Deploying FortiGate-VM instances

Deploy two FortiGate-VM instances using any method that this document describes into two different zones of the same region. Both instances should have three network interfaces (NIC) connected to three subnets of three different virtual private cloud (VPC) networks:

• port1 – SUBNET_EXT (with a public IP address)
• port2 – SUBNET_INT (with no public IP address)
• port3 – SUBNET_HASYNC (optionally with public IP address for management)

You can use additional NICs to connect more networks. However, in a typical scenario, using VPC peering to connect to additional VPCs via a single internal NIC is recommended.

Remember to select a machine type with at least three vCPUs, such as n2-standard-4, to support three NICs.

The following provides example GCloud commands to deploy a primary FortiGate instance:

gcloud compute instance create example-vm-fgt1 --zone ZONE_1 \
  --machine-type=e2-standard-4 \
  --image-project=fortigcp-project-001 \
  --image-family=fortigate-70-byol \
  --can-ip-forward \
  --network-interface=”subnet=SUBNET_EXT” \
  --network-interface=”subnet=SUBNET_INT,no-address” \
  --network-interface=”subnet=SUBNET_HASYNC,private-network-ip=HA_IP_1” \
  --service-account=SERVICE_ACCOUNT \
  --scopes=cloud-platform