Deployment comparison

The following table summarizes how the three deployment models differ.

The bootstrap configuration differs across the following deployment models:

• Single VM
• HA single-zone — active node
• HA single-zone — passive node
• HA cross-zone — active node
• HA cross-zone — passive node

Bootstrap configurations contain variables that are replaced with deployment-specific values at provisioning time. For a complete list of variables and their sources, see Bootstrap variables.

Every deployment creates two dedicated security groups — one for the public interface and one for the private interface. Both security groups include restrictive rules that allow the instance to download the license and enable cluster synchronization. All other inbound traffic is denied by default. Before you can access the firewall by using HTTPS or SSH, add inbound security group rules that allow management access from trusted IP addresses.

Default configuration of a Single VM deployment

A Single VM deployment provisions one FortiGate-VM firewall with one public interface (port1) and one private interface (port2). The bootstrap configuration is static. It contains no dynamic variables and applies the same defaults to every Single VM deployment.

config system global
    set hostname FGT-IBM
end

config system interface
    edit port1
        set alias untrust
        set allowaccess https ssh ping
    next
    edit port2
        set alias trust
        set allowaccess https ssh ping
    next
end

The following table describes the default interface settings:

Default configuration of an HA single-zone deployment — active node

An HA single-zone deployment provisions two FortiGate-VM firewalls within the same availability zone as an active-passive cluster. The active and passive nodes receive separate bootstrap configurations.

The active node is assigned a higher HA priority (50), which ensures it becomes the primary firewall after deployment. It also receives the IBM Cloud SDN connector configuration, which enables automatic failover.

config system global
    set hostname IBM-HA-Active
end

config system interface
    edit port1
        set alias public
        set mode static
        set ip ${fgt_1_static_port1} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port2
        set mode static
        set ip ${fgt_1_static_port2} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port3
        set mode static
        set ip ${fgt_1_static_port3} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port4
        set mode static
        set ip ${fgt_1_static_port4} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
end

config router static
    edit 1
        set gateway ${port1_gateway}
        set device "port1"
    next
end

config system ha
    set group-name "IBM-HA"
    set mode a-p
    set hbdev "port3" 100
    set session-pickup enable
    set ha-mgmt-status enable
    set password ${ha_password}
    config ha-mgmt-interfaces
        edit 1
            set interface "port4"
            set gateway ${fgt1_port_4_mgmt_gateway}
        next
    end
    set override disable
    set priority 50
    set unicast-hb enable
    set unicast-hb-peerip ${fgt_2_static_port3}
end

config system sdn-connector
    edit "ibm-ha"
        set type ibm
        set ha-status enable
        set api-key ${ibm_api_key}
        set region ${region}
        set update-interval 60
    next
end

config system vdom-exception
    edit 1
        set object system.interface
    next
end

The following table describes the default settings for the active node:

Default configuration of an HA single-zone deployment — passive node

The passive node is assigned a lower HA priority (25), which keeps it in the standby role during normal operation. It continuously synchronizes configuration and session state from the active node and automatically takes over if the active node fails.

config system global
    set hostname IBM-HA-Passive
end

config system interface
    edit port1
        set alias public
        set mode static
        set ip ${fgt_2_static_port1} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port2
        set mode static
        set ip ${fgt_2_static_port2} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port3
        set mode static
        set ip ${fgt_2_static_port3} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port4
        set mode static
        set ip ${fgt_2_static_port4} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
end

config system ha
    set group-name "IBM-HA"
    set mode a-p
    set hbdev "port3" 100
    set session-pickup enable
    set ha-mgmt-status enable
    set password ${ha_password}
    config ha-mgmt-interfaces
        edit 1
            set interface "port4"
            set gateway ${fgt2_port_4_mgmt_gateway}
        next
    end
    set override disable
    set priority 25
    set unicast-hb enable
    set unicast-hb-peerip ${fgt_1_static_port3}
end

config system sdn-connector
    edit "ibm-ha"
        set type ibm
        set ha-status enable
        set api-key ${ibm_api_key}
        set region ${region}
        set update-interval 60
    next
end

config system vdom-exception
    edit 1
        set object system.interface
    next
end

