{"id":1938,"date":"2022-03-26T20:27:00","date_gmt":"2022-03-27T04:27:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=1938"},"modified":"2022-08-05T14:49:46","modified_gmt":"2022-08-05T22:49:46","slug":"deploy-ipsec-vpn-site-to-site-between-fortigate-on-aws-on-palo-alto-on-prem","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=1938","title":{"rendered":"Deploy IPSEC VPN site-to-site between FortiGate on AWS and Palo Alto on premises"},"content":{"rendered":"\n<p>This is a diagram to show how to create a VPN site to site connection from PA on-prem and FG on AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"804\" height=\"478\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-62.png\" alt=\"\" class=\"wp-image-2002\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-62.png 804w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-62-300x178.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-62-768x457.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-62-200x119.png 200w\" sizes=\"auto, (max-width: 804px) 100vw, 804px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-61.png\" alt=\"\" class=\"wp-image-2001\" width=\"714\" height=\"319\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-61.png 947w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-61-300x134.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-61-768x343.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-61-200x89.png 200w\" sizes=\"auto, (max-width: 714px) 100vw, 714px\" \/><\/figure>\n\n\n\n<p>In this lab:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Create a VPC, subnets, Internet gateway, route tables.<\/li><li>Create a FortiGate VM and Windows 2016 instance on AWS<\/li><li>Configure Palo Alto<\/li><li>Create VPN site to site between both sites PA and FortiGate<\/li><li>Allow Windows 2016 instance to access the Internet via FortiGate. Also, allow RDP to this machine via the Internet by using FortiGate.<\/li><li>Test ping traffic between both sites.<\/li><li>Allow a machine on the PA LAN subnet to access the Internet and the Windows 2016 instance on AWS.<\/li><li>Create a new SSLVPN portal on AWS and test to access the portal via SSLVPN.<\/li><\/ul>\n\n\n\n<p>+ Below are a couple of steps to deploy FortiGate on AWS.<\/p>\n\n\n\n<p>Create a new VPC.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"790\" height=\"1011\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/1-1.png\" alt=\"\" class=\"wp-image-1866\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/1-1.png 790w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/1-1-234x300.png 234w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/1-1-768x983.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/1-1-156x200.png 156w\" sizes=\"auto, (max-width: 790px) 100vw, 790px\" \/><\/figure>\n\n\n\n<p>Create a public subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"686\" height=\"882\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-63.png\" alt=\"\" class=\"wp-image-2003\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-63.png 686w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-63-233x300.png 233w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-63-156x200.png 156w\" sizes=\"auto, (max-width: 686px) 100vw, 686px\" \/><\/figure>\n\n\n\n<p>Create a private subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"685\" height=\"872\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-64.png\" alt=\"\" class=\"wp-image-2004\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-64.png 685w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-64-236x300.png 236w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-64-157x200.png 157w\" sizes=\"auto, (max-width: 685px) 100vw, 685px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"385\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1-1024x385.png\" alt=\"\" class=\"wp-image-1869\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1-1024x385.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1-300x113.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1-768x289.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1-200x75.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/4-1.png 1121w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create an Internet gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"781\" height=\"717\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/5-1.png\" alt=\"\" class=\"wp-image-1870\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/5-1.png 781w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/5-1-300x275.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/5-1-768x705.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/5-1-200x184.png 200w\" sizes=\"auto, (max-width: 781px) 100vw, 781px\" \/><\/figure>\n\n\n\n<p>Attach the gateway to your VPC.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"465\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-65.png\" alt=\"\" class=\"wp-image-2005\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-65.png 700w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-65-300x199.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-65-200x133.png 200w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p>Edit Route table, change default Route table to Private Route.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"608\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66-1024x608.png\" alt=\"\" class=\"wp-image-2006\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66-1024x608.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66-300x178.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66-768x456.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66-200x119.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-66.png 1234w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create a Public Route Table.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"695\" height=\"723\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-67.png\" alt=\"\" class=\"wp-image-2007\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-67.png 695w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-67-288x300.png 288w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-67-192x200.png 192w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/figure>\n\n\n\n<p>Link the Public Subnet to the Public Route.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"405\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70-1024x405.png\" alt=\"\" class=\"wp-image-2010\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70-1024x405.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70-300x119.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70-768x304.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70-200x79.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-70.png 1327w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Add a new route 0.0.0.0\/0 to your Internet gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"330\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69-1024x330.png\" alt=\"\" class=\"wp-image-2009\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69-1024x330.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69-300x97.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69-768x248.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69-200x64.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-69.png 1290w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create a new key pair.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"691\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-71.png\" alt=\"\" class=\"wp-image-2011\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-71.png 737w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-71-300x281.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-71-200x188.png 200w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><\/figure>\n\n\n\n<p>+ Go to EC2, and deploy Fortinet on AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"691\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1-1024x691.png\" alt=\"\" class=\"wp-image-1878\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1-1024x691.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1-300x202.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1-768x518.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1-200x135.