azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "adminUsername": {
      "type": "string",
      "metadata": {
        "description": "Username for the FortiGate VM"
      }
    },
    "adminPassword": {
      "type": "securestring",
      "metadata": {
        "description": "Password for the FortiGate VM"
      }
    },
    "fortiGateNamePrefix": {
      "type": "string",
      "metadata": {
        "description": "Naming prefix for all deployed resources. The FortiGate VM will have the suffix '-FGT'. For example if the prefix is 'ACME-01' the FortiGate will be named 'ACME-01-FGT'"
      }
    },
    "fortiGateName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Custom naming for the deployed FortiGate resources. This will override the automatic generation based on the prefix for the FortiGate name."
      }
    },
    "fortiGateImageSKU": {
      "type": "string",
      "defaultValue": "fortinet_fg-vm",
      "allowedValues": [
        "fortinet_fg-vm"
      ],
      "metadata": {
        "description": "BYOL license only to support eval edition on Azure"
      }
    },
    "fortiGateImageVersion": {
      "type": "string",
      "defaultValue": "latest",
      "allowedValues": [
        "7.2.0",
        "7.2.1",
        "7.2.2",
        "7.2.3",
        "7.2.4",
        "latest"
      ],
      "metadata": {
        "description": "Select the image version (7.2.0 is the minimum version for eval license)"
      }
    },
    "fortiGateAdditionalCustomData": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The ARM template provides a basic configuration. Additional configuration can be added here."
      }
    },
    "instanceType": {
      "type": "string",
      "defaultValue": "Standard_A1_v2",
      "allowedValues": [
        "Standard_A1_v2",
        "Standard_B1ms"
      ],
      "metadata": {
        "description": "Virtual Machine size selection - Must be A1 or B1ms for eval license"
      }
    },
    "availabilityOptions": {
      "type": "string",
      "allowedValues": [
        "None",
        "Availability set",
        "Availability zone"
      ],
      "defaultValue": "None",
      "metadata": {
        "description": "Deploy FortiGate VM in an Availability Set or Availability Zones. If Availability Zones deployment is selected but the location does not support Availability Zones an Availability Set will be deployed. If Availability Zones deployment is selected and Availability Zones are available in the location, FortiGate A will be placed in Zone 1, FortiGate B will be placed in Zone 2"
      }
    },
    "existingAvailabilitySetName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name of existing Availability Set in case you want to replace or add a FortiGate to an existing cluster."
      }
    },
    "availabilityZoneNumber": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name of existing Availability Set in case you want to replace or add a FortiGate to an existing cluster."
      }
    },
    "publicIP1NewOrExisting": {
      "type": "string",
      "defaultValue": "new",
      "allowedValues": [
        "new",
        "existing",
        "none"
      ],
      "metadata": {
        "description": "Choose between an existing or new public IP address linked to the external interface of the FortiGate VM"
      }
    },
    "publicIP1Name": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name of Public IP address, if no name is provided the default name will be the Resource Group Name as the Prefix and '-FGT-PIP' as the suffix"
      }
    },
    "publicIP1ResourceGroup": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Public IP Resource Group, this value is required if an existing Public IP is selected"
      }
    },
    "publicIP1AddressType": {
      "type": "string",
      "defaultValue": "Static",
      "allowedValues": [
        "Dynamic",
        "Static"
      ],
      "metadata": {
        "description": "Type of public IP address"
      }
    },
    "publicIP1SKU": {
      "type": "string",
      "defaultValue": "Standard",
      "allowedValues": [
        "Basic",
        "Standard"
      ],
      "metadata": {
        "description": "Type of public IP address"
      }
    },
    "vnetNewOrExisting": {
