Deploy a single BYOL FortiGate in IBM Cloud using the Schematics service.
Note: For a local deployment a Gen 2 API key will be needed. For details see: IBM Gen 2 API key
This deployment requires that you already have the following already configured:
- Terraform 0.13+
- A VPC with two subnets in a single zone
- A configured IBM SSH key
- A public gateway attached to the public subnet (its ID is a required input)
Terraform deploys the following components:
- A FortiGate BYOL instance with two NICs, one in each subnet
- A Floating Public IP address attached to the FortiGate
- A Logging disk
The template creates and attaches two security groups — no pre-existing security group is required.
| Security group | Attached to | Direction | Protocol / Port | Remote | Purpose |
|---|---|---|---|---|---|
| Public | Port1 (external) | Inbound | TCP 443 | 0.0.0.0/0 |
HTTPS admin GUI access (see Note below) |
| Inbound | All | Same security group | Traffic between cluster members | ||
| Outbound | UDP 53 | 0.0.0.0/0 |
FortiGuard DNS & SDNS queries | ||
| Outbound | TCP 443 | 0.0.0.0/0 |
Licensing, FortiCare & IBM SDN connector | ||
| Outbound | TCP 8890 | 0.0.0.0/0 |
FortiGuard distribution updates | ||
| Private | Port2 (internal) | Inbound | All | Same security group | Private subnet security group |
| Outbound | All | Same security group | Private subnet security group |
Note: The inbound HTTPS rule is open to
0.0.0.0/0to allow initial access to the admin GUI. After initial configuration, it is recommended to lock the rule's remote down to a trusted host or CIDR.
-
Fill in the required VPC, Subnet and ssh key values as shown below:
Note For Subnets, put the UUID of the subnet. Not the name
-
Apply the Plan.
-
Outputs, such as the Public IP and Default username and password can be found under the
View Loglink.
See below for info on destroying the cluster.
Deploying This package from IBM Schematics is possible. To do so navigate to the Repo at https://github.com/fortinet/ibm-fortigate-terraform-deploy and follow the steps below:
-
From the IBM console navitagte to Schematics.
-
Fill in the workspace info and create your workspace.
-
Copy the repo URL into repository URL field and then select Terraform version 0.13.
-
Add in and adjust any Variables as needed in the settings.
-
Apply the plan.
-
Outputs, such as the Public IP and Default username and password can be found under the
View Loglink.
To destroy the cluster, click on Actions...->Destroy
Fortinet-provided scripts in this and other GitHub projects do not fall under the regular Fortinet technical support scope and are not supported by FortiCare Support Services. For direct issues, please refer to the Issues tab of this GitHub project. For other questions related to this project, contact github@fortinet.com.
License © Fortinet Technologies. All rights reserved.