About FortiGate VMX
Fortinet's FortiGate-VMX is a next generation firewall virtual appliance for VMware environments that provides purpose-built integration for VMware's Software-Defined Data Center (SDDC) and interoperability with VMware vSphere and NSX. FortiGate-VMX provides visibility into virtualized network traffic in the vSphere hypervisor through direct API-level integration and management orchestration to secure workloads in dynamic software-defined networks and infrastructure without protection and compliance gaps. FortiGate-VMX provides integrated protection of East/West traffic flow inside VMWare's NSX environment.
Through the close partnership VMware and Fortinet maintain, VMware-specific APIs were made available to enable the FortGate-VMX integration. This allows for interception and policy enforcement at the hypervisor level.
There are two components comprising FortiOS:
FortiOS Service Manager (SVM)
Once properly configured and licensed, FortiGate-VMX Security Nodes will be automatically deployed to each ESXi host in the designated cluster(s). If a new ESXi host is introduced into a designated cluster, a FortiGate-VMX Security Node will auto-deploy and policy synchronized.
The FortiGate-VMX Security Node is not in Transparent Mode as might be assumed because there is no NAT occurring. The FortiGate-VMX Security Node only has internal interfaces. For FortiGate-VMX v1, they are conveniently named “internal” & “external”. For FortiGate-VMX (second generation), there is an internal port pair per VDOM, so the naming convention is <VDOM name>-int & <VDOM name>-ext. FortiGate-VMX security policies are configured and applied using these interfaces.
FortiOS 6.0 is certified for use with NSX 6.3.0+, 6.4.0, and 6.4.1, and vSphere ESXi 6.0, 6.5, and 6.7.
For information on additional supported software, see the VMware Compatibility Guide.
The integration/interaction process
After the software is properly installed, the deployment of FortiGate-VMX Security Nodes will be automatic. The deployment process is as follows:
- FortiGate-VMX Service Manager registers the Fortinet security service with NSX Manager (FortiGate-VMX):
The registration process uses the NetX management plane API to enable bi-directional communication between the FortiGate-VMX Service Manager and the NSX Manager.
- Auto-deploy FortiGate-VMX to all hosts in designated cluster(s):
The NSX Manager collects the FortiGate-VMX image from the URL specified during registration and installs an instance of FortiGate-VMX on each ESXi host in the designated cluster(s). The image update is instantaneous and beneficial for on-demand, software-defined data center requirements.
- FortiGate-VMX Security Node connects with FortiGate-VMX Service Manager:
The FortiGate-VMX Security Node initiates a connection to the FortiGate-VMX Service Manager to register and obtain its license.
- License verification and configuration synchronization with FortiGate-VMX:
FortiGate-VMX Service Manager verifies the serial number and synchronizes configuration and policy.
- Redirection policy rules updated for enablement of FortiGate-VMX security service:
For all objects secured in the cluster, a policy redirecting all, or specific traffic to FortiGate-VMX is ready.
- Real-time updates of object database:
The NSX Manager sends real-time updates on the changes in the virtual environment to the FortiGate-VMX Service Manager.
- FortiGate-VMX Service Manager dynamically synchronizes object database and policy to all FortiGate-VMX Security Nodes deployed in cluster.