      "type": "string",
      "defaultValue": "new",
      "allowedValues": [
        "new",
        "existing"
      ],
      "metadata": {
        "description": "Identify whether to use a new or existing vnet"
      }
    },
    "vnetName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name of the Azure virtual network, required if utilizing an existing VNET. If no name is provided the default name will be the Resource Group Name as the Prefix and '-VNET' as the suffix"
      }
    },
    "vnetResourceGroup": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Resource Group containing the existing virtual network, leave blank if a new VNET is being utilize"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "172.16.136.0/22",
      "metadata": {
        "description": "Virtual Network Address prefix"
      }
    },
    "subnet1Name": {
      "type": "string",
      "defaultValue": "ExternalSubnet",
      "metadata": {
        "description": "Subnet 1 Name"
      }
    },
    "subnet1Prefix": {
      "type": "string",
      "defaultValue": "172.16.136.0/26",
      "metadata": {
        "description": "Subnet 1 Prefix"
      }
    },
    "subnet1StartAddress": {
      "type": "string",
      "defaultValue": "172.16.136.4",
      "metadata": {
        "description": "Subnet 1 start address, 1 consecutive private IPs are required"
      }
    },
    "subnet2Name": {
      "type": "string",
      "defaultValue": "InternalSubnet",
      "metadata": {
        "description": "Subnet 2 Subnet"
      }
    },
    "subnet2Prefix": {
      "type": "string",
      "defaultValue": "172.16.136.64/26",
      "metadata": {
        "description": "Subnet 2 Prefix"
      }
    },
    "subnet2StartAddress": {
      "type": "string",
      "defaultValue": "172.16.136.68",
      "metadata": {
        "description": "Subnet 2 start address, 1 consecutive private IPs are required"
      }
    },
    "serialConsole": {
      "type": "string",
      "defaultValue": "yes",
      "allowedValues": [
        "yes",
        "no"
      ],
      "metadata": {
        "description": "Enable Serial Console"
      }
    },
    "fortiManager": {
      "type": "string",
      "defaultValue": "no",
      "allowedValues": [
        "yes",
        "no"
      ],
      "metadata": {
        "description": "Connect to FortiManager"
      }
    },
    "fortiManagerIP": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "FortiManager IP or DNS name to connect to on port TCP/541"
      }
    },
    "fortiManagerSerial": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "FortiManager serial number to add the deployed FortiGate into the FortiManager"
      }
    },
    "fortiGateLicenseBYOL": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "FortiGate BYOL license content"
      }
    },
    "fortiGateLicenseFlexVM": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "FortiGate BYOL Flex-VM license token"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "fortinetTags": {
      "type": "object",
      "defaultValue": {
        "publisher": "Fortinet",
        "provider": "6EB3B02F-50E5-4A3E-8CB8-2E12925831VM"
      }
    }
  },
  "variables": {
    "imagePublisher": "fortinet",
    "imageOffer": "fortinet_fortigate-vm_v5",
    "availabilitySetName": "[if(equals(parameters('existingAvailabilitySetName'),''),concat(parameters('fortiGateNamePrefix'),'-AvailabilitySet'),parameters('existingAvailabilitySetName'))]",
    "availabilitySetId": {
      "id": "[resourceId('Microsoft.Compute/availabilitySets', variables('availabilitySetName'))]"
    },
    "useAS": "[equals(parameters('availabilityOptions'), 'Availability set')]",
    "useAZ": "[and(not(empty(pickZones('Microsoft.Compute', 'virtualMachines', parameters('location')))), equals(parameters('availabilityOptions'), 'Availability zone'))]",
    "pipZones": "[if(variables('useAZ'), pickZones('Microsoft.Network', 'publicIPAddresses', parameters('location'), 3), json('null'))]",
    "zone1": "[if(equals(parameters('availabilityZoneNumber'),''),pickZones('Microsoft.Compute', 'virtualMachines', parameters('location')),array(parameters('availabilityZoneNumber')))]",
    "vnetName": "[if(equals(parameters('vnetName'),''),concat(parameters('fortiGateNamePrefix'),'-VNET'),parameters('vnetName'))]",
