Fortinet black logo

Administration Guide

IBM Cloud SDN connector using API keys

IBM Cloud SDN connector using API keys

FortiOS can automatically update dynamic addresses for IBM Cloud using an SDN connector.

To configure IBM Cloud SDN connectors using the GUI:
  1. Create SDN connectors for compute generation 1 and 2:
    1. Go to Security Fabric > External Connectors.
    2. Click Create New, then select IBM Cloud.
    3. Configure the connector for computer generation 1:

    4. Click OK.
    5. Click Create New, then select IBM Cloud.
    6. Configure the connector for computer generation 2:

    7. Click OK.
  2. Create dynamic firewall addresses for the configured connectors:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New > Address.
    3. From the Type dropdown list, select Dynamic.
    4. From the Sub Type dropdown list, select Fabric Connector Address.
    5. From the SDN Connector dropdown list, select the IBM SDN connector.
    6. In the Filter field, add the desired filters. The following filters are supported:
      • <InstanceId>
      • <InstanceName>
      • <ImageId>
      • <ImageName>
      • <Architecture>
      • <Profile>
      • <Vpc>
      • <Zone>
      • <Subnet>
      • <ResourceGroup>

    7. Click OK.
    8. Click Create New > Address.
    9. Repeat the process for computer generation 2:

    10. Click OK.
  3. Ensure that the connectors resolve dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the addresses created in step 2 to see a list of IP addresses that the connector has resolved:

To configure IBM Cloud SDN connectors using the CLI:
  1. Create SDN connectors for compute generation 1 and 2:
    config system sdn-connector
        edit "ibm_gen1"
            set status enable
            set type ibm
            set api-key xxxxxx
            set compute-generation 1
            set ibm-region us-south
            set update-interval 60
        next
        edit "ibm_gen2"
            set status enable
            set type ibm
            set api-key xxxxxx
            set compute-generation 2
            set ibm-region us-east
            set update-interval 60
        next
    end
  2. Create dynamic firewall addresses for the configured connectors:
    config firewall address
        edit "ibm_gen1_add1"
            set type dynamic
            set sdn "ibm_gen1"
            set color 19
            set filter "Vpc=alex-vpc1"
        next
        edit "ibm_gen2_add1"
            set type dynamic
            set sdn "ibm_gen2"
            set color 19
            set filter "ResourceGroup=alex-grp2"
        next
    end
  3. Ensure that the connectors resolve dynamic firewall IP addresses:
    # show firewall address ibm_gen1_add1
    config firewall address
        edit "ibm_gen1_add1"
            set uuid 586841c4-7f46-51ea-dc66-dbf840af03d3
            set type dynamic
            set sdn "ibm_gen1"
            set color 19
            set filter "Vpc=alex-vpc1"
            config list
                edit "10.240.0.49"
                next
                edit "10.240.0.75"
                next
                edit "169.61.227.88"
                next
                edit "52.117.170.31"
                next
            end
        next
    end
    # show firewall address ibm_gen2_add1
    config firewall address
        edit "ibm_gen2_add1"
            set uuid 5868c4f0-7f46-51ea-2b79-b5170fbfd4a8
            set type dynamic
            set sdn "ibm_gen2"
            set color 19
            set filter "ResourceGroup=alex-grp2"
            config list
                edit "10.241.128.4"
                next
                edit "10.241.128.5"
                next
                edit "10.241.129.4"
                next
                edit "52.117.126.69"
                next
            end
        next
    end

IBM Cloud SDN connector using API keys

FortiOS can automatically update dynamic addresses for IBM Cloud using an SDN connector.

To configure IBM Cloud SDN connectors using the GUI:
  1. Create SDN connectors for compute generation 1 and 2:
    1. Go to Security Fabric > External Connectors.
    2. Click Create New, then select IBM Cloud.
    3. Configure the connector for computer generation 1:

    4. Click OK.
    5. Click Create New, then select IBM Cloud.
    6. Configure the connector for computer generation 2:

    7. Click OK.
  2. Create dynamic firewall addresses for the configured connectors:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New > Address.
    3. From the Type dropdown list, select Dynamic.
    4. From the Sub Type dropdown list, select Fabric Connector Address.
    5. From the SDN Connector dropdown list, select the IBM SDN connector.
    6. In the Filter field, add the desired filters. The following filters are supported:
      • <InstanceId>
      • <InstanceName>
      • <ImageId>
      • <ImageName>
      • <Architecture>
      • <Profile>
      • <Vpc>
      • <Zone>
      • <Subnet>
      • <ResourceGroup>

    7. Click OK.
    8. Click Create New > Address.
    9. Repeat the process for computer generation 2:

    10. Click OK.
  3. Ensure that the connectors resolve dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the addresses created in step 2 to see a list of IP addresses that the connector has resolved:

To configure IBM Cloud SDN connectors using the CLI:
  1. Create SDN connectors for compute generation 1 and 2:
    config system sdn-connector
        edit "ibm_gen1"
            set status enable
            set type ibm
            set api-key xxxxxx
            set compute-generation 1
            set ibm-region us-south
            set update-interval 60
        next
        edit "ibm_gen2"
            set status enable
            set type ibm
            set api-key xxxxxx
            set compute-generation 2
            set ibm-region us-east
            set update-interval 60
        next
    end
  2. Create dynamic firewall addresses for the configured connectors:
    config firewall address
        edit "ibm_gen1_add1"
            set type dynamic
            set sdn "ibm_gen1"
            set color 19
            set filter "Vpc=alex-vpc1"
        next
        edit "ibm_gen2_add1"
            set type dynamic
            set sdn "ibm_gen2"
            set color 19
            set filter "ResourceGroup=alex-grp2"
        next
    end
  3. Ensure that the connectors resolve dynamic firewall IP addresses:
    # show firewall address ibm_gen1_add1
    config firewall address
        edit "ibm_gen1_add1"
            set uuid 586841c4-7f46-51ea-dc66-dbf840af03d3
            set type dynamic
            set sdn "ibm_gen1"
            set color 19
            set filter "Vpc=alex-vpc1"
            config list
                edit "10.240.0.49"
                next
                edit "10.240.0.75"
                next
                edit "169.61.227.88"
                next
                edit "52.117.170.31"
                next
            end
        next
    end
    # show firewall address ibm_gen2_add1
    config firewall address
        edit "ibm_gen2_add1"
            set uuid 5868c4f0-7f46-51ea-2b79-b5170fbfd4a8
            set type dynamic
            set sdn "ibm_gen2"
            set color 19
            set filter "ResourceGroup=alex-grp2"
            config list
                edit "10.241.128.4"
                next
                edit "10.241.128.5"
                next
                edit "10.241.129.4"
                next
                edit "52.117.126.69"
                next
            end
        next
    end