How to Deploy a FortiGate VNF in the Cloud
A FortiGate VNF is a virtual network function: a Fortinet firewall that you deploy as a server within your subscription and operate yourself.
In this guide, you create it from the Marketplace, connect it to your networks, and verify access to its console.
👍 What you get
A FortiGate deployed and up and running, with a public IP on its management interface and access confirmed by web console and SSH.
Before you begin
Access to the Plenit dashboard with permissions to create servers.
Have a name in mind (for example
FortinetKing) and the deployment region and zone.Reserve at least the resources recommended by Fortinet: 1 vCPU, 2 GB of RAM and 2 GB of disk.
Decide which networks to connect (a management one and, if applicable, an internal one) and whether you will use a manual or auto-generated password.
Step 1. Create a new server
In the dashboard, go to New service → Servers → Register server and give it a descriptive name (for example FortinetKing). VNF like FortiGate are managed within the Servers service.
{/* 📸 SCREENSHOT 1 · New service → Servers → Register server, with the name */}
Step 2. Select region and zone
Choose the country and zone that best fit your infrastructure or your client's.
{/* 📸 SCREENSHOT 2 · region and zone selection */}
Step 3. Assign resources
Adjust CPU, RAM, and disk to your needs, starting from Fortinet's minimums (1 vCPU, 2 GB RAM, 2 GB disk). If you are going to move a lot of traffic or multiple VPNs, size it above the minimum.
{/* 📸 SCREENSHOT 3 · CPU, RAM, and disk assignment */}
Step 4. Select the FortiGate image
In the Imagessection, open the Marketplace, choose FortiGate as the VNF type, and select the image that best fits your infrastructure.
{/* 📸 SCREENSHOT 4 · Marketplace with the FortiGate image */}
Step 5. Configure storage
Keep the main disk at 2 GB: due to the manufacturer's limitation, the disk where the VNF is installed only supports that size. If you need space for configurations, logs, or extra storage, add additional disks (up to 1 TB each, and you can add several).
{/* 📸 SCREENSHOT 5 · 2 GB main disk and additional disks */}
Step 6. Configure the network
You can add multiple interfaces and choose between Direct IP, Standard, VPC or Layer 2 (L2). For a functional deployment, the usual setup is a management interface with Direct IP (immediate external access) and an internal interface with L2 network interface to route traffic from your infrastructure.
The management network you choose changes how you control access:
Standard or VPC
Yes, from the network
Extra control layer before traffic reaches the FortiGate
Direct IP
No, not from the network
With GeoIP or with policies on the FortiGate itself
{/* 📸 SCREENSHOT 6 · management interfaces (Direct IP) and internal (L2) */}
📘 If you use Direct IP, control access separately
With Direct IP, traffic reaches the FortiGate's public interface directly and you cannot filter by source IP from the network.
Apply control with GeoIP or with the FortiGate's own security policies.
Step 7. Complete the final configuration
Identification: define the hostname, the administrator user (default admin) and the password, manual or auto-generated.
❗️ The auto-generated password cannot be changed later
If you do not fill in the password, the user will be
adminand the password will be generated automatically and provided when the server is created.That auto-generated password cannot be changed later with the password reset function, so store it in a safe place at the time of creation.
Monitoring (SNMP Community): it is disabled by default. Enable it during deployment to see basic CPU, memory, and disk metrics from the very beginning; if you do not do it here, you can enable it later through the FortiGate CLI, but the panel option will remain disabled.
Management ports on the management network:
HTTPS: you can leave it on 443, although it is recommended 8443.
SSH: you can map it to an alternate port, for example 2022.
After deployment you will connect with https://IP:8443 and ssh admin@IP -p 2022.
{/* 📸 SCREENSHOT 7 · hostname, user, password, SNMP, and management ports */}
Step 8. Verify the deployment and access it
In Servers / My servers, find the newly created subscription and check that the status is Running / Active and that the Direct IP interface has a public IP assigned. Then open the web console in the browser:
Enter the credentials from Step 7 (or admin and the auto-generated password). If everything is correct, you will see the FortiGate web console ready.
To check it from the terminal, verify that the management port responds and, if you work via CLI, log in through SSH:
(The -k is because the initial certificate is self-signed.)
Validation
Consider the deployment successful if all of this is met:
The server appears in status Running / Active.
The interface Direct IP has a public IP assigned.
The web console responds at
https://IP:8443.You log in with the configured credentials or the auto-generated ones.
Operational and security notes
With Direct IP as management, restrict access with GeoIP or with FortiGate policies, since the network does not filter by source IP.
Change the management ports to non-standard values (8443 / 2022) to reduce exposure.
Save the auto-generated password as soon as the server is created.
After the first login, review the logs and export an initial copy of the configuration.
Conclusion
With this, you have a FortiGate VNF deployed and accessible, ready to be integrated into your infrastructure as a perimeter under your control.
From here, the steps that make the difference are the usual ones for a firewall: register the license and FortiGuard services if applicable, set up the security policies, export a backup of the initial configuration, and keep SNMP monitoring sending metrics.
The sooner you harden management access, the less exposed the device remains.
Last updated
Was this helpful?