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/13-1.png 1048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"956\" height=\"578\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/14-2.png\" alt=\"\" class=\"wp-image-1879\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/14-2.png 956w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/14-2-300x181.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/14-2-768x464.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/14-2-200x121.png 200w\" sizes=\"auto, (max-width: 956px) 100vw, 956px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"498\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1-1024x498.png\" alt=\"\" class=\"wp-image-1880\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1-1024x498.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1-300x146.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1-768x373.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1-200x97.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/15-1.png 1218w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Select your VPC, the subnet belongs to Lab Public Subnet. Also, changing the Auto-assign Public IP is Enable.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"716\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72-1024x716.png\" alt=\"\" class=\"wp-image-2012\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72-1024x716.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72-768x537.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72-200x140.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-72.png 1112w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"830\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1-1024x830.png\" alt=\"\" class=\"wp-image-1884\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1-1024x830.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1-300x243.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1-768x623.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1-200x162.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/19-1.png 1147w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>On the Security Group tab, add new two lines at the end of Security Group as a screenshot below. This allows to ping and RDP to the Windows 2016 machine on a private subnet later on.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"508\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73-1024x508.png\" alt=\"\" class=\"wp-image-2013\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73-1024x508.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73-300x149.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73-768x381.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73-200x99.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-73.png 1472w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"485\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1-1024x485.png\" alt=\"\" class=\"wp-image-1882\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1-1024x485.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1-300x142.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1-768x364.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1-200x95.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/17-1.png 1423w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"736\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74-1024x736.png\" alt=\"\" class=\"wp-image-2014\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74-1024x736.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74-300x216.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74-768x552.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74-200x144.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-74.png 1153w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"588\" height=\"363\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-75.png\" alt=\"\" class=\"wp-image-2015\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-75.png 588w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-75-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-75-200x123.png 200w\" sizes=\"auto, (max-width: 588px) 100vw, 588px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"575\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76-1024x575.png\" alt=\"\" class=\"wp-image-2016\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76-1024x575.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76-300x168.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76-768x431.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76-200x112.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-76.png 1062w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"595\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79-1024x595.png\" alt=\"\" class=\"wp-image-2019\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79-1024x595.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79-300x174.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79-768x446.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79-200x116.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-79.png 1436w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Go to Network interfaces, change the interface to FG Public Interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"556\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81-1024x556.png\" alt=\"\" class=\"wp-image-2021\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81-1024x556.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81-300x163.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81-768x417.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81-200x109.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-81.png 1452w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create a new FG Private interface. Links to the private subnet and FortiGate Security Group.  <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"757\" height=\"663\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-84.png\" alt=\"\" class=\"wp-image-2024\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-84.png 757w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-84-300x263.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-84-200x175.png 200w\" sizes=\"auto, (max-width: 757px) 100vw, 757px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"754\" height=\"878\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-82.png\" alt=\"\" class=\"wp-image-2022\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-82.png 754w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-82-258x300.png 258w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-82-172x200.png 172w\" sizes=\"auto, (max-width: 754px) 100vw, 754px\" \/><\/figure>\n\n\n\n<p>Change to FG Private Interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"419\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85-1024x419.png\" alt=\"\" class=\"wp-image-2025\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85-1024x419.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85-300x123.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85-768x315.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85-200x82.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-85.png 1282w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Select the FG private interface, choose Action on the top right-hand side and Attach this network interface to Fortinet EC2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"576\" height=\"284\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-86.png\" alt=\"\" class=\"wp-image-2026\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-86.png 576w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-86-300x148.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-86-200x99.png 200w\" sizes=\"auto, (max-width: 576px) 100vw, 576px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"563\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87-1024x563.png\" alt=\"\" class=\"wp-image-2027\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87-1024x563.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87-300x165.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87-768x422.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87-200x110.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-87.png 1455w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Right-click on both FG Public and Private interfaces, and disable &#8220;Change source\/dest check&#8221; on both interfaces to allow NAT traffic on these interfaces.