Technical Tip: How to install FortiDeceptor VM on Proxmox

Proxmox is an open-source enterprise-grade hypervisor that uses KVM for virtualization. As FortiDeceptor deploys decoys on different networks, it is useful to know specific steps to implement on KVM.

Step 1: Create the virtual machine with a relevant Name and take note of the VM ID.

At the OS tab, select 'Do not use any media'.

Leave the defaults for the System tab.

At the disks tab, delete the initial disk by selecting the trash can button. There should be no disks.

At the CPU tab, select the number of vCPUs to assign to the VM. Two vCPUs for the core FortiDeceptor OS are needed, and then two vCPUs for each decoy. For example, for four decoys, ten vCPUs (2 for core and 2 x 4 for the decoys) are needed.

Ensure that 'nested-virt' is selected in the 'on' position.  

For the memory, four GBs for the core FortiDeceptor OS is required, and then four GBs for each decoy. For example, for four decoys, 20GBs memory is needed (4 for the core and 4 x 4 for the decoys).

For the network, select the network interface for the FortiDeceptor management network. This is not the decoy deployment network interface that will be added later.

Confirm the settings and select Finish. Ensure that 'Start after created' is deselected.

Step 2: Add the virtual disks to the VM.

First, extract the FortiDeceptor KVM Installation files downloaded from the Fortinet Support portal. Proxmox uses KVM as the hypervisor, so the KVM VM package is required.

Then upload the required disks to the Proxmox server. Go to the Proxmox storage where the virtual disks will be installed, then go to Import. Select Upload.

Browse to the location where the FortiDeceptor KVM installation files were extracted and select the 'FDC-bootdrive.qcow2' file, and select Upload.

Once the 'FDC-bootdrive.qcow2' file is uploaded, select the uploaded file and select Import.

Select the FortiDeceptor VM as the Target Guest and add it.

Now add the data drive. Repeat the above steps to upload the 'FDCVMS-datadrive.qcow2' virtual disk from the FDCVMS folder in the location where the FortiDeceptor KVM installation files were extracted.

Note: When deploying a FortiDeceptor VME appliance, the 'FDCVME-datadrive.qcow2' will be attached. See the README.txt file in the extracted location for more information.

Both disks should be attached as shown in the image below.

Step 3: Configure the deployment network.

On the Proxmox server, configure a bridge interface to allow VLANs for the deployment network. In the Proxmox GUI, select the host server and go to System, then Network.

Edit the bridge interface for the decoy network and ensure that 'VLAN aware' is selected.

Return to the FortiDeceptor VM settings and add the deployment network virtual bridge interface. Select the FortiDeceptor virtual machine and go to Hardware. Select Add and 'Network Device'.

Select the virtual bridge for the decoy network. Ensure Firewall is deselected.

Ensure that the physical switch interface that the virtual bridge that will be used for the decoy deployment networks is set up as a tagged interface and allows the relevant VLANs.

Step 4: Boot the FortiDeceptor VM. First, edit the Boot Order by going to Options.

Move the virtual disks (usually scsi0 and scsi1) to the top. Deselect all the devices and select ONLY scsi0 as the boot device.

Step 5: Start the FortiDeceptor Virtual Machine.

Note that the Port1 IP address and gateway settings will need to be configured to access the GUI. See the FortiDeceptor CLI Reference for more information.

Step 6: Create the Deployment Networks.

In FortiDeceptor, go to Deception, then Deployment Network. Select Add new VLAN/Subnet. When adding a VLAN interface, turn the 'Tagged Interface' selector to On, then enter the VLAN ID of the VLAN. Configure the monitor IP address and gateway and select save.

Repeat the process for the additional VLANs.

Note that if a deployment network is being created where the VLAN is the Native VLAN of the interface, then turn the 'Tagged Interface' selector to Off.

Step 7: Deploy the decoys, selecting the relevant deployment networks.

Test and verify that the decoys can be accessed from a device on the same network.

Related documents:

Technical Tip: How to install FortiGate VM on Proxmox 

Deploying a FortiGate-VM into Proxmox 

Deploying FortiDeceptor VM on KVM

CLI Reference