Cloud WAN

• An IAM role in the Permissions section
• Acknowledge the warnings in the Capabilities section
• then scroll down and click Create stack

3.1: In the Network Manager Console navigate to the Policy versions page for your Core Network and select the only policy version and click Edit.

3.2: Select the Segments tab and notice the existing segments. You should see three segments (firewall, production, and development).

3.3: Select the Segments actions tab then find the Sharing section and click Create. Use the table below to create the sharing rules need.

3.4: Next, select the Attachment policies tab then find the Attachment policies section and click Create. Use the table below to create the sharing rules need. Here is an example of the first rule.

3.5: Once completed, you should see these attachment policies. Next, click Create policy.

3.6: You should be back on the Policy versions page with a new policy version showing. Once Policy version - 2 shows Ready to execute, select the version and click View or apply change set.

3.7: On the next page click Apply change set. You will be returned to the Policy version page and see the new policy version is executing. In a few moments this will show as Execution succeeded.

4.1: Navigate to the attachments page under your Core Network. Select the CWAN-security-connect-attachment and view the Details tab. Notice the segment and attachment policy rule number are now populated. The table below should match what your environment looks like after applying the correct Core Network Policy. Select the other attachments to verify the results.

4.2: Navigate to the main Core network page for your Core Network. Select the Routes tab and in the route filter, select a segment and edge location and click Search routes. You should eventually see routes matching the table below. Notice, the default route is an ECMP route received from both FGTs through the connect attachment.

4.2: Login to FortiGate1, using the outputs FGT1LoginURL, Username, and Password.

4.4: Upon login in the upper right-hand corner click on the >_ icon to open a CLI session.

4.8: Run the command get router info bgp summary and notice State/PfxRcd is now showing four routes received.

4.9: Run the command get router info bgp neighbors <peer-ip> routes for each BGP neighbor and notice four routes are received from Cloud WAN. Notice that the Next Hop address is the IP of the Core Network attachment CWAN-security-vpc-attachment in the same subnet as port2 of FortiGate1.

4.10: Run the command get router info routing-table all and notice there is a static route for 100.64.0.0/24 & 10.0.0.0/16 out port2. This allows the FGTs to BGP directly with the Core Network Edge (CNE) and use FGSP between each FGT.

4.11: Navigate to the EC2 Console and connect to Instance-A using the Serial Console directions

• Password: FORTInet123!

4.12: Run the following commands to test connectivity and make sure the results match expectations

5.1 Notice that Instance-A can access Instance-B over HTTP but could not access Instance-C, however pings were successful. This is because Instance-A and Instance-B are in VPCs attached to the production segment which is configured as a shared routing domain by default. This allows anything attached to the same segment to communicate bidirectionally. This means anything in VPC A can reach VPC B without being sent through the FGTs in the inspection VPC which is in the firewall segment.

5.2 VPC C is in the development segment so when VPC A reaches out to this destination, the routes for the production segment first forwards traffic to the FGTs in the inspection VPC (via 0.0.0.0/0 to Connect attachments). This allowed the FGTs to enforce FW policy that blocked HTTP access from VPC A to VPC C but allowed pings between the different segments.

5.3 Segments can be configured to be isolated so that resources attached to the same segment can’t communicate directly. Through the Core Network Policy you can still allow access to specific routes or other segments explicitly.

5.4 In the Network Manager Console navigate to the Policy versions page select ‘Policy version - 2’ and click Edit.

5.5 Select the Segments tab, select the production segment and click Edit.

5.6 On the Edit segment page, check the box for Isolated attachments and click Edit Segment, then on the next page click Create Policy.

5.7 You should be back on the Policy versions page with a new policy version showing. Once Policy version - 3 shows Ready to execute, select the version and click View or apply change set.

5.8 On the next page click Apply change set. You will be returned to the Policy version page and see the new policy version is executing. In a few moments this will show as Execution succeeded.

5.9: Navigate back to the EC2 Console and connect to Instance-A using the Serial Console directions

• Password: FORTInet123!

5.10: Run the following commands to test connectivity again and make sure the results match expectations

• HTTP should now be block by the FW policy on the FGTs for VPC B and C but Pings allowed

5.11 Navigate back to the main Core network page for your Core Network. Select the Routes tab and in the route filter, select the production segment and edge location and click Search routes. You should eventually see routes matching the table below. The production segment now does not automatically share routes for attachments.