We have one FortiGate-VM in AWS today and are adding a second. Each appliance will establish an IPsec tunnel back to our corporate office. We want traffic and routing to switch automatically to the surviving FortiGate if one EC2 instance fails. Is there an AWS-native feature for this, or should we use something such as BGP or IP SLA?
3 Answers
Use FortiGate’s AWS active-passive high-availability deployment rather than trying to build the failover entirely with AWS routing features. When configured correctly, the HA setup can move the relevant ENI and update the route-table entry when the active appliance fails, allowing traffic to use the standby automatically.
Treat this as a FortiGate HA design integrated with AWS, not as a generic AWS mechanism. Follow Fortinet’s AWS active-passive HA deployment guidance and verify that the failover process handles the ENI, route-table changes, and IPsec tunnel recovery as expected.
For stronger resilience, place the two FortiGate instances in separate Availability Zones where the design permits it. Also check whether the underlying AWS connectivity has separate failure domains or transit paths; putting both appliances in different zones alone may not protect against every shared dependency.
There may be a short convergence window while AWS updates the software-defined network, since this does not behave exactly like gratuitous ARP on a physical switch. Tune IPsec dead-peer-detection timers on both sides so the corporate firewall detects tunnel changes promptly.