Technical Tip: Provisioning FortiGate with FortiZTP

[fgallardo1]

Description	This article describes how the FortiZTP (Zero touch provisioning) allows automatic device configuration and management, it reduces the task management effort by enabling easier remote deployment of different Fortinet devices, including: FortiGate. FortiGate-VM. FortiWifi. FortiAP. FortiSwitch. FortiExtender. FortiZTP integrates with other FortiCloud services called provisioning targets for centralized management, including: FortiGate Cloud. FortiManager. FortiManager Cloud. FortiLAN Cloud. FortiExtender Cloud. FortiSASE. For testing purposes, a FortiGate-VM and FortiManager cloud will be used to demonstrate the configuration process.
Scope	FortiZTP v7.2.3, FortiManagerCloud v7.2.3, FortiGate-VM v7.2.4.
Solution	The following steps describe how to provision a FortiGate device from FortiZTP and Centrally Manage using FortiManager Cloud.     1. Register the FortiGate device on the Asset Management Portal in the same FortiCloud account. This will allow the device to be available for FortiZTP.  Access the FortiZTP and view the summary:                                                      FortiGate Configuration. The FortiGate device must be factory reset and licensed before it is provisioned. The FortiGate model in this example has DHCP enabled on port1 by default. To figure out the management IP on that port, it is possible to execute the following command: diagnose ip address list With the previous information, access the web interface via HTTP port 80 and install the license file. The system will reboot. FortiZTP requires a FortiGate model that supports the zero-touch provisioning (autojoin) feature. FortiGate/FortiWiFi/POE desktop and 1U models up to 100F support the zero-touch provisioning feature. For other models, FortiZTP supports one-touch provisioning. For these models, configure DHCP on the port of choice.  config system fortiguard     set auto-join-forticloud enable end config system central-management     set type fortiguard end Back on FortiZTP, Provision FortiGate-VM to FortiManager Cloud, select the device to be provisioned and Provision, and select FortiManager Cloud as Target Location:                                                            Select Provision Now.                                                           Confirm whether the FortiGate is provisioned on the FortiZTP summary:                                                           Go to the FortiManager Cloud site, Login and in the tree menu, select Device Manager. 'Right-click' the FortiGate device and select Edit, or select the device and select the edit button.                                                              Enable Automatically Link to Real Device, then select OK.                                                              In the admin user/password section, fill in the FortiGate’s admin user and password.                                                               Select OK. If needed, change the Name to field for a custom name.                                                            Create a new Policy Package, from Policy & Objects -> Policy Packages -> Select the Default Policy Package -> 'Right Click' on New -> Create New Policy Package. Name: Branch1. Leave the rest of the fields as default and select OK.                                                               Go to Policy & Objects -> Policy Packages -> Branch1 -> Firewall Policy -> + Create new, fill the following fields as follows, and select OK: Name: Internet_Access_from_DMZ. Incoming Interface: Port2. Outgoing interface: Port1. Source: All. Destination: All. Service: All. Action: Accept. Inspection Mode: Flow-based. NAT: enable. Change note: Firewall policy to enable DMZ network access to the internet. Go to Policy & Objects -> Policy Packages -> Branch1 -> Installation Targets -> Edit -> Edit Installation Targets. Select the Branch1 device and select OK.                                                                Select the Install Wizard -> Install Policy Package & Device Settings. Confirm the installation of the policy package and proceed.                                                                                                                      Confirm if the installation was applied on the FortiGate, from Device Manager -> Select Branch1 -> Dashboard -> Summary -> System Information -> Operation -> Select the connect to CLI via SSH.                                                      Log in as the admin user with and password.