    "subnet1Id": "[if(equals(parameters('vnetNewOrExisting'),'new'),resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'),parameters('subnet1Name')),resourceId(parameters('vnetResourceGroup'),'Microsoft.Network/virtualNetworks/subnets', variables('vnetName'),parameters('subnet1Name')))]",
    "subnet2Id": "[if(equals(parameters('vnetNewOrExisting'),'new'),resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'),parameters('subnet2Name')),resourceId(parameters('vnetResourceGroup'),'Microsoft.Network/virtualNetworks/subnets', variables('vnetName'),parameters('subnet2Name')))]",
    "fgtVmName": "[if(equals(parameters('fortiGateName'),''),concat(parameters('fortiGateNamePrefix'),'-FGT'),parameters('fortiGateName'))]",
    "fmgCustomData": "[if(equals(parameters('fortiManager'),'yes'),concat('\nconfig system central-management\nset type fortimanager\n set fmg ',parameters('fortiManagerIP'),'\nset serial-number ', parameters('fortiManagerSerial'), '\nend\n config system interface\n edit port1\n append allowaccess fgfm\n end\n config system interface\n edit port2\n append allowaccess fgfm\n end\n'),'')]",
    "customDataHeader": "Content-Type: multipart/mixed; boundary=\"12345\"\nMIME-Version: 1.0\n\n--12345\nContent-Type: text/plain; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"config\"\n\n",
    "customDataBody": "[concat('config system sdn-connector\nedit AzureSDN\nset type azure\nnext\nend\nconfig router static\nedit 1\nset gateway ', variables('sn1GatewayIP'), '\nset device port1\nnext\nedit 2\nset dst ', parameters('vnetAddressPrefix'), '\nset gateway ', variables('sn2GatewayIP'), '\nset device port2\nnext\nend\nconfig system interface\nedit port1\nset mode static\nset ip ',  variables('sn1IPfgt'), '/', variables('sn1CIDRmask'), '\nset description external\nset allowaccess ping ssh https\nnext\nedit port2\nset mode static\nset ip ', variables('sn2IPfgt'), '/', variables('sn2CIDRmask'), '\nset description internal\nset allowaccess ping ssh https\nnext\nend\n', variables('fmgCustomData'), parameters('fortiGateAdditionalCustomData'), '\n')]",
    "customDataLicenseHeader": "--12345\nContent-Type: text/plain; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"license\"\n\n",
    "customDataFooter": "\n--12345--\n",
    "customDataFlexVM": "[if(equals(parameters('fortiGateLicenseFlexVM'),''),'',concat('LICENSE-TOKEN:',parameters('fortiGateLicenseFlexVM'), '\n'))]",
    "customDataCombined": "[concat(variables('customDataHeader'),variables('customDataBody'),variables('customDataLicenseHeader'), variables('customDataFlexVM'), parameters('fortiGateLicenseBYOL'), variables('customDataFooter'))]",
    "fgtCustomData": "[base64(if(and(equals(parameters('fortiGateLicenseBYOL'),''),equals(parameters('fortiGateLicenseFlexVM'),'')),variables('customDataBody'),variables('customDataCombined')))]",
    "fgtNic1Name": "[concat(variables('fgtVmName'),'-Nic1')]",
    "fgtNic1Id": "[resourceId('Microsoft.Network/networkInterfaces',variables('fgtNic1Name'))]",
    "fgtNic2Name": "[concat(variables('fgtVmName'),'-Nic2')]",
    "fgtNic2Id": "[resourceId('Microsoft.Network/networkInterfaces',variables('fgtNic2Name'))]",
    "serialConsoleEnabled": "[if(equals(parameters('serialConsole'),'yes'),'true','false')]",
    "publicIP1Name": "[if(equals(parameters('publicIP1Name'),''),concat(parameters('fortiGateNamePrefix'),'-FGT-PIP'),parameters('publicIP1Name'))]",
    "publicIP1Id": "[if(equals(parameters('publicIP1NewOrExisting'),'new'),resourceId('Microsoft.Network/publicIPAddresses',variables('publicIP1Name')),resourceId(parameters('publicIP1ResourceGroup'),'Microsoft.Network/publicIPAddresses',variables('publicIP1Name')))]",
    "publicIP1AddressId": {
      "id": "[variables('publicIP1Id')]"
    },
    "NSGName": "[concat(parameters('fortiGateNamePrefix'),'-',uniqueString(resourceGroup().id),'-NSG')]",
    "NSGId": "[resourceID('Microsoft.Network/networkSecurityGroups/',variables('NSGName'))]",
    "sn1IPArray": "[split(parameters('subnet1Prefix'),'.')]",
    "sn1IPArray2ndString": "[string(variables('sn1IPArray')[3])]",
    "sn1IPArray2nd": "[split(variables('sn1IPArray2ndString'),'/')]",
    "sn1CIDRmask": "[string(int(variables('sn1IPArray2nd')[1]))]",
