Cloud-init
You can use cloud-init to preconfigure a FortiGate-VM instance before bootup using a text file. For example, you can include a license or configuration information in the cloud-init file, so that the license and configuration is already present on the FortiGate-VM after initialization. All FortiGate-VM public and private cloud platforms support cloud-init. You can provide the cloud-init file when initializing the FortiGate-VM through the GUI of your desired cloud platform.
When providing FortiOS configuration in the cloud-init text file, you can include a full backed up FortiOS configuration or a partial configuration. For a partial configuration, provide the configuration in the form of CLI commands. The example in this topic includes a partial configuration that consists of the following CLI commands:
config system global
set hostname mimecheck
set admintimeout 480
endconfig system admin
edit admin
set password 12345678
next
end
The following shows the content of an example cloud-init MIME file that includes the FortiGate-VM license and some configuration. The example omits most of the license file content for security purposes:
Content-Type: multipart/mixed; boundary="===============0740947994048919689==" MIME-Version: 1.0 --===============0740947994048919689== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="config" config system global set hostname mimecheck set admintimeout 480 end config system admin edit admin set password 12345678 end --===============0740947994048919689== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="license" -----BEGIN FGT VM LICENSE----- QAAAAM9mmdw0/C5oquSAhgYYurEyOAeTChjuEt8NlvQZszsj6FMpzv9FFLl8DuV8 C7JSP1JqFSjTEeSLa/crtO84Df7gGQAAgZ3RwxjOeKPEgl4i4cQKpcECVcXM4hcb ... uqoVJ7Nca1B4mZUE3v4BuO07fZZJCdO2 -----END FGT VM LICENSE----- --===============0740947994048919689==--
To debug the cloud-init configuration, use the diagnose debug cloud-init show command. The following shows example output for this command:
>> Checking metadata source config drive >> Found config drive /dev/sr0 >> Successfully mount config drive >> MIME parsed preconfig script >> Found metadata source: config drive >> Trying to install vmlicense ... >> Run config script >> FGVMULTM12345678 $ >> FGVMULTM12345678 $ config system global >> FGVMULTM12345678 (global) $ set hostname vFGTvm00 >> FGVMULTM12345678 (global) $ end >> vFGTvm00 $ config system admin >> vFGTvm00 (admin) $ edit admin >> vFGTvm00 (admin) $ set password 12345678 >> vFGTvm00 (admin) $ end >> vFGTvm00 $ >> vFGTvm00 $ config system interface >> vFGTvm00 (interface) $ edit port1 >> vFGTvm00 (port1) $ set mode static >> vFGTvm00 (port1) $ set ip 10.6.30.169/24 >> vFGTvm00 (port1) $ set allowaccess ping https ssh snmp http telnet fgfm radius-acct probe-response ftm >> vFGTvm00 (port1) $ next >> vFGTvm00 (interface) $ edit port2 >> vFGTvm00 (port2) $ set mode static >> vFGTvm00 (port2) $ set ip 10.1.100.169/24 >> vFGTvm00 (port2) $ set allowaccess ping https ssh snmp http telnet fgfm radius-acct probe-response ftm >> vFGTvm00 (port2) $ next >> vFGTvm00 (interface) $ edit port3 >> vFGTvm00 (port3) $ set mode static >> vFGTvm00 (port3) $ set ip 172.16.200.169/24 >> vFGTvm00 (port3) $ set allowaccess ping https ssh snmp http telnet fgfm radius-acct probe-response ftm >> vFGTvm00 (port3) $ next >> vFGTvm00 (interface) $ end >> vFGTvm00 $ >> vFGTvm00 $ config firewall policy >> vFGTvm00 (policy) $ edit 0 >> vFGTvm00 (0) $ set srcintf "port2" >> vFGTvm00 (0) $ set dstintf "port3" >> vFGTvm00 (0) $ set srcaddr "all" >> vFGTvm00 (0) $ set dstaddr "all" >> vFGTvm00 (0) $ set action accept >> vFGTvm00 (0) $ set schedule "always" >> vFGTvm00 (0) $ set service "ALL" >> vFGTvm00 (0) $ set nat enable >> vFGTvm00 (0) $ next >> vFGTvm00 (policy) $ end >> vFGTvm00 $ >> vFGTvm00 $ config router static >> vFGTvm00 (static) $ edit 1 >> vFGTvm00 (1) $ set gateway 172.16.200.254 >> vFGTvm00 (1) $ set device "port3" >> vFGTvm00 (1) $ next >> The destination is set to 0.0.0.0/0 which means all IP addresses. >> vFGTvm00 (static) $ end >> vFGTvm00 $ >> Finish running config script