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"614\" height=\"574\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-108.png\" alt=\"\" class=\"wp-image-2048\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-108.png 614w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-108-300x280.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-108-200x187.png 200w\" sizes=\"auto, (max-width: 614px) 100vw, 614px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"575\" height=\"261\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-89.png\" alt=\"\" class=\"wp-image-2029\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-89.png 575w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-89-300x136.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-89-200x91.png 200w\" sizes=\"auto, (max-width: 575px) 100vw, 575px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"564\" height=\"276\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-88.png\" alt=\"\" class=\"wp-image-2028\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-88.png 564w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-88-300x147.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-88-200x98.png 200w\" sizes=\"auto, (max-width: 564px) 100vw, 564px\" \/><\/figure>\n\n\n\n<p>Create a new Elastic IP address.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"787\" height=\"899\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/30-1.png\" alt=\"\" class=\"wp-image-1894\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/30-1.png 787w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/30-1-263x300.png 263w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/30-1-768x877.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/30-1-175x200.png 175w\" sizes=\"auto, (max-width: 787px) 100vw, 787px\" \/><figcaption>Change to Fortinet EIP.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"593\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94-1024x593.png\" alt=\"\" class=\"wp-image-2034\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94-1024x593.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94-300x174.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94-768x444.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94-200x116.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-94.png 1372w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Associate this Elastic IP address to Fortinet EC2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"725\" height=\"735\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-80.png\" alt=\"\" class=\"wp-image-2020\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-80.png 725w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-80-296x300.png 296w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-80-197x200.png 197w\" sizes=\"auto, (max-width: 725px) 100vw, 725px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"677\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1-1024x677.png\" alt=\"\" class=\"wp-image-1897\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1-1024x677.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1-300x198.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1-768x507.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1-200x132.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/35-1.png 1285w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Back to Route tables, add a new route 0.0.0.0\/0 to FG private interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"431\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90-1024x431.png\" alt=\"\" class=\"wp-image-2030\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90-1024x431.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90-300x126.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90-768x323.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90-200x84.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-90.png 1180w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"633\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91-1024x633.png\" alt=\"\" class=\"wp-image-2031\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91-1024x633.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91-768x475.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91-200x124.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-91.png 1369w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Now, Fortinet has two interfaces. One is Private, and another one is Public.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"535\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-1024x535.png\" alt=\"\" class=\"wp-image-2122\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-1024x535.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-300x157.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-768x402.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-1536x803.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182-200x105.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-182.png 1591w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Copy the Elastic IP address and paste it to your web browser to access the FortiGate management interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"630\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93-1024x630.png\" alt=\"\" class=\"wp-image-2033\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93-1024x630.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93-768x472.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93-200x123.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-93.png 1369w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Access Fortinet via the Internet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"560\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95-1024x560.png\" alt=\"\" class=\"wp-image-2035\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95-1024x560.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95-300x164.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95-768x420.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95-200x109.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-95.png 1139w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ Launch a new Windows VM EC2 instance on your VPC. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"781\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96-1024x781.png\" alt=\"\" class=\"wp-image-2036\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96-1024x781.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96-300x229.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96-768x586.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96-200x153.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-96.png 1119w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Network: Your VPC<\/p>\n\n\n\n<p>Subnet: Private subnet<\/p>\n\n\n\n<p>Auto-assign Public IP: Disabled. We will access RDP to the machine via DNAT on FortiGate.<\/p>\n\n\n\n<p>On the Security Group setting, add two lines to allow RDP and ICMP traffic to the machine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"428\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97-1024x428.png\" alt=\"\" class=\"wp-image-2037\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97-1024x428.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97-300x125.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97-768x321.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97-200x84.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-97.png 1461w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"744\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98-1024x744.png\" alt=\"\" class=\"wp-image-2038\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98-1024x744.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98-300x218.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98-768x558.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98-200x145.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-98.png 1146w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"642\" height=\"411\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-99.png\" alt=\"\" class=\"wp-image-2039\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-99.png 642w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-99-300x192.