I85PREP
⌘ K
FCSS Public Cloud Security study materials
FCSS Public Cloud Security study resources

FCSS Public Cloud Security: Deploying and Managing FortiGate Virtual Appliances in Public Clouds

FCSS Public Cloud Security · Work through your exam, one topic at a time.

All guide sections

Deploying and Managing FortiGate Virtual Appliances in Public Clouds

Domain three covers lifecycle: choosing a licensing model, sizing and placing FortiGate-VM instances, bootstrapping configuration, and managing HA or autoscaling through cloud APIs and FortiManager.

Core rules

  • FortiGate-VM is available as BYOL and as pay-as-you-go marketplace images; FortiFlex tokens are another licensing route. Match vCPU/RAM and NIC count to the license and throughput, not just the instance size.
  • Cloud HA is not identical to on-prem HA. AWS HA commonly uses two FortiGates in different AZs with secondary private IPs, route-table changes, and API permissions to move addresses. Azure uses availability zones/sets and load balancers or UDR failover. The exact design must preserve return paths.
  • Bootstrap with cloud-init/user-data or the FortiGate API: set admin credentials, license, management access, HA, and initial policies. Never bake secrets into a public image.
  • Use FortiManager for central policy, FortiAnalyzer for logs, and SDN connectors for dynamic address objects driven by cloud tags.
  • Autoscaling needs health checks, scale-in/out policies, and a way to synchronize configuration. A scale set without bootstrap and licensing will launch unusable appliances.

Worked example

A team needs HA across two AWS AZs for north-south inspection. Create two private subnets in different AZs, deploy one FortiGate-VM per AZ, and give each an elastic IP only if inbound management is required (prefer SSM/bastion). Use secondary private IPs and an IAM role that lets the FortiGate API reassign the secondary IP and update the route table on failover. Both appliances need identical policy and licenses; the active appliance owns the route. Test failover by stopping the active instance and confirming the route table next hop and session behavior. If the IAM role lacks ec2:AssignPrivateIpAddresses or route-table permissions, HA cannot complete.

Traps

  • Placing both HA members in one AZ.
  • Licensing a BYOL image with no license file.
  • Forgetting cloud API permissions for HA.
  • Changing instance size without checking license entitlement.
  • Using SDN connectors with an IAM role that cannot list tags.
  • Assuming FortiManager manages bootstrap licensing automatically.