> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-deploy-a-fortigate-vnf.md).
# How to Deploy a FortiGate VNF in the Cloud
A FortiGate VNF is a virtual network function: a Fortinet firewall you deploy as a server within your subscription and operate yourself.
In this guide you create it from the Marketplace, connect it to your networks, and verify access to its console.
> #### ๐ What you get
>
> A FortiGate deployed and up and running, with a public IP on its management interface and access confirmed via web console and SSH.
### Before you start
* Access the Plenit panel with permissions to create servers.
* Have a name in mind (for example `FortinetKing`) and the deployment region and zone.
* Reserve at least the resources recommended by Fortinet: **1 vCPU**, **2 GB of RAM** and **2 GB of disk**.
* Decide which networks to connect (one management and, if applicable, one internal) and whether you will use a manual or auto-generated password.
### Step 1. Create a new server
In the dashboard, go to **New service โ Servers โ Register server** and give it an identifying name (for example `FortinetKing`). FortiGate VNFs are managed within the Servers service.
{/\* ๐ธ CAPTURE 1 ยท New service โ Servers โ Register server, with the name \*/}
### Step 2. Select region and zone
Choose the country and zone that best fit your infrastructure or your client's.
{/\* ๐ธ CAPTURE 2 ยท region and zone selection \*/}
### Step 3. Assign resources
Adjust CPU, RAM and disk to your needs, starting from Fortinet's minimums (1 vCPU, 2 GB of RAM, 2 GB of disk). If you are going to move a lot of traffic or several VPNs, size it above the minimum.
{/\* ๐ธ CAPTURE 3 ยท allocation of CPU, RAM and disk \*/}
### Step 4. Select the FortiGate image
In the **Images**, open the **Marketplace**Marketplace **FortiGate** as the VNF type and select the image that best fits your infrastructure.
{/\* ๐ธ CAPTURE 4 ยท Marketplace with the FortiGate image \*/}
### Step 5. Configure storage
Keep the main disk at **2 GB**: due to the manufacturer's limitation, the disk where the VNF is installed only supports that size. If you need space for configurations, logs, or extra storage, add additional disks (up to **1 TB** each, and you can add several).
{/\* ๐ธ CAPTURE 5 ยท main disk of 2 GB and additional disks \*/}
### Step 6. Configure the network
You can add multiple interfaces and choose between **Direct IP**, **Standard**, **VPC** or **Layer 2 (L2)**. For a functional deployment, the usual setup is a **management** with **Direct IP** (immediate external access) and an **internal** with **L2 network** to route traffic from your infrastructure.
The management network you choose changes how you control access:
| Management network | Does it filter by source IP? | Access control |
| ------------------ | ---------------------------- | -------------------------------------------------------- |
| Standard or VPC | Yes, from the network | Extra control layer before traffic reaches the FortiGate |
| Direct IP | No, not from the network | With GeoIP or with policies on the FortiGate itself |
{/\* ๐ธ CAPTURE 6 ยท management interfaces (Direct IP) and internal (L2) \*/}
> #### ๐ If you use Direct IP, control access separately
>
> With Direct IP, traffic goes directly to the public interface of the FortiGate and you cannot filter by source IP from the network.
>
> Apply control with [GeoIP](/docs-en/productos/servers/how-to/how-to-configure-geoip-to-block-or-allow-countries.md) or with security policies on the FortiGate itself.
### Step 7. Complete the final configuration
**Identification**: define the **hostname**, the **administrator user** (default `admin`) and the **password**, manual or auto-generated.
> #### โ๏ธ The auto-generated password cannot be changed later
>
> If you do not fill in the password, the user will be `admin` and the password will be generated automatically and delivered when the server is created.
>
> That auto-generated password cannot be changed later with the password reset function, so save it in a safe place when you create it.
**Monitoring (SNMP Community)**: it is disabled by default. Enable it during deployment to see basic CPU, memory, and disk metrics from the outset; if you do not do it here, you can enable it later through the FortiGate CLI, but the panel option will remain disabled.
**Administration ports** on the management network:
* **HTTPS**: you can leave it at 443, although it is recommended **8443**.
* **SSH**: you can map it to an alternative port, for example **2022**.
After deployment you will connect with `https://IP:8443` and `ssh admin@IP -p 2022`.
{/\* ๐ธ CAPTURE 7 ยท hostname, user, password, SNMP and administration ports \*/}
### Step 8. Validate the deployment and access it
In **Servers / My servers**, locate the newly created subscription and check that the status is **Running / Active** and that the interface **Direct IP** has a public IP assigned. Then open the web console in the browser:
```scala
https://IP:8443
```
Enter the credentials from Step 7 (or `admin` and the auto-generated password). If everything is correct, you will see the FortiGate web console ready.
To check it from the terminal, verify that the administration port responds and, if you work via CLI, connect through SSH:
```bash
curl -kI https://:8443
ssh admin@ -p 2022
```
(The `-k` is because the initial certificate is self-signed.)
### Validation
Consider the deployment successful if all of this is true:
* The server appears in state **Running / Active**.
* The interface **Direct IP** has a public IP assigned.
* The web console responds at `https://IP:8443`.
* You log in with the configured or auto-generated credentials.
### Operational and security notes
* With **Direct IP** as the management interface, restrict access with GeoIP or with FortiGate policies, since the network does not filter by source IP.
* Change the administration ports to non-standard values (8443 / 2022) to reduce exposure.
* Save the auto-generated password as soon as the server is created.
* After first access, review the logs and export an initial copy of the configuration.
### Conclusion
With this you have a FortiGate VNF deployed and accessible, ready to integrate into your infrastructure as a perimeter under your control.
From here, the steps that make the difference are the usual ones in a firewall: register the license and FortiGuard services if applicable, set up security policies, export a backup of the initial configuration, and leave SNMP monitoring sending metrics.
The sooner you harden management access, the less exposed the equipment remains.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-deploy-a-fortigate-vnf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.