Technical Tip: Bootstrapping FortiGate VM using FortiFlex license in AWS using cloudinit

Set up IAM roles as this needs S3 bucket read access.

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": [

"s3:Get*",

"s3:List*"

],

"Resource": "*"

}

]

}

To install a FortiFlex license during bootstrap, the following script can be used, also upload the FortiFlex token and pre-config and post-config files. Pre-config file is important so that the FortiGate VM can connect to the FortiFlex and download the license file.

{

 "bucket": "mybucket",        <--- S3 bucket name.

 "region": "us-east-1",

 "license-token":"<FortiFlex Token>",

 "config": "/FGT-Config.txt"  <--- FortiGate config file.

}

When using pre-config, JSON format is not supported in user data, hence it is recommended to use MIME multipart as below.

Content-Type: multipart/mixed; boundary="==AWS=="
MIME-Version: 1.0

--==AWS==
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Disposition: attachment; filename="preconfig"

config system global
set hostname AWS-Single
end

--==AWS==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="license"

LICENSE-TOKEN: XXXXXXX

--==AWS==
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Disposition: attachment; filename="post"

config system interface
    edit port1
        set alias untrust
    next
end

--==AWS==--

Below is the output, post successful execution.

AWS-Single # diagnose debug cloudinit show
>> Checking metadata source aws
>> MIME parsed preconfig script
>> MIME parsed VM token
>> MIME parsed config script
>> Run preconfig script
>> FortiGate-VM64-AWS config system global
>> FortiGate-VM64-AWS (global) set hostname AWS-Single
>> FortiGate-VM64-AWS (global) end
>> Finish running preconfig script
>> Trying to install vmlicense ...
>> License-token: XXXXXXXXXXXXXXXX
>> VM license install succeeded. Rebooting firewall.
>> Run config script
>> AWS-Single config system interface
>> AWS-Single (interface) edit port1
>> AWS-Single (port1) set alias untrust
>> AWS-Single (port1) next
>> AWS-Single (interface) end
>> Finish running config script

Related document:

Bootstrapping the FortiGate-VM at initial bootup using user data