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-99-200x128.png 200w\" sizes=\"auto, (max-width: 642px) 100vw, 642px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1022\" height=\"661\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/39.png\" alt=\"\" class=\"wp-image-1901\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/39.png 1022w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/39-300x194.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/39-768x497.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/39-200x129.png 200w\" sizes=\"auto, (max-width: 1022px) 100vw, 1022px\" \/><\/figure>\n\n\n\n<p>+ Login to Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"688\" height=\"539\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-28.png\" alt=\"\" class=\"wp-image-1954\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-28.png 688w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-28-300x235.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-28-200x157.png 200w\" sizes=\"auto, (max-width: 688px) 100vw, 688px\" \/><\/figure>\n\n\n\n<p>Copy the FG instance and paste it to password login.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"639\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100-1024x639.png\" alt=\"\" class=\"wp-image-2040\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100-1024x639.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100-300x187.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100-768x479.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100-200x125.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-100.png 1289w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1007\" height=\"618\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-101.png\" alt=\"\" class=\"wp-image-2041\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-101.png 1007w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-101-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-101-768x471.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-101-200x123.png 200w\" sizes=\"auto, (max-width: 1007px) 100vw, 1007px\" \/><\/figure>\n\n\n\n<p>Change the password to login to Fortinet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102-1024x693.png\" alt=\"\" class=\"wp-image-2042\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102-1024x693.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102-300x203.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102-768x520.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102-200x135.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-102.png 1074w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"532\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-1024x532.png\" alt=\"\" class=\"wp-image-2043\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-1024x532.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-300x156.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-768x399.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-1536x798.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103-200x104.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-103.png 1599w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Edit WAN and LAN interface setting.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"874\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104-1024x874.png\" alt=\"\" class=\"wp-image-2044\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104-1024x874.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104-300x256.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104-768x655.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104-200x171.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-104.png 1064w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"883\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105-1024x883.png\" alt=\"\" class=\"wp-image-2045\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105-1024x883.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105-300x259.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105-768x662.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105-200x172.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-105.png 1051w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"482\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106-1024x482.png\" alt=\"\" class=\"wp-image-2046\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106-1024x482.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106-300x141.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106-768x362.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106-200x94.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-106.png 1506w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Back to Fortinet to configure Firewall Policy to allow RDP traffic from the Internet to the Windows VM machine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109-1024x627.png\" alt=\"\" class=\"wp-image-2049\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109-1024x627.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109-768x470.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109-200x122.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-109.png 1403w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Configure port forwarding to allow traffic from the Internet to Windows 2016 VM instance on AWS.<\/p>\n\n\n\n<p>External IP address: IP address of FG on the public subnet<\/p>\n\n\n\n<p>Map to IPv4 address on the private subnet is IP address of Windows VM computer.<\/p>\n\n\n\n<p>The external service port and map to IPv4 port is 3389.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"728\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111-1024x728.png\" alt=\"\" class=\"wp-image-2051\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111-1024x728.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111-300x213.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111-768x546.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111-200x142.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-111.png 1059w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"314\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112-1024x314.png\" alt=\"\" class=\"wp-image-2052\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112-1024x314.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112-300x92.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112-768x236.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112-200x61.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-112.png 1449w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Allow inbound traffic from WAN to this machine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"880\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113-1024x880.png\" alt=\"\" class=\"wp-image-2053\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113-1024x880.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113-300x258.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113-768x660.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113-200x172.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-113.png 1051w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create both static routes to allow a private subnet to access outside.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"836\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114-1024x836.png\" alt=\"\" class=\"wp-image-2054\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114-1024x836.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114-300x245.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114-768x627.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114-200x163.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-114.png 1041w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"681\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115-1024x681.png\" alt=\"\" class=\"wp-image-2055\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115-1024x681.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115-300x200.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115-768x511.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115-200x133.