Deployment example – OpenXen

Once you have downloaded the FORTINET.out.OpenXen.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your OpenXen environment.

The following topics are included in this section:

Create the FortiGate VM virtual machine (VMM)

Create the FortiGate VM virtual machine (VMM)

To create the FortiGate VM virtual machine:

1. Launch Virtual Machine Manager (virt-manager) on your OpenXen host server.

The Virtual Machine Manager home page opens.

2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example.
4. Ensure that Connection is localhost. (This is the default.)
5. Select Import existing disk image.

6.

7. In OS Type select Linux.
8. In Version, select Generic 2.4.x.kernel.
9. Select Browse.

The Locate or create storage volume window opens.

10. Select Browse Local, find the fortios.qcow2 disk image file.
11. Select fortios.qcow2 and select Choose Volume.

12.

13. Specify the amount of memory and number of CPUs to allocate to this virtual machine. The amounts must not exceed your license limits.

14.

15. Select Customize configuration before install. This enables you to make some hardware configuration changes before VM creation is started.
16. Expand Advanced options. A new virtual machine includes one network adapter by default. Select Specify shared device name and enter the name of the bridge interface on the OpenXen host. Optionally, set a specific MAC address for the virtual network interface. Virt Type and Architecture are set by default and should be correct.
17. Select Finish.

The virtual machine hardware configuration window opens.

You can use this window to add hardware such as network interfaces and disk drives.

18. Select Add Hardware. In the Add Hardware window select Storage.
19. Select Create a disk image on the computer’s harddrive and set the size to 30GB.
20. Enter:

21. Select Network to configure add more the network interfaces. The Device type must be Virtio.

A new virtual machine includes one network adapter by default. You can add more through the Add Hardware window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer.

22. Select Finish.
23. Select Begin Installation. After the installation completes successfully, the VM starts and the console window opens.

(XenCenter)

Deployment example – KVM

Once you have downloaded the FORTINET.out.kvm.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your KVM environment.

The following topics are included in this section:

Create the FortiGate VM virtual machine

Configure FortiGate VM hardware settings

Start the FortiGate VM

Create the FortiGate VM virtual machine

To create the FortiGate VM virtual machine:

1. Launch Virtual Machine Manager (virt-manager) on your KVM host server.

The Virtual Machine Manager home page opens.

2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example.
4. Ensure that Connection is localhost. (This is the default.)
5. Select Import existing disk image.

KVM                                                                       Create the FortiGate VM virtual machine

6. Forward.
7. In OS Type select Linux.
8. In Version, select a Generic version with virtio.

Configure                       hardware settings                                                                    Deployment example – KVM

9. Select Browse.
10. If you copied the fortios.qcow2 file to /var/lib/libvirt/images, it will be visible on the right. If you saved it somewhere else on your server, select Browse Local and find it.
11. Choose Choose Volume.
12. Select Forward.
13. Specify the amount of memory and number of CPUs to allocate to this virtual machine. The amounts must not exceed your license limits. See FortiGate VM Overview on page 10.
14. Select Forward.
15. Expand Advanced options. A new virtual machine includes one network adapter by default. Select a network adapter on the host computer. Optionally, set a specific MAC address for the virtual network interface. Set Virt Type to virtio and Architecture to qcow2.
16. Select Finish.

Configure FortiGate VM hardware settings

Before powering on your FortiGate VM you must add the log disk and configure the virtual hardware of your FortiGate VM.

To configure settings for FortiGate VM on the server:

1. In the Virtual Machine Manager, locate the name of the virtual machine and then select Open from the toolbar.
2. Select Add Hardware. In the Add Hardware window select Storage.

KVM                                                                                                Start the FortiGate VM

3. Create a disk image on the computer’s harddrive and set the size to 30GB.
4. Enter:

5. Select Network to configure add more the network interfaces. The Device type must be Virtio.

A new virtual machine includes one network adapter by default. You can add more through the Add Hardware window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer.

6. Select Finish.

Start the FortiGate VM

You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines. In the toolbar, select Console and then select Start.

