Request for Active-Passive Firewall Automation Solution on AWS

Question

Hi,

In my network account, we have deployed multi-AZ Fortinet firewalls, and all traffic passes through both firewalls. However, my customer wants an active-passive firewall setup and wants this to be automated on the AWS side. The internet-facing ALB has a target group attached to these firewalls, and I want the traffic to pass through only one firewall EC2 instance. If that instance becomes unhealthy, the traffic should automatically switch to another instance. Is this possible? Please suggest a solution.

AWSAmir · Accepted Answer

Hi Akshay,
Before proposing and implementing a solution it is worth investigating requirements and understand why there is a requirement to have an active-passive setup?

Fortinet themselves have 2 flavors published here - one for active-active (current) and another for active-passive (deprecated, as they note), see https://github.com/fortinet/aws-cloudformation-templates
Also take a look here - https://github.com/40net-cloud/fortinet-aws-solutions/tree/master/FortiGate, this repo is maintained by Fortinet's EMEA team.

You may want to look at both, compare and see if these are applicable/compatible.

Request for Active-Passive Firewall Automation Solution on AWS

Relevant content