Install Guest VMs

FortiSandbox supports Local VMs, include Default VM, Optional VM, Custom VM, and Cloud VM. The table below display the difference:

	Default VM	Optional VM	Custom VM	Cloud VM
Nested Mode	Supported	Supported	Supported vdi style	Supported
Non-Nested Mode			Supported vhd style	Supported

To create a custom Windows VM for Azure, follow steps in Custom VM Guide which can be found in the Fortinet Developer Network or is available on request from Customer Support.

Install Guest VMs as Nested Mode

To support the VMs, you will need to set up two more interfaces: port2 and port3.

To setup network interfaces for guest VM for Nested mode:

1. Guest VMs use port3 to access internet on Nested mode. If you have not created port3 in previous steps, please set up for it here. Otherwise, please skip.

2. Shutdown the FortiSandbox VM instance from the Azure Portal.

3. Create interfaces for port2 and port3 to install the VMs. For information, see Create a network interface, in Set up the Azure environment for FortiSandbox.

Nested

Two interfaces are required: Interface 2: port2 Interface 3: port3

3. Attach this network interface to FortiSandbox VM instance as FSA Port2 and Port3.

4. Start the FortiSandbox VM instance from Azure Portal.

5. On the FortiSandbox GUI, go to System > Interfaces to verify that the network interface is attached.

To install the Guest VM:

• Please follow the instructions in, VM Settings in the FortiSandbox Administration Guide. There are default VMs, optional VMs and Customized VM via GUI or CLI. The cloud VMs can be enabled via GUI,
• Please make sure the status of port3 is connected on VM External Network Access of page System >Settings

If port1’s connection to Fortinet’s image server is not available, the image should be installed with the CLI command: fw-upgrade, for example:

fw-upgrade -v -thttps –s<your https server> -f/images/WIN10O21V1_1.pkg

Install Guest VMs as Non-Nested Mode

To set up network interface for custom VM for Non-Nested mode:

1. Guest VMs use port2 to access internet on Non-Nested mode. If you have not created port2 in previous steps, please set up for it. Otherwise, please skip.

2. Shutdown the FortiSandbox VM instance from the Azure Portal.

3. Create interfaces for port2 to install the VMs. For information, see Create network interfaces in Set up the Azure environment for FortiSandbox

4. Attach this network interface to FortiSandbox VM instance as FSA Port2.

5. Start the FortiSandbox VM instance from Azure Portal

6. On the FortiSandbox GUI, go to System > Interfaces to verify that the network interface is attached.

To upload image to blob container for installing the custom VM:

1. Check your Azure Config for the FortiSandbox firmware image storage account.

2. Go to Resource group > Storage account > Data storage->Containers.

3. Create a storage blob for the custom VM image.

   1. Create a blob container (with anonymous read access) in this storage account.

   2. Upload the activated prebuilt custom VM image VHD to this blob container.

To install a custom VM using CLI on Non-Nested Mode:

1. Go to the FortiSandbox firmware CLI.

2. Import the VHD image with the CLI: vm-customized

From v3.2.0, FortiSandbox Azure supports installing custom VMs from Azure snapshot and Azure disks. Use a meaningful custom VM name and keep the same name as VM_image_name. Do not use: Special characters in the name. Reserved FortiSandbox VM names starting with WIN7, WIN8, or WIN10. The set admin-port command to set port2 or port3 as the administrative port.

To install custom VM from a blob for the Azure Non-Nested mode:

1. Install the Azure custom VM with the CLI command: vm-customized

2. Install the VM from a blob as the default type.

vm-customized –cn -tblob -f[blob container name] -b[VM_image_name.vhd] -vo[OS type] -vn[VM name]

To install custom VM from snapshot for the Azure Non-Nested mode:

1. Install the Azure custom VM with the CLI command: vm-customized

2. Verify that your snapshot is under the same resource group as FortiSandbox and related resources.

3. Install the VM from disk with the -t option.

vm-customized -cn -tsnapshot -b[VM_image_disk_name] -vo[OS type] -vn[VM name]

To install custom VM from disk for the Azure Non-Nested mode:

4. Install the Azure custom VM with the CLI command: vm-customized

5. Verify that your disk is under the same resource group as FortiSandbox and related resources.

6. Install the VM from disk with the -t option.

vm-customized -cn -tdisk -b[VM_image_disk_name] -vo[OS type] -vn[VM name]

How to switch between nested and non-nested mode

FortiSandbox support the switching between the two Guest VM running modes when the settings match the requirements.

• Non-Nested to Nested: Ensure there is a port 3 and all customized VMs deleted.

• Nested to Non-Nested: The clone number of local VMs must be 0. FortiSandbox will delete all local VMs after switching.

• Switching is only allowed on standalone unit type.

To switch between Non-Nested and Nested mode, go to the System > Azure config page, refer to Setup Guest VM Running mode Switching modes will reboot the system and delete all the local VMs.

For CLI config-reset and factory-reset, the Guest VM Running Mode setting will be kept.

When backup/restore, the Guest VM Running Mode will also be retained and not restored according to the backup file.

To install the Guest VM in air-gapped mode:

The VM cannot be activated online If FortiSandbox is in air-gapped mode. To activate the VM, do the following:

1. Go to Log & Report > Events > VM Event.

2. Search for the failure of activation with an installation ID log.

3. Call the Microsoft Activation Center to get the confirmation ID.

4. Use the CLI to add the confirmation ID:

confirm-id -a –k<windows/office key> –c<confirmation ID> –n<VM name>

The re-initialization of the VM will start automatically. Please refer to Hyper-V Admin Guide for other operations.

Non-Nested mode: The custom VMs uses vhd file. Nested mode: The custom VMs uses vdi file. They are in a different format.