High Availability Hyper-V configuration

Promiscuous mode and support for MAC address spoofing is required for FortiGate-VM for Hyper-V to support FortiGate Clustering Protocol (FGCP) high availability (HA). By default the FortiGate-VM for Hyper-V has promiscuous mode enabled in the XML configuration file in the FortiGate-VM Hyper-V image. If you have problems with HA mode, confirm that this is still enabled.

In addition, because the FGCP applies virtual MAC addresses to FortiGate data interfaces and because these virtual MAC addresses mean that matching interfaces of different FortiGate-VM instances will have the same virtual MAC addresses you have to configure Hyper-V to allow MAC spoofing. But you should only enable MAC spoofing for FortiGate-VM data interfaces. You should not enable MAC spoofing for FortiGate HA heartbeat interfaces.

With promiscuous mode enabled and the correct MAC spoofing settings you should be able to configure HA between two or more FortiGate-VM for Hyper-V instances.

Start the FortiGate VM

You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines, right-click, and select Start in the menu. Optionally, you can select the name of the FortiGate VM in the list of virtual machines and select Start in the Actions menu.

Create the                       virtual machine                                                                       Deployment example – KVM

Deployment example – MS Hyper-V

Once you have downloaded the FGT_VMxx_HV-v5-build0xxx-FORTINET.out.hyperv.zip file and extracted the package contents to a folder on your Microsoft server, you can deploy the VHD package to your Microsoft Hyper-V environment.

The following topics are included in this section:

Create the FortiGate VM virtual machine

Configure FortiGate VM hardware settings

Create the FortiGate VM virtual machine

To create the FortiGate VM virtual machine:

1. Launch the Hyper-V Manager in your Microsoft server.

The Hyper-V Manager home page opens.

2. Select the server in the right-tree menu. The server details page is displayed.
3. Right-click the server and select New and select Virtual Machine from the menu. Optionally, in the Actions menu, select New and select Virtual Machine from the menu.

The New Virtual Machine Wizard opens.

4. Select Next to create a virtual machine with a custom configuration.

The Specify Name and Location page is displayed.

5. Enter a name for this virtual machine. The name is displayed in the Hyper-V Manager.

Select Next to continue. The Assign Memory page is displayed.

6. Specify the amount of memory to allocate to this virtual machine. The default memory for FortiGate VM is 1GB (1024MB).

Select Next to continue. The Configure Networking page is displayed.

7. Each new virtual machine includes a network adapter. You can configure the network adapter to use a virtual switch, or it can remain disconnected. FortiGate VM requires four network adapters. You must configure network adapters in the Settings

Select Next to continue. The Connect Virtual Hard Disk page is displayed.

8. Select to use an existing virtual hard disk and browse for the vhd file that you downloaded from the Fortinet Customer Service & Support portal.

Select Next to continue. The Summary page is displayed.

9. To create the virtual machine and close the wizard, select Finish.

Configure FortiGate VM hardware settings

Before powering on your FortiGate VM you must configure the virtual memory, virtual CPU, and virtual disk configuration to match your FortiGate VM license.

To configure settings for FortiGate VM on the server:

1. In the Hyper-V Manager, locate the name of the virtual machine, right-click the entry, and select Settings from the menu. Optionally, you can select the virtual machine and select Settings in the Actions

The Settings page is displayed.

2. Configure virtual processors, network adapters, and virtual hard drive settings.
3. Select Apply to save the settings and then select OK to close the settings page.

FortiGate VM virtual processors

You must configure FortiGate VM virtual processors in the server settings page. The number of processors is dependent on your server environment.

Configure FortiGate VM virtual processors:

1. In the Settings page, select Processor from the Hardware

The Processor page is displayed.

2. Configure the number of virtual processors for the FortiGate VM virtual machine. Optionally, you can use resource controls to balance resources among virtual machines.
3. Select Apply to save the settings.

FortiGate VM network adapters

You must configure FortiGate VM network adapters in the server settings page. FortiGate VM supports four network adapters.

