Deploying FortiSandbox VM on Azure (Basic)

To deploy FortiSandbox VM on Azure with Windows Cloud VMs:

1. Go to Azure Marketplace and search for Fortinet FortiSandbox.

   

2. Select a software plan and then click Create to start the setup wizard.

   If you select Fortinet FortiSandbox-VM for Azure BYOL, you must provide your own licenses.

   

3. In the setup wizard, click Create.
4. Configure the virtual machine.
   

   

   Resource group	Create a new resource group.
   Virtual machine name	Name of the VM.
   Region	VM region.
   Size	Select the VM instance type. We recommend Standard A4 v2 for speed and storage capacity. FortiSandbox on Azure uses the temporary disk (provided free by the VM) to store and process job files. A secondary disk is not required.
   Authentication type	Click Password or SSH public key.
   Username	Enter a secondary admin user; the default Admin user is always created.

5. Click Review + Create.
6. When the setup wizard has validated your information, click Create.

   Wait a few minutes for the FortiSandbox VM to become available.

   

7. When the VM is available, click Go to resource to go to the VM.

   

8. Use the Public IP address assigned to the FortiSandbox to access from HTTPS.

   

9. Get the default admin password for the FortiSandbox VM using the Azure CLI command az vm list –output tsv -g [Your resource group].

   The VM-ID UUID is the default password for Admin access.

   

To apply the VM00 license and enable Windows Cloud VMs:

1. Log into FortiSandbox with the username admin and the password you retrieved from the CLI in the previous step.
2. Go to FortiSandbox > Dashboard and click Upload License to upload your license.

   

   When a license file is loaded, the FortiSandbox Azure instance reboots.

   When the FortiSandbox Azure instance finishes rebooting, the VM License icon changes to green.

3. Go to Scan Policy and Object > VM Settings and select the WindowsCloudVM.
4. Click Edit Clone Number to assign a clone number and enable the Windows Cloud VM.

   

   As with FortiSandbox appliance, the FortiSandbox license must be generated matching the port1 IP of the instance. Go to System > Interfaces to check the port1 IP address assigned by Azure.

FortiSandbox VM and Windows Cloud VMs topology

FortiSandbox VM Port Usage

Type	Service	Port
FortiGate	OFTP	TCP/514
FortiClient	File Analysis	TCP/514
Others	SSH CLI Management	TCP/22
	Telnet CLI Management	TCP/23
	Web Admin	TCP/80, TCP/443
	OFTP Communication with FortiGate and FortiMail	TCP/514
	Third-Party Proxy Server for ICAP Servers (ICAP)	TCP/1344
	Third-Party Proxy Server for ICAP Servers (ICAPS)	TCP/11344
FortiGuard	FortiGuard Distribution Servers	TCP/8890
	FortiGuard Web Filtering Servers	UDP/53, UDP/8888
FortiSandbox Community Cloud	Upload Detected Malware Information	TCP/443, UDP/53
FortiSandbox WindowsCloudVM	Serving WindowsVM on cloud for FSA-VM to perform sandboxing	TCP/443