Checking the prerequisites
To deploy and configure the FortiGate-VM as an A-P HA solution, you need the following items:
- OCI account to operate in OCI compute portal
- Availability to accommodate required OCI resources
- See Service Limits.
- VCN with five subnets
- Three public IP addresses
- One for traffic to/through the active (primary) FortiGate-VM
- Two for management access to each FortiGate-VM
- All IP addresses must be static, not DHCP.
- Two FortiGate-VM instances
- You must deploy the two nodes in different ADs and under the same VCN.
- Each FortiGate-VM must have at least four network interfaces. See Compute Shapes.
- Two valid FortiGate-VM BYOL licenses. See Licensing.
- The following summarizes minimum sufficient IAM roles for this deployment:
- Allow dynamic-group <group_name> to read compartments in tenancy
- Allow dynamic-group <group_name> to read instances in tenancy
- Allow dynamic-group <group_name> to read vnic-attachments in tenancy
- Allow dynamic-group <group_name> to read subnets in tenancy
- Allow dynamic-group <group_name> to manage private-ips in tenancy
- Allow dynamic-group <group_name> to manage public-ips in tenancy
- Allow dynamic-group <group_name> to manage route-tables in tenancy
- To define simpler roles, use the following:
- Allow dynamic-group <group_name> to read compartments in tenancy
- Allow dynamic-group <group_name> to read instances in tenancy
- Allow dynamic-group <group_name> to manage virtual-network-family in tenancy
|
Actual role configurations may differ depending on your environments. Check with your company's public cloud administrators for more details. |