Implementing SSL VPN Using FortiGate in AWS Cloud
Tags: aws, cybersecurity, fortigate, awscloudsecuritywestafrica
Published: 2024-03-10 14:27:36

<u>**DEPLOYMENT OF FORTIGATE SSL VPN IN AWS CLOUD**</u>

There has been a significant increase in the deployment of enterprise applications and services in the cloud. This has necessitated the need for an additional layer of security and flexibility for services hosted in the cloud. Below are the advantages this deployment will offer:

a. It provides additional security to services and applications hosted on the AWS cloud.

b. It allows easy accessibility of services and applications hosted on the AWS platform.

c. Users do not need to have AWS accounts before they can access and modify applications hosted on AWS.

d. It provides  privacy for services and applications.


<u>**WHAT IS SSLVPN?**</u>

Secure Socket Layer Virtual Private Network (SSLVPN), is an example of VPN (Virtual Private Network) technology that utilizes SSL/TLS protocols to provide secure remote access to a private network. SSLVPN enables users to securely access applications and resources on a private network from a remote location through an encrypted connection over the internet.


<u>**STEPS FOR  FORTIGATE CLOUD DEPLOYMENT IN AWS** </u>

              NETWORK DIAGRAM
            


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4g4drdp6whw5974kamkf.png)








                   
**1.CREATE A VPC:** The first thing that is required is to create a VPC inside the AWS cloud.
For this VPC 10.10.0.0/16 subnet will be used with name tag SSLVPN-VPC




![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w6vh2nlgushlk5dt4myp.png)



**2.CREATE SUBNET**
Create a list of three subnets, with the first one being the public subnet and the remaining two being private subnets.
 The subnets shall be named as follows:
10.10.1.0/24 = Subnet_A
10.10.2.0/24 = Subnet_B
10.10.3.0/24 = subnet_C

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vzq9npf78m8p51zh1331.png)

**3.CONFIGURE ROUTING**
 Create a separate routing table for each of the three subnets. They will be named:
 10.10.1.0/24 = Route_A 
 10.10.2.0/24 = Route_B
 10.10.3.0/24 = Route_C 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t65sjjlpsrdvjv89ng8z.png)

**4. CREATE SECURITY GROUPS**
Create a security group and allow the following protocols inbound, including ports 22, 80, 443, and 10443. The security group is named SSL-VPN-SG


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3nrfwi23x289fxjod9tm.png)

**5. CREATE ENI FOR PRIVATE NETWORKS**
Elastic Network Interfaces (ENIs) should be created for each subnet. They will be named as shown below:

ENI-A,ENI-B and ENI-C 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e9iisrucj5db9v8yom29.png)

**6. LAUNCH FORTIGATE FIREWALL AND ATTACH ELASTIC NETWORK INTERFACE (ENI).**

Launch the Fortigate firewall instance from the AWS Marketplace. In this scenario, I am using Instance type of t3.medium 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kyh30v7inbydu4y6ofeo.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/naazk6ocic2vp2yxxzvi.png)

**7. CHANGE THE DEFAULT LOGIN DETAILS**
When you launch Fortigate Firewall, it gives you the default username as admin and the password as instance ID. It is mandatory to change the password

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8jzzgxsjll0e46it67i3.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ul35dw6537tyogmluwej.png)

**8. ATTACH TWO ADDITIONAL LOCAL INTERFACES TO THE FORTIGATE**

_**BEFORE  THE INTERFACES ARE ADDED**_
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5b0ube9a4sk8m2plpgx3.png)

  **_HOW TO ADD THE INTERFACE_**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p9xibbpb00v2xz2vwosg.png)
  **_AFTER THE INTERFACES  ARE ADDED_**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkcvhg9xpsbo019y5wcy.png)

  **9. CONFIGURE GATEWAY ADDRESS ON THE FIREWALL WITH THE IP ADDRESS OF THE NETWORK INTERFACES**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3sndnkyjn0klkddlqxtg.png)

**10. CONFIGURE USER DEFINITIONS AND USER GROUPS.**
   
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ic7v18bhjbm6rk067c1.png)

**11.  CONFIGURE IP SUBNET FOR SSL REMOTE VPN**

  
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fvrlvvruo5pcyg55u3tk.png)

**12. CONFIGURE VPN PORTAL**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ifdjf4gm0wt853gruiw.png)


**13. CONFIGURE SSL VPN SETTINGS**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tnypiqnnnsxh75wkhuj.png)
b. CONFIGURE OTHER USER GROUPS TO USE SSLVPN WEB MODE 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zjfj7phluq580znymkum.png)
C.  CONFIGURE SSL_GROUPS TO USE SSLVPN TUNNEL MODE 
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eq0jt6te6g390v8sb0yf.png)

**14. ADD DEFAULT ROUTE FOR ALL THE SUBNETS.**
  **_a.POINT DEFAULT ROUTE FOR SUBNET_A  TO INTERNET GATEWAY (IGW)_**
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sbxcacdundn60zrodq8w.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wgw77cob13zhk44cnnj1.png)



**_b.POINT DEFAULT ROUTE FOR SUBNET_B AND SUBNET_C TO FORTIGATE  ENI._**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/solxm895m3rtw2rr3d8k.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r9jna7w67nk7g88tzk7g.png)



 **_15. CREATE FIREWALL POLICY_**

_a. Create a firewall policy that allows local LAN_1 access to internet ._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f7xt7drsorrbol5lspj5.png)
_b.  Create a firewall policy that allows local LAN_2 access to internet_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b7stfvf3ig9x3kc0xls9.png)

_c. create a firewall policy that allows internet (inbound traffic) access to  LAN_1_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xt7u5uz64c5bq4fqgpc9.png)

_d. create a firewall policy that allows internet (inbound traffic) access to  LAN_2_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nl5ztbvce61c10l58gd8.png)

**16. CONNECT TO AWS SERVICES ON A PRIVATE CLOUD USING SSLVPN WITH FORTICLIENT.**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3vsodd5n3y1dbi4zf79o.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i2iqsbcq5x8udkit3qqy.png)

**17.  LAUNCH AMAZON INSTANCE INSIDE LAN_2 SUBNET**
   
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k2yedztekd3xhocu0jvi.png)




**18. TEST CONNECTIVITY FROM USER PC ON INTERNET TO  AMAZON INSTANCE LAUNCH INSIDE LAN_2 SUBNET**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0v0f8hvm1nknw03zigsg.png)

**19. CONNECT TO AMAZON INSTANCE LAUNCH INSIDE LAN_2 SUBNET AND TEST INTERNET ACCESS**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iz5a8xs2kxreiv2psxdn.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y395nkyrte4tj3zave7a.png)

**CONCLUSION**
This guide outlines a straightforward process for deploying an SSL VPN using FortiGate in the cloud. I trust it will be beneficial as you embark on your deployment journey. Please be aware that utilizing the FortiGate AWS Marketplace will incur charges for both instance usage and software. However, opting for a lower instance type on AWS can help minimize instance costs. Additionally, you can use a trial unit of this product for 30 days without incurring software charges, though AWS infrastructure charges will still be applicable.