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-115.png 1075w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Creating new static routes for the private subnet from 10.0.0.0\/16 to 10.0.1.1 that is the default gateway on the private subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"548\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116-1024x548.png\" alt=\"\" class=\"wp-image-2056\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116-1024x548.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116-300x161.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116-768x411.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116-200x107.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-116.png 1222w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Try to access the machine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"741\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117-1024x741.png\" alt=\"\" class=\"wp-image-2057\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117-1024x741.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117-300x217.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117-768x555.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117-200x145.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-117.png 1091w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Load private key to decrypt Windows password.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"874\" height=\"801\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-118.png\" alt=\"\" class=\"wp-image-2058\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-118.png 874w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-118-300x275.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-118-768x704.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-118-200x183.png 200w\" sizes=\"auto, (max-width: 874px) 100vw, 874px\" \/><\/figure>\n\n\n\n<p>Access RDP to Windows 2016 instance on AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"637\" height=\"493\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/72-1.png\" alt=\"\" class=\"wp-image-1931\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/72-1.png 637w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/72-1-300x232.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/72-1-200x155.png 200w\" sizes=\"auto, (max-width: 637px) 100vw, 637px\" \/><\/figure>\n\n\n\n<p>Now we can see the RDP traffic via Fortinet. <\/p>\n\n\n\n<p>Disable Windows Firewall to allow ICMP traffic to that machine on Palo Alto private subnet. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"878\" height=\"536\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-119.png\" alt=\"\" class=\"wp-image-2059\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-119.png 878w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-119-300x183.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-119-768x469.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-119-200x122.png 200w\" sizes=\"auto, (max-width: 878px) 100vw, 878px\" \/><\/figure>\n\n\n\n<p>Configure IPSEC site to site wizard. Choose Custom.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"855\" height=\"664\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-120.png\" alt=\"\" class=\"wp-image-2060\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-120.png 855w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-120-300x233.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-120-768x596.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-120-200x155.png 200w\" sizes=\"auto, (max-width: 855px) 100vw, 855px\" \/><\/figure>\n\n\n\n<p>Enter IP address of public interface of PA. Disable NAT traversal, enter the pre-shared key and choose the IKE v2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"832\" height=\"476\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-121.png\" alt=\"\" class=\"wp-image-2061\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-121.png 832w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-121-300x172.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-121-768x439.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-121-200x114.png 200w\" sizes=\"auto, (max-width: 832px) 100vw, 832px\" \/><\/figure>\n\n\n\n<p>Phase 1 and Phase 2 settings need to match with the Palo Alto setting.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"851\" height=\"597\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-122.png\" alt=\"\" class=\"wp-image-2062\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-122.png 851w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-122-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-122-768x539.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-122-200x140.png 200w\" sizes=\"auto, (max-width: 851px) 100vw, 851px\" \/><\/figure>\n\n\n\n<p>Local Address: the private subnet of FG: 10.0.1.0\/24<\/p>\n\n\n\n<p>Remote Address: PA LAN subnets: 172.16.0.0\/16<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"699\" height=\"799\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-123.png\" alt=\"\" class=\"wp-image-2063\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-123.png 699w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-123-262x300.png 262w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-123-175x200.png 175w\" sizes=\"auto, (max-width: 699px) 100vw, 699px\" \/><\/figure>\n\n\n\n<p>Click the Advanced tab. Change the setting to match with PA Phase 2 setting<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"709\" height=\"609\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-124.png\" alt=\"\" class=\"wp-image-2064\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-124.png 709w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-124-300x258.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-124-200x172.png 200w\" sizes=\"auto, (max-width: 709px) 100vw, 709px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"328\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125-1024x328.png\" alt=\"\" class=\"wp-image-2065\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125-1024x328.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125-300x96.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125-768x246.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125-200x64.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-125.png 1409w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create Fortinet LAN and PA LAN subnet network addresses.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"528\" height=\"296\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-129.png\" alt=\"\" class=\"wp-image-2069\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-129.png 528w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-129-300x168.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-129-200x112.png 200w\" sizes=\"auto, (max-width: 528px) 100vw, 528px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"563\" height=\"345\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-130.png\" alt=\"\" class=\"wp-image-2070\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-130.png 563w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-130-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-130-200x123.png 200w\" sizes=\"auto, (max-width: 563px) 100vw, 563px\" \/><\/figure>\n\n\n\n<p>Create a static route on Fortinet to allow private subnet traffic to the Palo Alto LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"696\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-127.png\" alt=\"\" class=\"wp-image-2067\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-127.png 1023w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-127-300x204.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-127-768x523.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-127-200x136.png 200w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"263\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128-1024x263.png\" alt=\"\" class=\"wp-image-2068\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128-1024x263.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128-300x77.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128-768x197.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128-200x51.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-128.png 1238w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create a Security Policy to allow traffic from the Fortinet LAN subnet to the PA LAN subnet. Remember to uncheck NAT setting on access rules from AWS LAN to PA LAN and vice versa.