-
Notifications
You must be signed in to change notification settings - Fork 0
/
fgtvm3.conf
136 lines (131 loc) · 2.33 KB
/
fgtvm3.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
Content-Type: multipart/mixed; boundary="==AWS=="
MIME-Version: 1.0
--==AWS==
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
config system global
set hostname FGTVM-GWLB2
set admin-sport ${adminsport}
end
config system interface
edit port1
set alias public
set mode dhcp
set allowaccess https ssh
next
edit port2
set alias private
set mode dhcp
set allowaccess ping https ssh fgfm probe-response
set defaultgw disable
next
end
config system probe-response
set mode http-probe
end
config system global
set vdom-mode split-vdom
end
config global
config system interface
edit port2
set vdom FG-traffic
next
end
end
config vdom
edit FG-traffic
config system geneve
edit "gwlb-az2c"
set interface "port2"
set type ppp
set remote-ip ${endpointip}
next
edit "gwlb-az2a"
set interface "port2"
set type ppp
set remote-ip ${endpointip2a}
next
edit "gwlb-az2b"
set interface "port2"
set type ppp
set remote-ip ${endpointip2b}
next
end
config system zone
edit "gwlb-tunnels"
set interface "gwlb-az2a" "gwlb-az2b" "gwlb-az2c"
next
end
config firewall policy
edit 1
set name "http-deny"
set srcintf "gwlb-tunnels"
set dstintf "gwlb-tunnels"
set srcaddr "all"
set dstaddr "all"
set action deny
set schedule "always"
set service "HTTP"
set logtraffic disable
next
edit 2
set name "https-allow"
set srcintf "gwlb-tunnels"
set dstintf "gwlb-tunnels"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
end
config router static
edit 1
set device gwlb-az2a
next
edit 2
set device gwlb-az2b
next
edit 3
set device gwlb-az2c
next
edit 4
set device port2
set dst ${cidr}
set gateway ${gateway}
next
end
config router policy
edit 1
set input-device "gwlb-az2a"
set output-device "gwlb-az2a"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip2a}
next
edit 2
set input-device "gwlb-az2b"
set output-device "gwlb-az2b"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip2b}
next
edit 3
set input-device "gwlb-az2c"
set output-device "gwlb-az2c"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip}
next
end
%{ if type == "byol" }
--==AWS==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="license"
${file(license_file)}
%{ endif }
--==AWS==--