    "sn1IPArray3": "[string(add(int(variables('sn1IPArray2nd')[0]),1))]",
    "sn1IPArray2": "[string(int(variables('sn1IPArray')[2]))]",
    "sn1IPArray1": "[string(int(variables('sn1IPArray')[1]))]",
    "sn1IPArray0": "[string(int(variables('sn1IPArray')[0]))]",
    "sn1GatewayIP": "[concat(variables('sn1IPArray0'),'.',variables('sn1IPArray1'),'.',variables('sn1IPArray2'),'.',variables('sn1IPArray3'))]",
    "sn1IPStartAddress": "[split(parameters('subnet1StartAddress'),'.')]",
    "sn1IPfgt": "[concat(variables('sn1IPArray0'),'.',variables('sn1IPArray1'),'.',variables('sn1IPArray2'),'.',int(variables('sn1IPStartAddress')[3]))]",
    "sn2IPArray": "[split(parameters('subnet2Prefix'),'.')]",
    "sn2IPArray2ndString": "[string(variables('sn2IPArray')[3])]",
    "sn2IPArray2nd": "[split(variables('sn2IPArray2ndString'),'/')]",
    "sn2CIDRmask": "[string(int(variables('sn2IPArray2nd')[1]))]",
    "sn2IPArray3": "[string(add(int(variables('sn2IPArray2nd')[0]),1))]",
    "sn2IPArray2": "[string(int(variables('sn2IPArray')[2]))]",
    "sn2IPArray1": "[string(int(variables('sn2IPArray')[1]))]",
    "sn2IPArray0": "[string(int(variables('sn2IPArray')[0]))]",
    "sn2GatewayIP": "[concat(variables('sn2IPArray0'),'.',variables('sn2IPArray1'),'.',variables('sn2IPArray2'),'.',variables('sn2IPArray3'))]",
    "sn2IPStartAddress": "[split(parameters('subnet2StartAddress'),'.')]",
    "sn2IPfgt": "[concat(variables('sn2IPArray0'),'.',variables('sn2IPArray1'),'.',variables('sn2IPArray2'),'.',int(variables('sn2IPStartAddress')[3]))]"
  },
  "resources": [
    {
      "apiVersion": "2021-04-01",
      "name": "[concat(parameters('fortiGateNamePrefix'), '-fortinetdeployment-', uniquestring(resourceGroup().id))]",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": []
        }
      }
    },
    {
      "condition": "[and(variables('useAS'),equals(parameters('existingAvailabilitySetName'),''))]",
      "type": "Microsoft.Compute/availabilitySets",
      "name": "[variables('availabilitySetName')]",
      "apiVersion": "2022-08-01",
      "location": "[parameters('location')]",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "properties": {
        "platformFaultDomainCount": 2,
        "platformUpdateDomainCount": 2
      },
      "sku": {
        "name": "Aligned"
      }
    },
    {
      "condition": "[equals(parameters('vnetNewOrExisting'), 'new')]",
      "name": "[variables('vnetName')]",
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2022-05-01",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[parameters('subnet1Name')]",
            "properties": {
              "addressPrefix": "[parameters('subnet1Prefix')]"
            }
          },
          {
            "name": "[parameters('subnet2Name')]",
            "properties": {
              "addressPrefix": "[parameters('subnet2Prefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "name": "[variables('NSGName')]",
      "apiVersion": "2022-05-01",
      "location": "[parameters('location')]",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "properties": {
        "securityRules": [
          {
            "name": "AllowAllInbound",
            "properties": {
              "description": "Allow all in",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "AllowAllOutbound",
            "properties": {
              "description": "Allow all out",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 105,
              "direction": "Outbound"
            }
          }
        ]
      }
    },
    {
      "condition": "[equals(parameters('publicIP1NewOrExisting'), 'new')]",
      "type": "Microsoft.Network/publicIPAddresses",
      "name": "[variables('publicIP1Name')]",
      "apiVersion": "2022-05-01",
      "location": "[parameters('location')]",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "sku": {
        "name": "[parameters('publicIP1SKU')]"
      },
      "zones": "[variables('pipZones')]",
      "properties": {
        "publicIPAllocationMethod": "[parameters('publicIP1AddressType')]",
        "dnsSettings": {
          "domainNameLabel": "[concat(toLower(variables('fgtVmName')), '-', uniquestring(resourceGroup().id))]"
        }
      }