<\/p>\n\n\n\n<p>PA LAN subnet to AWS LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1011\" height=\"878\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-131.png\" alt=\"\" class=\"wp-image-2071\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-131.png 1011w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-131-300x261.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-131-768x667.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-131-200x174.png 200w\" sizes=\"auto, (max-width: 1011px) 100vw, 1011px\" \/><\/figure>\n\n\n\n<p>AWS LAN subnet to PA LAN subnet. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"884\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-132.png\" alt=\"\" class=\"wp-image-2072\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-132.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-132-300x259.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-132-768x663.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-132-200x173.png 200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"477\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2-1024x477.png\" alt=\"\" class=\"wp-image-1957\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2-1024x477.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2-300x140.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2-768x358.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2-200x93.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/65-2.png 1526w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"278\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-1024x278.png\" alt=\"\" class=\"wp-image-2073\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-1024x278.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-300x81.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-768x208.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-1536x417.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133-200x54.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-133.png 1610w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Create a new access rule to allow the FG LAN subnet to access the Internet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"852\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168-1024x852.png\" alt=\"\" class=\"wp-image-2108\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168-1024x852.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168-300x250.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168-768x639.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168-200x166.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-168.png 1050w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Ping 8.8.8.8 from Windows 2016 VM instance.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"740\" height=\"567\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-169.png\" alt=\"\" class=\"wp-image-2109\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-169.png 740w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-169-300x230.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-169-200x153.png 200w\" sizes=\"auto, (max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<p>+ Configure PA.<\/p>\n\n\n\n<p>Setting the IP address for e1\/1 is DHCP, and assign an IP address for e1\/2 is 172.16.1.254\/24<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"941\" height=\"615\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-134.png\" alt=\"\" class=\"wp-image-2074\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-134.png 941w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-134-300x196.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-134-768x502.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-134-200x131.png 200w\" sizes=\"auto, (max-width: 941px) 100vw, 941px\" \/><\/figure>\n\n\n\n<p>Create a tunnel interface: tunnel 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"869\" height=\"565\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-135.png\" alt=\"\" class=\"wp-image-2075\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-135.png 869w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-135-300x195.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-135-768x499.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-135-200x130.png 200w\" sizes=\"auto, (max-width: 869px) 100vw, 869px\" \/><\/figure>\n\n\n\n<p>Create network objects for FortiGate, PA LAN, and AWS LAN.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"944\" height=\"384\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-142.png\" alt=\"\" class=\"wp-image-2082\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-142.png 944w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-142-300x122.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-142-768x312.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-142-200x81.png 200w\" sizes=\"auto, (max-width: 944px) 100vw, 944px\" \/><\/figure>\n\n\n\n<p>Create IKEC Crypto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"982\" height=\"568\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-136.png\" alt=\"\" class=\"wp-image-2076\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-136.png 982w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-136-300x174.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-136-768x444.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-136-200x116.png 200w\" sizes=\"auto, (max-width: 982px) 100vw, 982px\" \/><\/figure>\n\n\n\n<p>Create an IPSEC Crypto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"950\" height=\"558\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-138.png\" alt=\"\" class=\"wp-image-2078\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-138.png 950w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-138-300x176.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-138-768x451.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-138-200x117.png 200w\" sizes=\"auto, (max-width: 950px) 100vw, 950px\" \/><\/figure>\n\n\n\n<p>IKE Gateway.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"827\" height=\"644\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-146.png\" alt=\"\" class=\"wp-image-2086\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-146.png 827w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-146-300x234.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-146-768x598.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-146-200x156.png 200w\" sizes=\"auto, (max-width: 827px) 100vw, 827px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"836\" height=\"573\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-145.png\" alt=\"\" class=\"wp-image-2085\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-145.png 836w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-145-300x206.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-145-768x526.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-145-200x137.png 200w\" sizes=\"auto, (max-width: 836px) 100vw, 836px\" \/><\/figure>\n\n\n\n<p>IPSEC tunnel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"915\" height=\"506\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-147.png\" alt=\"\" class=\"wp-image-2087\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-147.png 915w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-147-300x166.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-147-768x425.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-147-200x111.png 200w\" sizes=\"auto, (max-width: 915px) 100vw, 915px\" \/><\/figure>\n\n\n\n<p>On Proxy ID tab.<\/p>\n\n\n\n<p>Local: PA LAN subnets.<\/p>\n\n\n\n<p>Remote: AWS LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"607\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-140.png\" alt=\"\" class=\"wp-image-2080\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-140.png 900w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-140-300x202.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-140-768x518.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-140-200x135.png 200w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>Create a Static Route from PA LAN to Fortinet LAN on AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"906\" height=\"662\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-141.png\" alt=\"\" class=\"wp-image-2081\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-141.png 906w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-141-300x219.