> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-deploy-a-fortigate-vnf.md).
# How to Deploy a FortiGate VNF in the Cloud
A FortiGate VNF is a virtual network function: a Fortinet firewall that you deploy as a server within your subscription and operate yourself.
In this guide, you create it from the Marketplace, connect it to your networks, and verify access to its console.
> #### ๐ What you get
>
> A FortiGate deployed and up and running, with a public IP on its management interface and access confirmed by web console and SSH.
### Before you begin
* Access to the Plenit dashboard with permissions to create servers.
* Have a name in mind (for example `FortinetKing`) and the deployment region and zone.
* Reserve at least the resources recommended by Fortinet: **1 vCPU**, **2 GB of RAM** and **2 GB of disk**.
* Decide which networks to connect (a management one and, if applicable, an internal one) and whether you will use a manual or auto-generated password.
### Step 1. Create a new server
In the dashboard, go to **New service โ Servers โ Register server** and give it a descriptive name (for example `FortinetKing`). VNF like FortiGate are managed within the Servers service.
{/\* ๐ธ SCREENSHOT 1 ยท New service โ Servers โ Register server, with the name \*/}
### Step 2. Select region and zone
Choose the country and zone that best fit your infrastructure or your client's.
{/\* ๐ธ SCREENSHOT 2 ยท region and zone selection \*/}
### Step 3. Assign resources
Adjust CPU, RAM, and disk to your needs, starting from Fortinet's minimums (1 vCPU, 2 GB RAM, 2 GB disk). If you are going to move a lot of traffic or multiple VPNs, size it above the minimum.
{/\* ๐ธ SCREENSHOT 3 ยท CPU, RAM, and disk assignment \*/}
### Step 4. Select the FortiGate image
In the **Images**section, open the **Marketplace**, choose **FortiGate** as the VNF type, and select the image that best fits your infrastructure.
{/\* ๐ธ SCREENSHOT 4 ยท Marketplace with the FortiGate image \*/}
### Step 5. Configure storage
Keep the main disk at **2 GB**: due to the manufacturer's limitation, the disk where the VNF is installed only supports that size. If you need space for configurations, logs, or extra storage, add additional disks (up to **1 TB** each, and you can add several).
{/\* ๐ธ SCREENSHOT 5 ยท 2 GB main disk and additional disks \*/}
### Step 6. Configure the network
You can add multiple interfaces and choose between **Direct IP**, **Standard**, **VPC** or **Layer 2 (L2)**. For a functional deployment, the usual setup is a **management** interface with **Direct IP** (immediate external access) and an **internal** interface with **L2 network** interface to route traffic from your infrastructure.
The management network you choose changes how you control access:
| Management network | Does it filter by source IP? | Access control |
| ------------------ | ---------------------------- | -------------------------------------------------------- |
| Standard or VPC | Yes, from the network | Extra control layer before traffic reaches the FortiGate |
| Direct IP | No, not from the network | With GeoIP or with policies on the FortiGate itself |
{/\* ๐ธ SCREENSHOT 6 ยท management interfaces (Direct IP) and internal (L2) \*/}
> #### ๐ If you use Direct IP, control access separately
>
> With Direct IP, traffic reaches the FortiGate's public interface directly and you cannot filter by source IP from the network.
>
> Apply control with [GeoIP](/docs-en/productos/servers/how-to/how-to-configure-geoip-to-block-or-allow-countries.md) or with the FortiGate's own security policies.
### Step 7. Complete the final configuration
**Identification**: define the **hostname**, the **administrator user** (default `admin`) and the **password**, manual or auto-generated.
> #### โ๏ธ The auto-generated password cannot be changed later
>
> If you do not fill in the password, the user will be `admin` and the password will be generated automatically and provided when the server is created.
>
> That auto-generated password cannot be changed later with the password reset function, so store it in a safe place at the time of creation.
**Monitoring (SNMP Community)**: it is disabled by default. Enable it during deployment to see basic CPU, memory, and disk metrics from the very beginning; if you do not do it here, you can enable it later through the FortiGate CLI, but the panel option will remain disabled.
**Management ports** on the management network:
* **HTTPS**: you can leave it on 443, although it is recommended **8443**.
* **SSH**: you can map it to an alternate port, for example **2022**.
After deployment you will connect with `https://IP:8443` and `ssh admin@IP -p 2022`.
{/\* ๐ธ SCREENSHOT 7 ยท hostname, user, password, SNMP, and management ports \*/}
### Step 8. Verify the deployment and access it
In **Servers / My servers**, find the newly created subscription and check that the status is **Running / Active** and that the **Direct IP** interface has a public IP assigned. Then open the web console in the browser:
```scala
https://IP:8443
```
Enter the credentials from Step 7 (or `admin` and the auto-generated password). If everything is correct, you will see the FortiGate web console ready.
To check it from the terminal, verify that the management port responds and, if you work via CLI, log in through SSH:
```bash
curl -kI https://:8443
ssh admin@ -p 2022
```
(The `-k` is because the initial certificate is self-signed.)
### Validation
Consider the deployment successful if all of this is met:
* The server appears in status **Running / Active**.
* The interface **Direct IP** has a public IP assigned.
* The web console responds at `https://IP:8443`.
* You log in with the configured credentials or the auto-generated ones.
### Operational and security notes
* With **Direct IP** as management, restrict access with GeoIP or with FortiGate policies, since the network does not filter by source IP.
* Change the management ports to non-standard values (8443 / 2022) to reduce exposure.
* Save the auto-generated password as soon as the server is created.
* After the first login, review the logs and export an initial copy of the configuration.
### Conclusion
With this, you have a FortiGate VNF deployed and accessible, ready to be integrated into your infrastructure as a perimeter under your control.
From here, the steps that make the difference are the usual ones for a firewall: register the license and FortiGuard services if applicable, set up the security policies, export a backup of the initial configuration, and keep SNMP monitoring sending metrics.
The sooner you harden management access, the less exposed the device remains.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-deploy-a-fortigate-vnf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.