I had a customer over the weekend that has two VPCs (VPC-A and VPC-B). He created a peering connection between the two. VPC-A has a subnet of 10.1.0.0/16 and VPC-B has a 10.2.0.0/16. Normal day-to-day traffic was working fine.
On VPC-A, he has a FortiGate firewall, and an IPsec VPN to a remote vendor with a destination of (10.3.0.0/24).
On the routing instance that the FortiGate uses, he added 10.3.0.0/24 next hop, the FortiGate inside interface. Additionally, there was a route to 10.2.0.0/16 to the peering connection.
Customer was unable to get to the remote VPN (10.3.0.0/24). On the FortiGate, I ran a
diag sniffer packet any 'net 10.3.0.0/24' 4 l 0
to see if I was seeing the packets hitting the FortiGate; I was not.
Log story short, I realized that the peering connector will NOT inject outside routes. In other words, with a peering connector, you can only advertise the 10.1.0.0/16 and the 10.2.0.0/16 between them, all other routes are ignored and dropped.
What we did to fix this
- Created a subnet with the /29
- Created a third interface on the FortiGate and gave it an IP on the
/29subnet. - Created a
transit gateway - Created a
routing table - Created a static route on the FortiGate that to hit
10.2.0.0/16, use the new routing table. - This
transit gatewayis associated with the routing table not the default.
Now all of my traffic destined to 10.2.0.0/16 from the FortiGate will use the Transit Gateway while the two VPC use there peering connection between them. On the VPC-B side, we send traffic destined to 10.3.0.0/24 to the transit gateway.
Once we did this, I could issue the command again….
diag sniffer packet any 'net 10.3.0.0/24' 4 l 0
And I could see the traffic coming IN on port3 (the new port we created) and I could see it going OUT the VPN interface.
Things to know
You pay an hourly rate for every resource (attachment) connected to the Transit Gateway, billed per hour or partial hour consumed.
You pay for the volume of traffic flowing through the Transit Gateway. Billed GB per day
Estimate
Attachment Cost: 2 VPCs×$0.05/hr×730 hrs=$73.00
Data Processing Cost: 100 GB×$0.02/GB=$2.00
Total Estimated TGW Cost: $75.00/month
