Technical Tip: Provisioning FortiGate with FortiZTP

[fgallardo1]

Description	This article describes that the FortiZTP (Zero touch provisioning) allows automatic device configuration and management, it reduces the task management  effort by enabling easier remote deployment of different Fortinet devices including: FortiGate. FortiGate-VM. FortiWifi. FortiAP. FortiSwitch. FortiExtender. FortiZTP integrates with other FortiCloud services called provisioning targets for centralized management, including: FortiGate Cloud. FortiManager. FortiManager Cloud. FortiLAN Cloud. FortiExtender Cloud. FortiSASE. For testing purposes, a FortiGate-VM and FortiManager cloud will be used to demonstrate the configuration process. Note: Appropriate licenses for the services used as provisioning targets should be acquired. For more details, refer to this document, FortiZTP Requirements.
Scope	FortiZTP v7.2.3.
Solution	The following steps describe how to provision a FortiGate device from FortiZTP and Centrally Manage it using FortiManager Cloud. Register the FortiGate device on the Asset Management Portal in the same FortiCloud account. This will allow the device to be available for FortiZTP. Access the FortiZTP using the URL (https://fortiztp.forticloud.com/), and the summary view is displayed:                                                                                                           FortiGate Configuration. The FortiGate device must be factory reset and licensed before it is provisioned. The FortiGate model in this example has DHCP enabled on port1 by default. To figure out the management IP on that port, it is possible to execute the following command: diagnose ip address list With the previous information, access the web interface via HTTP port 80 and install the license file, and the system will reboot. Refer to this document for the requirements and configuring DHCP: FortiGate-VM licensing  Back on FortiZTP, Provision FortiGate-VM to FortiManager Cloud, select the device to be provisioned and select the Provision button, select FortiManager Cloud as Target Location:                                                                                                   Select the 'Provision Now' button.                                                           On the FortiZTP summary, confirm if the FortiGate is provisioned:                                                                                             Go to the FortiManager Cloud (FortiManager Cloud), on the Device Manager. 'Right-click' the FortiGate device and select Edit, or select the device and select the edit button.                                                              Enable Automatically Link to Real Device, then select OK.                                                                                                          In the admin user/password section, fill in FortiGate’s admin user and password.                                                               Select the OK button. If needed, change the Name to a file for a custom name.                                                            Create a new Policy Package, from Policy & Objects -> Policy Packages -> Select the Default Policy Package -> 'Right Click' on New -> Create New Policy Package. Name: Branch1. Leave the rest of the fields as the default and select OK.                                                                                                      Go to Policy & Objects -> Policy Packages -> Branch1 -> Firewall Policy -> + Create new, fill in the following fields as follows, and select OK: Name: Internet_Access_from_DMZ. Incoming Interface: Port2. Outgoing interface: Port1. Source: All. Destination: All. Service: All. Action: Accept. Inspection Mode: Flow-based. NAT: enable. Change note: Firewall policy to enable DMZ network access to the internet. Go to Policy & Objects -> Policy Packages -> Branch1 -> Installation Targets -> Edit -> Edit Installation Targets. Select the Branch1 device and select OK.                                                                Select the Install Wizard -> Install Policy Package & Device Settings. Confirm the installation of the policy package and proceed.                                                                                                                        Confirm if the installation was applied on the FortiGate, from Device Manager -> Select Branch1 -> Dashboard -> Summary -> System Information -> Operation -> Select connect to CLI via SSH.                                                     Log in as admin user and password.