solutions/project/hub-env/fortigate/fortigate-ap-primary.yaml [115:198]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            set pre-login-banner enable
            set admintimeout 60
            set timezone 12
        end
        config system admin
            # AC-2(A) - The Fortigates/FortiOS comes with a default local `admin` account.
            edit "admin"
                # DO NOT modify this value, it will be updated with the value in the search-replace-config.yaml
                set password TOKEN_ADMIN_PASSWORD
            next
        end
        config system replacemsg admin "pre_admin-disclaimer-text"
            set buffer "Acceptable Use Policy
        WARNING: This is a private computer system. Unauthorized access or use is prohibited and subject to prosecution and/or disciplinary action. All use of this system constitutes consent to monitoring at all times and users are not entitled to any expectation of privacy. If monitoring reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring reveals violations of security regulations or unauthorized use, employees who violate security regulations or make unauthorized use of this system are subject to appropriate disciplinary action."
        end
        config router static
            edit 10
                set device "port1"
                set gateway 172.31.200.1
            next
            edit 11
              set dst 172.31.200.0/24
              set device "port1"
              set gateway 172.31.200.1
            next
            edit 12
                set dst 35.191.0.0 255.255.0.0
                set comment "health check"
                set gateway 172.31.200.1
                set device "port1"
            next
            edit 13
                set dst 130.211.0.0 255.255.252.0
                set comment "health check"
                set gateway 172.31.200.1
                set device "port1"
            next
            edit 20
              set dst 172.31.201.1/32
              set device "port2"
            next
            edit 21
              set dst 172.31.201.0/24
              set device "port2"
              set gateway 172.31.201.1
            next
            edit 22
                set dst 35.191.0.0 255.255.0.0
                set comment "health check"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 23
                set dst 130.211.0.0 255.255.252.0
                set comment "health check"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 24
                set dst 10.0.0.0 255.0.0.0
                set comment "route to all spokes"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 30
                set dst 172.31.203.1/32
                set device "port3"
            next
            edit 31
              set dst 172.31.203.0/24
              set device "port3"
              set gateway 172.31.203.1
            next
        end
        config system probe-response
            set mode http-probe
            set http-probe-value OK
        end
        config system interface
            # AC-17(100) - The allowaccess setting which enables access to the fortigate is configured to only allow SSH and HTTPS on port4 (mgmt)
            edit port1
                set description "external"
                unset allowaccess
                set mode static
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



solutions/project/hub-env/fortigate/fortigate-ap-secondary.yaml [115:198]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            set pre-login-banner enable
            set admintimeout 60
            set timezone 12
        end
        config system admin
            # AC-2(A) - The Fortigates/FortiOS comes with a default local `admin` account.
            edit "admin"
                # DO NOT modify this value, it will be updated with the value in the search-replace-config.yaml
                set password TOKEN_ADMIN_PASSWORD
            next
        end
        config system replacemsg admin "pre_admin-disclaimer-text"
            set buffer "Acceptable Use Policy
        WARNING: This is a private computer system. Unauthorized access or use is prohibited and subject to prosecution and/or disciplinary action. All use of this system constitutes consent to monitoring at all times and users are not entitled to any expectation of privacy. If monitoring reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring reveals violations of security regulations or unauthorized use, employees who violate security regulations or make unauthorized use of this system are subject to appropriate disciplinary action."
        end
        config router static
            edit 10
                set device "port1"
                set gateway 172.31.200.1
            next
            edit 11
              set dst 172.31.200.0/24
              set device "port1"
              set gateway 172.31.200.1
            next
            edit 12
                set dst 35.191.0.0 255.255.0.0
                set comment "health check"
                set gateway 172.31.200.1
                set device "port1"
            next
            edit 13
                set dst 130.211.0.0 255.255.252.0
                set comment "health check"
                set gateway 172.31.200.1
                set device "port1"
            next
            edit 20
              set dst 172.31.201.1/32
              set device "port2"
            next
            edit 21
              set dst 172.31.201.0/24
              set device "port2"
              set gateway 172.31.201.1
            next
            edit 22
                set dst 35.191.0.0 255.255.0.0
                set comment "health check"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 23
                set dst 130.211.0.0 255.255.252.0
                set comment "health check"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 24
                set dst 10.0.0.0 255.0.0.0
                set comment "route to all spokes"
                set gateway 172.31.201.1
                set device "port2"
            next
            edit 30
                set dst 172.31.203.1/32
                set device "port3"
            next
            edit 31
              set dst 172.31.203.0/24
              set device "port3"
              set gateway 172.31.203.1
            next
        end
        config system probe-response
            set mode http-probe
            set http-probe-value OK
        end
        config system interface
            # AC-17(100) - The allowaccess setting which enables access to the fortigate is configured to only allow SSH and HTTPS on port4 (mgmt)
            edit port1
                set description "external"
                unset allowaccess
                set mode static
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