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "name": "[variables('fgtNic1Name')]",
      "apiVersion": "2022-05-01",
      "location": "[parameters('location')]",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "dependsOn": [
        "[variables('vnetName')]",
        "[variables('NSGId')]"
      ],
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig1",
            "properties": {
              "privateIPAddress": "[variables('sn1IPfgt')]",
              "privateIPAllocationMethod": "Static",
              "publicIPAddress": "[if(not(equals(parameters('publicIP1NewOrExisting'), 'none')), variables('publicIP1AddressId') , json('null'))]",
              "subnet": {
                "id": "[variables('subnet1Id')]"
              }
            }
          }
        ],
        "enableIPForwarding": true,
        "enableAcceleratedNetworking": false,
        "networkSecurityGroup": {
          "id": "[variables('NSGId')]"
        }
      }
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "name": "[variables('fgtNic2Name')]",
      "apiVersion": "2022-05-01",
      "location": "[parameters('location')]",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "dependsOn": [
        "[variables('vnetName')]",
        "[variables('NSGId')]"
      ],
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig1",
            "properties": {
              "privateIPAllocationMethod": "Static",
              "privateIPAddress": "[variables('sn2IPfgt')]",
              "subnet": {
                "id": "[variables('subnet2Id')]"
              }
            }
          }
        ],
        "enableIPForwarding": true,
        "enableAcceleratedNetworking": false,
        "networkSecurityGroup": {
          "id": "[variables('NSGId')]"
        }
      }
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "name": "[variables('fgtVmName')]",
      "apiVersion": "2022-08-01",
      "tags": {
        "provider": "[toUpper(parameters('fortinetTags').provider)]"
      },
      "location": "[parameters('location')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "zones": "[if(variables('useAZ'), variables('zone1'), json('null'))]",
      "plan": {
        "name": "[parameters('fortiGateImageSKU')]",
        "publisher": "[variables('imagePublisher')]",
        "product": "[variables('imageOffer')]"
      },
      "dependsOn": [
        "[variables('fgtNic1Id')]",
        "[variables('fgtNic2Id')]"
      ],
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('instanceType')]"
        },
        "availabilitySet": "[if(variables('useAS'), variables('availabilitySetId'), json('null'))]",
        "osProfile": {
          "computerName": "[variables('fgtVmName')]",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]",
          "customData": "[variables('fgtCustomData')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "[variables('imagePublisher')]",
            "offer": "[variables('imageOffer')]",
            "sku": "[parameters('fortiGateImageSKU')]",
            "version": "[parameters('FortigateImageVersion')]"
          },
          "osDisk": {
            "createOption": "FromImage"
          },
          "dataDisks": [
            {
              "diskSizeGB": 30,
              "lun": 0,
              "createOption": "Empty"
            }
          ]
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "properties": {
                "primary": true
              },
              "id": "[variables('fgtNic1Id')]"
            },
            {
              "properties": {
                "primary": false
              },
              "id": "[variables('fgtNic2Id')]"
            }
          ]
        },
        "diagnosticsProfile": {
          "bootDiagnostics": {
            "enabled": "[variables('serialConsoleEnabled')]"
          }
        }
      }
    }
  ],
  "outputs": {
    "fortiGatePublicIP": {
      "type": "string",
      "value": "[if(and(equals(parameters('publicIP1NewOrExisting'), 'new'),equals(parameters('publicIP1AddressType'),'Standard')), reference(variables('publicIP1Id')).ipAddress, '')]"
    },
    "fortiGateFQDN": {
      "type": "string",
      "value": "[if(equals(parameters('publicIP1NewOrExisting'), 'new'), reference(variables('publicIP1Id')).dnsSettings.fqdn, '' )]"
    }
  }
}