Technical Note: FortiGate instance on Amazon AWS EC2 is repeatedly rebooting

[Vbharath_FTNT]

Description

FortiGate instance on Amazon AWS can go in to a reboot loop with specific design/configuration.

Scope

FortiGate, Amazon AWS EC2

Solution

In some cases this may be due to the instance being placed behind a load balancer or another Layer 3 device which would point the default route to an IP address different from the AWS router.  This may lead to the instance going into a reboot loop.

The FortiGate instance on Amazon AWS should be reachable to any of the intrinsic router in AWS VPC subnets configured.

The intrinsic router is the first useable IP address of a VPC subnet.

To fix this issue:

Configure at least one default route on the FortiGate instance pointing to AWS router.

Or

Configure a static route "169.254.169.254" on any configured interface with gateway set to AWS router.

169.254.169.254 is the Amazon EC2 internal IP, the instances use this IP to access various metadata.

Configuration CLI

config router static
edit <id>
set dst 169.254.169.254 255.255.255.255
set gateway x.x.x.x       ----> AWS router IP
set device <interface name>
end