Configure FortiGate VM network adapters:

1. In the Settings page, select Add Hardware from the Hardware menu, select Network Adapter in the device list, and select the Add button.

The Network Adapter page is displayed.

1. You must manually configure four network adapters for FortiGate VM in the settings page. For each network adapter, select the virtual switch from the drop-down list.
2. Select Apply to save the settings.

FortiGate VM virtual hard disk

You must configure the FortiGate VM virtual hard disk in the server settings page.

If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.

Configure a FortiGate VM virtual hard drive:

1. In the Settings page, select IDE Controller 0 > Hard Drive from the Hardware

The Hard Drive page is displayed.

2. Select New to create a new virtual hard disk.

The New Virtual Hard Disk Wizard opens.

3. This wizard helps you to create a new virtual hard disk.

Select Next to continue. The Choose Disk Format page opens.

4. Select to use VHDX format virtual hard disks. This format supports virtual disks up to 64TB and is resilient to consistency issues that might occur from power failures. This format is not supported in operating systems earlier than Windows Server 2012. Note that FortiGate-VM does not support hard disks larger than 2TB.

Select Next to continue. The Choose Disk Type page opens.

5. Select the type of virtual disk you want to use. Select one of the following disk types:
   • Fixed size: This type of disk provides better performance and is recommended for servers running applications with high levels of disk activity. The virtual hard disk file that is created initially uses the size of the virtual hard disk and does not change when data is deleted or added.
   • Dynamic expanding: This type of disk provides better use of physical storage space and is recommended for servers running applications that are not disk intensive. The virtual disk file that is created is small initially and changes as data is added.
   • Differencing: This type of disk is associated in a parent-child relationship with another disk that you want to leave intact. You can make changes to the data or operating system without affecting the parent disk, so that you can revert the changes easily. All children must have the same virtual hard disk format as the parent (VHD or VHDX).

Select Next to continue. The Specify Name and Location page opens.

6. Specify the name and location of the virtual hard disk file. Use the Browse button to select a specific file folder on your server.

Select Next to continue. The Configure Disk page opens.

7. Select to Create a new blank virtual hard disk and enter the size of the disk in GB. The maximum size is dependent on your server environment.

Select Next to continue. The Summary page opens.

8. The summary page provides details of the virtual hard disk. Select Finish to create the virtual hard disk.
9. Select Apply to save the settings and select OK to exit the settings page.

High Availability Hyper-V configuration                                                                                    Start the FortiGate VM

High Availability VMware configuration

If you want to combine two or more FortiGate-VM instances into a FortiGate Clustering Protocol (FGCP) High Availability (HA) cluster the VMware server’s virtual switches used to connect the heartbeat interfaces must operate in promiscuous mode. This permits HA heartbeat communication between the heartbeat interfaces. HA heartbeat packets are non-TCP packets that use Ethertype values 0x8890, 0x8891, and 0x8890. The FGCP uses link-local IPv4 addresses in the 169.254.0.x range for HA heartbeat interface IP addresses.

To enable promiscuous mode in VMware:

1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.
2. In Hardware, select Networking.
3. Select Properties of a virtual switch used to connect heartbeat interfaces.
4. In the Properties window left pane, select vSwitch and then select Edit.
5. Select the Security tab, set Promiscuous Mode to Accept, then select OK.
6. Select Close.

You must also set the virtual switches connected to other FortiGate interfaces to allow MAC address changes and to accept forged transmits. This is required because the FGCP sets virtual MAC addresses for all FortiGate interfaces and the same interfaces on the different VM instances in the cluster will have the same virtual MAC addresses.

To make the required changes in VMware:

1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.
2. In Hardware, select Networking.
3. Select Properties of a virtual switch used to connect FortiGate VM interfaces.
4. Set MAC Address ChangestoAccept.
5. Set Forged Transmits to Accept.

Power on your FortiGate VM

You can now proceed to power on your FortiGate VM. There are several ways to do this:

• Select the name of the FortiGate VM you deployed in the inventory list and select Power on the virtual machine in the Getting Started
• In the inventory list, right-click the name of the FortiGate VM you deployed, and select Power > Power On. l Select the name of the FortiGate VM you deployed in the inventory list. Click the Power On button on the toolbar.

