Deploy FortiSandbox on AWS (BYOL/On-Demand)

You can create your FortiSandbox instance on AWS in On-Demand mode or BYOL mode. For BYOL mode, a FortiNDR VM00 license file should be purchased and uploaded.

Choose an Amazon Machine Image (AMI)

Go to EC2 > Instances and click Launch Instance.
On the Launch an instance page, browse for the FortiSandbox AMI on AWS Marketplace

Select Fortinet FortiSandbox Advanced Threat Protection (BYOL) or Fortinet FortiSandbox Advanced Threat Protection (On-Demand).

Technical Specification Details:

Technical Specification	Details
Technical Specification	On-Premise (Private) Cloud	Public Cloud - BYOL	Public Cloud - PAYG
Hypervisor Support	VMware ESXi Microsoft Hyper-V Windows server 2016 and 2019	AWS Azure
HA Support	FortiSandbox 3.2 or later
Virtual CPUs (min / max)	4/Unlimited Fortinet recommends four virtual CPUs plus the number of VM clones.	4/16 Fortinet recommends following virtual CPUs based on the number of VM Clones: 0-4 clones - 4 cores, 5-32 clones - 8 cores, 33-100 clones - 16 cores, 101+ clones - 16 cores or higher. Pick up the appropriate Instance Type.
Virtual Memory (min / max)	16 GB / 32 GB Fortinet recommends following virtual memory based n the number of VM Clones: 0-4 clones - 24 GB 5-8 clones - 32 GB	8 GB / 64 GB Recommended: Following virtual memory based on the number of VM Clones: 0-4 clones - 8 GB, 5-32 clones - 16 GB, 33-100 clones - 32 GB, 101+ clones - 64 GB. Pick the appropriate Instance Type.
Virtual Storage (min / max)	200 GB / 16 TB Fortinet recommends at least 500 GB for a production environment.
Virtual Network Interfaces	Recommended: 4 and above	Recommended: 2 and above
VM Clones Support (Min/Max)	0¹/ 8 (Local VMs) and 200 (Cloud VMs)	0¹ / 216²	0¹ / 128³

1 For HA-Cluster deployment setup configured as Primary node acting as a dispatcher.

2 Can enable any of the Custom VM or Cloud VM types up to the total seat count which is based on a combination of Windows licenses (max of 8), BYOL (8) and Cloud VMs (max of 200).

3 Total seat count is based on the number of cores multiplied by 4. Maximum VMs is 128 since the highest available vCPU on PAYG is 32. CloudVMs can also be added on top and registered, however, this is not advised due to product serial number changes after shutdown.

Click Next: Configure Instance Details.

Configure the instance

Add Name and tags

Add descriptive name tags to identify this FortiSandbox instance.

Choose the Instance type

To choose the instance type, refer to Technical Specification Details table.

Create a new key pair

You do not need to complete this task if you are using an existing key pair.

Click Create new key pair.
In the Create key pair box, enter the Key pair name, then click Create key pair. The key pair downloads automatically.
Save the key pair on your device.

Edit Network settings

Configure the following Network Settings:
VPC
Select the FortiSandbox VPC you created.
Subnet Select the management interface subnet you created.
Auto-Assign public IP Disable.
Firewall (security groups) Choose the security group you created.

Configure the following Advanced network configuration settings and click Add network interface.

Network interface 1

Select the management interface subnet you created; Auto-Assign (or any IP in that subnet)

Network interface 2

Select the local VM clone communication subnet you created; Auto-Assign (or any IP in that subnet)

You do not need to add Network interface 2 if are not using a local VM clone. If needed, you can attach network interfaces later when the instance is not running.

Configure storage

Fortinet recommends allotting 500GB to 16TB for storage size, depending on the number of historical jobs you want to keep in the system.

Launch the instance

Review the summary, then click Launch instance.
Click View Instances to view the instance state. Allow several minutes for Status Checks to change from Initializing to 2/2 checks passed.
Monitor the initialization, and select the created instance. Right-click the instance and select Monitor and troubleshoot > Get Instance Screenshot to view the status of the launched instance.