Fortinet Fortigate Cluster - Specifications
Fortinet Fortigate Cluster
This section documents the Fortinet Fortigate Cluster VNF. Vendor: Fortinet. This VNF performs the Firewall function and is based on the Fortigate image. The blueprint supports the cluster deployment mode and the documented topology uses two virtual devices. The specification does not describe cluster mechanics (for example failover or active/standby behaviour); cluster is the documented deployment mode only.
Flavors
Available flavor families and sizes are shown below. Choose the flavor that matches your expected workload and the selected software image.
| Standard | DPDK | |
|---|---|---|
| Extra-Small | 1 vCPU 2 GB Mem 64 GB Disk | - |
| Small | 2 vCPU 4 GB Mem 64 GB Disk | 2 vCPU 4 GB Mem 64 GB Disk |
| Medium | 4 vCPU 8 GB Mem 64 GB Disk | 4 vCPU 8 GB Mem 64 GB Disk |
| Medium | 4 vCPU 16 GB Mem 64 GB Disk | 4 vCPU 16 GB Mem 64 GB Disk |
| Large | 8 vCPU 16 GB Mem 64 GB Disk | 8 vCPU 16 GB Mem 64 GB Disk |
In cluster deployments a flavor can be selected for each virtual device.
Interfaces
The diagram above shows the simplified customer-facing topology for the cluster deployment. Each virtual device has three documented interface roles: #1 - Internet Interface, #2 - MPLS-VPN interface (with VLAN sub-interfaces), and #3 - HA Interface. Public IPv4 addresses shown for the Internet interface are platform-generated informational outputs.
#1 - Internet Interface
Role: Internet-facing interface. The platform allocates public IPv4 address outputs for this interface; these addresses are displayed in the portal as informational outputs after provisioning.
Customer configuration options:
- Added IP address number: request 1..8 extra public IP addresses for the Internet interface. Enter the desired number in the provisioning form; the platform will allocate and display the corresponding addresses.
Notes: Public IP addresses are platform outputs. Do not assume how they will be used (for example peering or NAT) from this information alone.
#2 - MPLS-VPN interface
Role: Interface used to connect to MPLS-VPN via VLAN sub-interfaces.
Behavior and customer options:
- VLAN sub-interfaces available: VLAN 101 sub-interface through VLAN 108 sub-interface. For each enabled sub-interface you can:
- select one or more VPN entries from the VPN list (the list accepts multiple items),
- set the VPN Name (alphanumeric, hyphen and underscore allowed),
- choose the VPN role from the provided values (any-to-any, client, server).
- BGP (optional): for each VLAN sub-interface you may enable BGP using Enable BGP. When BGP is enabled, an optional AS prepend integer may be provided; documented range is 1..6. The internal specification notes AS prepend with a qualifier 'Only for backup VM' but does not describe global routing or failover policies.
Notes: BGP configuration is optional and available per VLAN sub-interface. If BGP is not enabled, no BGP-specific configuration is applied through this setting.
VLAN sub-interface common settings
VLAN sub-interfaces share the same structure: you enable the sub-interface, add one or more VPN list entries, set the VPN Name and VPN role, and optionally enable BGP and set AS prepend when required by your design.
#3 - HA Interface
Role: Interface reserved for cluster/HA connectivity. The specification documents the presence of this interface but does not require any customer parameters for it.
Notes: The presence of an HA interface does not imply platform behaviour such as automatic failover or a specific HA mechanism; cluster is the documented deployment mode but cluster mechanics are not described in this blueprint.
Routing and BGP parameters
BGP-related settings are available per VLAN sub-interface under #2 - MPLS-VPN interface. Key points:
- Enable BGP: optional boolean per VLAN sub-interface. When disabled, no BGP-specific configuration is applied through this setting.
- AS prepend: optional integer used when BGP is enabled. Allowed range: 1..6. The internal text mentions this value in relation to a backup VM but does not document routing or failover behaviour.
These fields are optional and updatable via the provisioning form when present. The specification does not define full route exchange or advertisement behavior; consult your network operations team for route policy design.
Virtual device parameters
The cluster topology contains two identical Fortigate virtual devices. Where device settings are identical they are described once rather than repeated.
- Disk size (mandatory per VM): boot volume size in GiB. Allowed range: 16..500 GiB. This value is requested during provisioning and is not updatable after creation.
- VM AS number (optional per VM): autonomous system number for the virtual device if required by your network. Allowed range: 1..4294967295 (both 2-byte and 4-byte AS numbers are accepted). Provide this during provisioning if needed.
- Image and flavor selection: choose one software image and a flavor for each VM at creation time. The available images and flavors are listed below.
- VM placement: optional placement policy. The platform suggests leaving empty or using anti-affinity by default.
Service specific parameters
Service specific parameters are values requested at the service level during provisioning. They differ from VM-level parameters and from platform-generated outputs: customers provide these values and they are used by the platform during provisioning to configure or label the service.
For this VNF the service-level parameters are:
-
Equipment name (mandatory): a short identifier for the VNF instance. Provide a string using letters, digits, hyphen or underscore. The platform enforces a maximum length (the provisioning form shows the enforced limit). This value is used to name the virtual device instance in the platform and should not be confused with platform-generated IPs or internal identifiers.
-
Password (mandatory): administrator password for the virtual device. Provide a string matching the platform constraints (minimum and maximum lengths shown in the form). The platform uses this value to set the admin credential during provisioning; it is not displayed in plain text afterwards.
-
Fortinet manager IP address (optional): an IPv4 address to record the Fortinet manager endpoint if you use one. Supplying this value stores it with the service configuration; the specification does not describe automated registration or usage.
-
Fortinet manager serial number (optional): optional vendor serial number recorded with the deployment for administrative purposes.
These parameters are provided by the customer during provisioning and are not platform-generated outputs. Where the form enforces patterns or ranges those constraints are indicated in the provisioning UI.
Platform-generated outputs
The platform exposes certain values as outputs after provisioning. These are informational and are not customer inputs:
- Public IP address (platform allocated): the primary public IPv4 address assigned to the Internet interface is shown in the portal outputs.
- Extra Public IP address (platform allocated): when you request additional public IPs via Added IP address number, each allocated IPv4 address is displayed as an informational output. Up to 8 extra addresses can be requested.
- Cluster public IP address (informational): the platform may expose a public IP labelled 'Cluster public IP address' as an informational output.
These outputs are displayed in the portal after provisioning. Do not assume their operational role (for example peering or NAT) from this description alone.
Software device versions
Below are the software images available for this VNF. Select the full image name that matches your requirement.
- 7.2.5
- 7.2.6
- 7.4.9