Deploying FortiGate-VM instances

Deploy two FortiGate-VM instances using any method that this document describes into two different zones of the same region. Both instances should have three network interfaces (NIC) connected to three subnets of three different virtual private cloud (VPC) networks:

• port1 – SUBNET_EXT (with a public IP address)
• port2 – SUBNET_INT (with no public IP address)
• port3 – SUBNET_HASYNC (optionally with public IP address for management)

If you have created a dedicated service account to be associated with FortiGates, you can indicate it during VM instances deployment.

You can use additional NICs to connect more networks. However, in a typical scenario, using VPC peering to connect to additional VPCs via a single internal NIC is recommended.

Remember to select a machine type with at least three vCPUs, such as n2-standard-4, to support three NICs.

The following provides example GCloud commands to deploy a primary FortiGate instance using a 7.0 bring your own license image:

gcloud compute instance create example-vm-fgt1 --zone ZONE_1 \
  --machine-type=e2-standard-4 \
  --image-project=fortigcp-project-001 \
  --image-family=fortigate-70-byol \
  --can-ip-forward \
  --network-interface=”subnet=SUBNET_EXT” \
  --network-interface=”subnet=SUBNET_INT,no-address” \
  --network-interface=”subnet=SUBNET_HASYNC,private-network-ip=HA_IP_1” \
  --service-account=SERVICE_ACCOUNT \
  --scopes=cloud-platform