Select the Console tab to view the console. To enter text, you must click in the console pane. The mouse is then captured and cannot leave the console screen. As the FortiGate console is text-only, no mouse pointer is visible. To release the mouse, press Ctrl-Alt.

Transparent mode VMware configuration

If you want to use your FortiGate-VM in transparent mode, your VMware server’s virtual switches must operate in promiscuous mode. This permits these interfaces to receive traffic that will pass through the FortiGate unit but was not addressed to the FortiGate unit.

In VMware, promiscuous mode must be explicitly enabled:

1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.
2. In Hardware, select Networking.
3. Select Properties of vSwitch0.
4. In the Properties window left pane, select vSwitch and then select Edit.
5. Select the Security tab, set Promiscuous Mode to Accept, then select OK.
6. Select Close.
7. Repeat steps 3 through 6 for other vSwitches that your transparent mode FortiGate-VM uses.

High Availability VMware configuration                                                                           Power on your FortiGate VM

Deployment example – VMware

Once you have downloaded the FGT_VMxx-v5-build0xxx-FORTINET.out.ovf.zip file from http://support.fortinet.com and extracted the package contents to a folder on your local computer, you can use the vSphere client to create the virtual machine from the deployment package OVF template.

The following topics are included in this section:

Open the FortiGate VM OVF file with the vSphere client

Configure FortiGate VM hardware settings

Open the FortiGate VM OVF file with the vSphere client

To deploy the FortiGate VM OVF template:

1. Launch the VMware vSphere client, enter the IP address or host name of your server, enter your user name and password and select Login.

The vSphere client home page opens.

2. Select File > Deploy OVF Template to launch the OVF Template wizard.

Open the                    OVF file with the vSphere client

Source page opens.

3. Select the source location of the OVF file. Select Browse and locate the OVF file on your computer. Select Next to continue.

The OVF Template Details page opens.

4. Verify the OVF template details. This page details the product name, download size, size on disk, and description. Select Next to continue.

End User License Agreement page opens.

5. Read the end user license agreement for FortiGate VM. Select Accept and then select Next to continue.

Open the                    OVF file with the vSphere client

Name and Location page opens.

6. Enter a name for this OVF template. The name can contain up to 80 characters and it must be unique within the inventory folder. Select Next to continue.

Disk Format page opens.

7. Select one of the following:

• Thick Provision Lazy Zeroed: Allocates the disk space statically (no other volumes can take the space), but does not write zeros to the blocks until the first write takes place to that block during runtime (which includes a full disk format).
• Thick Provision Eager Zeroed: Allocates the disk space statically (no other volumes can take the space), and writes zeros to all the blocks.
• Thin Provision: Allocates the disk space only when a write occurs to a block, but the total volume size is

reported by VMFS to the OS. Other volumes can take the remaining space. This allows you to float space between your servers, and expand your storage when your size monitoring indicates there is a problem. Note that once a Thin Provisioned block is allocated, it remains on the volume regardless if you have deleted data, etc.

8. Select Next to continue.

The OVF Template Network Mapping page opens.

Configure                       hardware settings

9. Map the networks used in this OVF template to networks in your inventory. Network 1 maps to port1 of the FortiGate VM. You must set the destination network for this entry to access the device console. Select Next to continue.

The OVF Template Ready to Complete page opens.

10. Review the template configuration. Make sure that Power on after deployment is not enabled. You might need to configure the FortiGate VM hardware settings prior to powering on the FortiGate VM.
11. Select Finish to deploy the OVF template. You will receive a Deployment Completed Successfully dialog box once the FortiGate VM OVF template wizard has finished.

Configure FortiGate VM hardware settings

Before powering on your FortiGate VM you must configure the virtual memory, virtual CPU, and virtual disk configuration to match your FortiGate VM license.

Configure FortiGate VM hardware settings

Configure                       hardware settings                                                   Transparent mode VMware configuration