instance. Any ideas what could be wrong?

 

The console image shows the following:

 

System is starting...
Serial number is FGTAWS000133210D


FGTAWS000133210D login:
AWS instance-id: i-0133210d2e0c26da

14 REPLIES 14
emnoc
Esteemed Contributor III

Have you check

 

trusthost ?

security-group?

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
kadey
New Contributor II

Wouldn't the fact that I can scan the relevant ports mean there's nothing blocking the traffic?

 

I looked at the flow logs for the WAN interface, and the traffic is being accepted ok.

 

kadey
New Contributor II

I did more comprehensive scanning, and it's only finding tcp port 541 open.

 

Port 541 is used by FortiManager. Could my FortiGate have been somehow put into remote management mode?

 

emnoc
Esteemed Contributor III

What changes did you make in AWS and fortiOS? If it was working and now not working, undo or revert any changes. I would also not over look any local-in policies.

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
kadey
New Contributor II

I made no changes prior to this issue cropping up.

 

Can you elaborate on "local-in policies"? Are these in AWS or on the FortiGate?

emnoc
Esteemed Contributor III

You have 3 or 4 things to check

 

1: route 

 

2: trusthost for any allowaccess

 

https://kb.fortinet.com/kb/documentLink.do?externalID=10868

 

3: local-in policy

 

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Security%20Policies/...

 

4: proper SG in AWS 

 

https://docs.fortinet.com/vm/aws/fortigate/6.2/aws-cookbook/6.2.0/228062/opening-ports-in-the-securi...

 

If your not getting a login prompt, I would research all of the above. if you did not change the fortios-cfg than the logical step is to look at the SG in AWS. Also I had a client that change the elastic ip and so he was trying to access the Fortigateinstance with the wrong EIP address.

 

Ken Felix

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
kadey
New Contributor II

Thanks for those links.

 

Routing is not an issue, since, like I previously said, I can ping the instance and perform a port scan on it.

 

I did not enable "Restrict login to trusted hosts" nor configure local-in policies to restrict access.

 

The AWS Security Group for the instance is wide open, and I have confirmed that the traffic is getting to the instance by looking at the VPC flow logs of the WAN interface.

 

I believe the problem is that it's in some weird state, because the port scan shows nothing is listening on the usual access ports 22 and 443. The only port open is 541, the FortiManager access port.

James_G
Contributor III

Have you tried a reboot?
kadey
New Contributor II

Yes, I have stopped and restarted the instance multiple times.

 

Labels
Top Kudoed Authors