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-141-768x561.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-141-200x146.png 200w\" sizes=\"auto, (max-width: 906px) 100vw, 906px\" \/><\/figure>\n\n\n\n<p>Create both Security Policies to allow traffic from PA LAN subnet to AWS LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"570\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143-1024x570.png\" alt=\"\" class=\"wp-image-2083\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143-1024x570.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143-300x167.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143-768x427.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143-200x111.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-143.png 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Remember to click &#8220;Commit&#8221; button to apply the new settings on PA.<\/p>\n\n\n\n<p>From Windows 2016 VM instance, pings a machine on PA LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"697\" height=\"515\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-148.png\" alt=\"\" class=\"wp-image-2088\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-148.png 697w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-148-300x222.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-148-200x148.png 200w\" sizes=\"auto, (max-width: 697px) 100vw, 697px\" \/><\/figure>\n\n\n\n<p> + Pings from PA LAN subnet to AWS LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"666\" height=\"400\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-149.png\" alt=\"\" class=\"wp-image-2089\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-149.png 666w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-149-300x180.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-149-200x120.png 200w\" sizes=\"auto, (max-width: 666px) 100vw, 666px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"595\" height=\"465\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-150.png\" alt=\"\" class=\"wp-image-2090\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-150.png 595w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-150-300x234.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-150-200x156.png 200w\" sizes=\"auto, (max-width: 595px) 100vw, 595px\" \/><\/figure>\n\n\n\n<p>On PA, a tunnel is up.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1005\" height=\"465\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-151.png\" alt=\"\" class=\"wp-image-2091\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-151.png 1005w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-151-300x139.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-151-768x355.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-151-200x93.png 200w\" sizes=\"auto, (max-width: 1005px) 100vw, 1005px\" \/><\/figure>\n\n\n\n<p>Monitoring to see the traffic on both sites.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"919\" height=\"662\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-152.png\" alt=\"\" class=\"wp-image-2092\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-152.png 919w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-152-300x216.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-152-768x553.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-152-200x144.png 200w\" sizes=\"auto, (max-width: 919px) 100vw, 919px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"600\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153-1024x600.png\" alt=\"\" class=\"wp-image-2093\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153-1024x600.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153-300x176.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153-768x450.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153-200x117.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-153.png 1036w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>On FortiGate.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"416\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-1024x416.png\" alt=\"\" class=\"wp-image-2107\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-1024x416.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-300x122.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-768x312.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-1536x624.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167-200x81.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-167.png 1605w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>An IPSEC VPN site-to-site tunnel is up.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"401\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155-1024x401.png\" alt=\"\" class=\"wp-image-2095\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155-1024x401.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155-300x117.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155-768x301.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155-200x78.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-155.png 1494w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"381\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-1024x381.png\" alt=\"\" class=\"wp-image-2121\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-1024x381.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-300x112.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-768x286.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-1536x571.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181-200x74.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-181.png 1595w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>diagnose vpn tunnel list<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"480\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165-1024x480.png\" alt=\"\" class=\"wp-image-2105\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165-1024x480.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165-300x141.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165-768x360.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165-200x94.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-165.png 1300w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Click on the log and Report to see events that are related to VPN.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"560\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-1024x560.png\" alt=\"\" class=\"wp-image-2096\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-1024x560.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-300x164.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-768x420.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-1536x839.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156-200x109.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-156.png 1605w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ Back to PA to create another static route to allow the PA LAN subnet to access the Internet.<\/p>\n\n\n\n<p>A next hop is the default gateway of the PA public subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"913\" height=\"694\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-161.png\" alt=\"\" class=\"wp-image-2101\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-161.png 913w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-161-300x228.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-161-768x584.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-161-200x152.png 200w\" sizes=\"auto, (max-width: 913px) 100vw, 913px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"926\" height=\"650\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-160.png\" alt=\"\" class=\"wp-image-2100\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-160.png 926w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-160-300x211.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-160-768x539.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-160-200x140.png 200w\" sizes=\"auto, (max-width: 926px) 100vw, 926px\" \/><\/figure>\n\n\n\n<p>Create a SNAT policy to allow traffic from the PA LAN subnet to the Internet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"742\" height=\"343\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-163.png\" alt=\"\" class=\"wp-image-2103\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-163.png 742w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-163-300x139.