The following table describes the default settings for the passive node:

Default configuration of an HA cross-zone deployment — active node

An HA cross-zone deployment provisions two FortiGate-VM firewalls across separate availability zones. The cross-zone configuration extends the single-zone HA configuration with two additions: a public address range identifier in the SDN connector for cross-zone floating IP failover, and a VDOM exception list that helps ensure interfaces, static routes, and virtual IPs are synchronized between nodes.

config system global
    set hostname IBM-HA-Active
end

config system interface
    edit port1
        set alias public
        set mode static
        set ip ${fgt_1_static_port1} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port2
        set mode static
        set ip ${fgt_1_static_port2} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port3
        set mode static
        set ip ${fgt_1_static_port3} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port4
        set mode static
        set ip ${fgt_1_static_port4} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
end

config router static
    edit 1
        set gateway ${port1_active_gateway}
        set device "port1"
    next
end

config system ha
    set group-name "IBM-HA"
    set mode a-p
    set hbdev "port3" 100
    set session-pickup enable
    set ha-mgmt-status enable
    set password ${ha_password}
    config ha-mgmt-interfaces
        edit 1
            set interface "port4"
            set gateway ${fgt1_port_4_mgmt_gateway}
        next
    end
    set override disable
    set priority 50
    set unicast-hb enable
    set unicast-hb-peerip ${fgt_2_static_port3}
end

config system sdn-connector
    edit "ibm"
        set type ibm
        set par-id ${par_id}
        set ha-status enable
        set api-key ${ibm_api_key}
        set region ${region}
        set update-interval 60
    next
end

config system vdom-exception
    edit 1
        set object system.interface
    next
    edit 2
        set object router.static
    next
    edit 3
        set object firewall.vip
    next
end

The following table describes the default settings for the active node:

Default configuration of an HA cross-zone deployment — passive node

The passive node in a cross-zone deployment mirrors the active node configuration with a lower HA priority and reversed peer IP references. It includes the same public address range–enabled SDN connector and VDOM exception list as the active node.

config system global
    set hostname IBM-HA-Passive
end

config system interface
    edit port1
        set alias public
        set mode static
        set ip ${fgt_2_static_port1} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port2
        set mode static
        set ip ${fgt_2_static_port2} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port3
        set mode static
        set ip ${fgt_2_static_port3} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
    edit port4
        set mode static
        set ip ${fgt_2_static_port4} ${netmask}
        set allowaccess ping https ssh fgfm
        set mtu-override enable
    next
end

config router static
    edit 1
        set gateway ${port1_passive_gateway}
        set device "port1"
    next
end

config system ha
    set group-name "IBM-HA"
    set mode a-p
    set hbdev "port3" 100
    set session-pickup enable
    set ha-mgmt-status enable
    set password ${ha_password}
    config ha-mgmt-interfaces
        edit 1
            set interface "port4"
            set gateway ${fgt2_port_4_mgmt_gateway}
        next
    end
    set override disable
    set priority 25
    set unicast-hb enable
    set unicast-hb-peerip ${fgt_1_static_port3}
end

config system sdn-connector
    edit "ibm"
        set type ibm
        set par-id ${par_id}
        set ha-status enable
        set api-key ${ibm_api_key}
        set region ${region}
        set update-interval 60
    next
end

config system vdom-exception
    edit 1
        set object system.interface
    next
    edit 2
        set object router.static
    next
    edit 3
        set object firewall.vip
    next
end

The following table describes the default settings for the passive node:

Bootstrap variables

Bootstrap configurations contain variables that IBM Cloud replaces with deployment-specific values at provisioning time. These values come from inputs that you provide when you order the firewall, or from resources that IBM Cloud creates automatically during deployment.

The following table lists all bootstrap variables and their sources:

Related links

• Deploying a licensed FortiGate firewall
• Configuring your FortiGate firewall after deployment