I'm trying to route traffic from a kubernetes cluster through a fortigate firewall

Marty Timberlake 0 Reputation points
2023-11-15T20:08:49.15+00:00

I have a load balancer in front of a kubernetes cluster. I installed a Fortigate firewall after the fact. I routed traffic from PIP of the firewall to the PIP for the load balancer. I changed DNS to point to the Fortigate PIP for those sites. So now the traffic flows through as expected, but it goes back out through the load balancer's PIP instead of the firewall. So it goes like this:

PIP Firewall --> PIP Load Balancer --> Kubernetes cluster --> PIP load balancer --> Internet.

So I have asynchronous traffic and I can't fully monitor it.

What I need to have happen is this:
PIP Firewall --> PIP Load Balancer --> AKS Cluster --> Fortigate Firewall --> Internet.

This way I can see the traffic in both directions.

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,952 questions
Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
416 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ammar-Abdelqader01 1,006 Reputation points Microsoft Employee
    2023-11-16T06:48:14.4966667+00:00

    Hello @Marty Timberlake ,

    Thank you for your question, to ensure that the outgoing traffic from AKS go through the Firewall you need to create a UDR with a hop to Azure Firewall.

    The outbound type of UDR requires a route for 0.0.0.0/0 and a next hop destination of NVA in the route table. The route table already has a default 0.0.0.0/0 to the Internet. please check this link .

    make sure you create an appropriate DNAT rule in the Firewall to correctly allow ingress traffic check this link for more information

    Thank you!

    If this has been helpful, please take a moment to accept answers as this helps increase the visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!

    User's image

  2. Adam Zachary 2,876 Reputation points
    2023-11-16T07:02:26.07+00:00

    sorry, duplicated my answer

    0 comments
  3. Adam Zachary 2,876 Reputation points
    2023-11-16T07:13:55.4366667+00:00

    Hi Marty,

    We have a similar setup. along with the route table that @Ammar suggested, and links included in his answer are very helpful. I just thought to share how we configured it;

    To configure the traffic flow as PIP Firewall → PIP Load Balancer → AKS Cluster → Fortigate Firewall → Internet.

    1. Configure Initial Traffic Routing:
      • Ensure that incoming traffic from the internet first hits the Public IP (PIP) of the Fortigate Firewall.
        • Set up the Fortigate Firewall to route this incoming traffic to the Public IP of the Load Balancer.
    2. Load Balancer Configuration:
      • Configure the Load Balancer to forward the traffic to the AKS Cluster.
        • Make sure the Load Balancer is set up with the correct rules to route the traffic to the appropriate services in the AKS cluster.
    3. AKS Cluster Network Configuration:
      • Configure the AKS cluster's network settings to ensure that outbound traffic is directed towards the Fortigate Firewall.
        • This may involve setting up specific routes in the AKS cluster or adjusting the network configuration so that the default route for outbound traffic points to the Fortigate Firewall.
    4. Fortigate Firewall Outbound Configuration:
      • On the Fortigate Firewall, configure the outbound rules to handle traffic coming from the AKS cluster.
        • Set up NAT (Network Address Translation) rules, to translate the internal IP addresses from the AKS cluster to the public IP address of the Fortigate Firewall for outbound traffic to the internet.

    Say, the Load Balancer IP is (x.x.x.x) and the Fortigate Firewall (let's say y.y.y.y)

    Step 1: Configuring the Fortigate Firewall

    Log into the Fortigate Firewall:

    • Access the Fortigate Firewall management console.

    Create a Virtual IP (VIP):

    • Navigate to 'Policy & Objects' > 'Virtual IPs'.
    • Click 'Create New' > 'Virtual IP'.
    • Set the 'External IP Range' to the PIP of the Fortigate Firewall (y.y.y.y).
    • Set the 'Mapped IP Range' to the PIP of the Load Balancer (x.x.x.x).
    • Save the VIP configuration.

    Step 2: Setting Up a Firewall Policy

    Create a New Policy:

    • Go to 'Policy & Objects' > 'IPv4 Policy'.
    • Click 'Create New'.

    Configure the Policy:

    • In 'Incoming Interface', select the interface connected to the internet.
    • In 'Outgoing Interface', select the interface leading to the Load Balancer.
    • For 'Source', select 'all' or specify the desired source addresses.
    • Set 'Destination' to the VIP you created.
    • Set 'Service' to 'ALL' or specific services (like HTTP, HTTPS).
    • Turn 'NAT' on.
    • Save the policy.

    Step 3: Apply Changes

    1. Apply and Save Configuration:
      • Ensure the new configurations are saved and applied.
        • You might need to commit the changes, depending on the Fortigate model.

    Hope this is helpful .