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-163-200x92.png 200w\" sizes=\"auto, (max-width: 742px) 100vw, 742px\" \/><\/figure>\n\n\n\n<p>On the Destination interface, should choose e1\/1. This is because VPN site-to-site traffic does not use NAT.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"611\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-162.png\" alt=\"\" class=\"wp-image-2102\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-162.png 934w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-162-300x196.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-162-768x502.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-162-200x131.png 200w\" sizes=\"auto, (max-width: 934px) 100vw, 934px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"914\" height=\"519\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-164.png\" alt=\"\" class=\"wp-image-2104\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-164.png 914w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-164-300x170.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-164-768x436.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-164-200x114.png 200w\" sizes=\"auto, (max-width: 914px) 100vw, 914px\" \/><\/figure>\n\n\n\n<p>Ping 8.8.8.8 from PA LAN subnet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"775\" height=\"477\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-166.png\" alt=\"\" class=\"wp-image-2106\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-166.png 775w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-166-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-166-768x473.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-166-200x123.png 200w\" sizes=\"auto, (max-width: 775px) 100vw, 775px\" \/><\/figure>\n\n\n\n<p>+ Create an SSLVPN portal on FortiGate to allow to access FG private subnet on the SSLVPN zone.<\/p>\n\n\n\n<p>RDP to Windows 2016 instance private subnet on AWS is 10.0.1.42<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"864\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170-1024x864.png\" alt=\"\" class=\"wp-image-2110\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170-1024x864.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170-300x253.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170-768x648.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170-200x169.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-170.png 1042w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>On SSLVPN setting, enable SSLVPN via 44333 port.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1003\" height=\"702\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-171.png\" alt=\"\" class=\"wp-image-2111\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-171.png 1003w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-171-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-171-768x538.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-171-200x140.png 200w\" sizes=\"auto, (max-width: 1003px) 100vw, 1003px\" \/><\/figure>\n\n\n\n<p>Create a new username and password to access SSLVPN.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"187\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-172.png\" alt=\"\" class=\"wp-image-2112\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-172.png 737w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-172-300x76.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-172-200x51.png 200w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><\/figure>\n\n\n\n<p>Then assign this user to the portal that we have created on previous step.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"579\" height=\"204\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-173.png\" alt=\"\" class=\"wp-image-2113\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-173.png 579w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-173-300x106.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-173-200x70.png 200w\" sizes=\"auto, (max-width: 579px) 100vw, 579px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"886\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-174.png\" alt=\"\" class=\"wp-image-2114\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-174.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-174-300x260.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-174-768x665.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-174-200x173.png 200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Edit the Security Group to allow Internet traffic to SSLVPN port is 44333.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"604\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-1024x604.png\" alt=\"\" class=\"wp-image-2115\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-1024x604.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-300x177.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-768x453.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-1536x905.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175-200x118.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-175.png 1581w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>From a Windows machine, access SSLVPN portal on FG.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-176.png\" alt=\"\" class=\"wp-image-2116\" width=\"555\" height=\"332\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-176.png 796w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-176-300x179.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-176-768x459.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-176-200x120.png 200w\" sizes=\"auto, (max-width: 555px) 100vw, 555px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-177.png\" alt=\"\" class=\"wp-image-2117\" width=\"491\" height=\"365\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-177.png 740w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-177-300x223.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-177-200x149.png 200w\" sizes=\"auto, (max-width: 491px) 100vw, 491px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-179.png\" alt=\"\" class=\"wp-image-2119\" width=\"501\" height=\"435\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-179.png 644w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-179-300x260.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-179-200x174.png 200w\" sizes=\"auto, (max-width: 501px) 100vw, 501px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-178.png\" alt=\"\" class=\"wp-image-2118\" width=\"577\" height=\"346\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-178.png 812w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-178-300x180.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-178-768x461.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-178-200x120.png 200w\" sizes=\"auto, (max-width: 577px) 100vw, 577px\" \/><\/figure>\n\n\n\n<p>Also, we can use Forticlient to access if we have a license.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"894\" height=\"618\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-180.png\" alt=\"\" class=\"wp-image-2120\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-180.png 894w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-180-300x207.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-180-768x531.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/03\/image-180-200x138.png 200w\" sizes=\"auto, (max-width: 894px) 100vw, 894px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This is a diagram to show how to create a VPN site to site connection from PA on-prem and FG on AWS. In this lab: Create a VPC, subnets, Internet gateway, route tables. Create a FortiGate VM and Windows 2016 instance on AWS Configure Palo Alto Create VPN site to site between both sites PA [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,3,21],"tags":[20,14,18],"class_list":["post-1938","post","type-post","status-publish","format-standard","hentry","category-cloud","category-fortigate","category-palo-alto","tag-cloud","tag-fortinet","tag-palo-alto"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1938"}],"version-history":[{"count":6,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1938\/revisions"}],"predecessor-version":[{"id":3978,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1938\/revisions\/3978"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}