Copyright IBM Corporation 2017 Page 1 of 9

FortiGate Security Appliance on IBM Cloud

Solution Architecture

Date: 2017–12–22

Copyright IBM Corporation 2017 Page 2 of 9

Table of Contents

1 Introduction................................................................................................................................ 4

1.1 About FortiGate Security Appliance .................................................................................... 4

1.2 Background ......................................................................................................................... 4

1.3 Key Benefits ........................................................................................................................ 5

2 Design ....................................................................................................................................... 6

2.1 Overview.............................................................................................................................. 6

2.2 FortiGate Security Appliance Deployment .......................................................................... 6

Appliance configuration .............................................................................................. 7

Firewall configuration .................................................................................................. 7

High Availability .......................................................................................................... 8

User Management ...................................................................................................... 8

Caveats ....................................................................................................................... 8

Licensing ..................................................................................................................... 8

Appendix A—Reference ................................................................................................................... 9

List of Figures

Figure 1 VMware Cloud Foundation on IBM Cloud ........................................................................................ 4

Figure 2 FortiGate Security Appliance on VMware Cloud Foundation High Level Components .. 6

Figure 3 FortiGate Security Appliance network topology ........................................................................... 7

List of Tables

Table 1 FortiGate Security Appliance summary ............................................................................................. 7

Table 2 Permitted outbound traffic ..................................................................................................................... 8

Copyright IBM Corporation 2017 Page 3 of 9

Summary of Changes

This section records the history of significant changes to this document. Only the most significant changes

are described here.

Version Date Author Description of Change

1.0

2017–12–22 Jack Benney

Frank Chodacki

Daniel De Araujo

Bob Kellenberger

Simon Kofkin–Hansen

Scott Moonen

Jim Robbins

Initial Release

Copyright IBM Corporation 2017 Page 4 of 9

1 Introduction

1.1 About FortiGate Security Appliance

The purpose of this document is to define and describe the FortiGate Security Appliance architecture for

the vCenter Server and VMware Cloud Foundation offerings deployed in the IBM Cloud. Specifically, it

will detail the components of the solution and high–level configuration of each component in the design.

This solution is considered to be an additional component and extension of both the vCenter Server

solution offering and the VMware Cloud Foundation solution offering on IBM Cloud. As a result, this

document will not cover the existing configuration of the foundation solutions on IBM Cloud. Therefore, it

is highly recommended to review and understand the VMware on IBM Cloud solution architecture located

on the IBM Architecture Center before reading this document.

Figure 1 VMware Cloud Foundation on IBM Cloud

1.2 Background

IBM Cloud provides a variety of connectivity options for your IBM Cloud for VMware Solutions VMware

environment. For low bandwidth or initial connectivity, you can use the IBM Cloud VPN to connect

directly to your dedicated private network. For dedicated connections, IBM Cloud offers a Direct Link

service to connect to your existing network service provider or to connect to other clouds via a cloud

exchange provider. IBM Cloud also offers public network connectivity for applications that need to be

available over the public network, or for cases where your solution allows for public connectivity or

tunneling and does not require Direct Link.

Copyright IBM Corporation 2017 Page 5 of 9

If you choose public interconnectivity for your VMware environment, you have a number of additional

options to provide firewall, NAT, and VPN services for your connection. The base IBM Cloud for VMware

solutions offerings include VMware NSX licensing suitable for deploying NSX Edge Services Gateways

that you can use for firewall, NAT, and VPN services for protect your environment’s public network

access. However, in case you require a physical firewall and gateway device rather than a virtual firewall

for your VMware environment, this architecture specifies how to deploy the IBM Cloud FortiGate Security

Appliance offering as part of your environment’s security implementation.

IBM Cloud also offers a FortiGate–VM offering which is provides network security services in virtual

appliance form within your vSphere cluster. Visit the IBM Architecture Center to see the FortiGate–VM

solution architecture.

1.3 Key Benefits

The FortiGate 300 series Security Appliance available in the IBM Cloud offers firewall, routing, NAT, and

VPN services to your VMware environment, including the following:

• Deep packet inspection

• SSL inspection

• Intrusion prevention

• Data loss prevention

• Sandboxing

• Anti–malware and anti–virus

• Web filtering

• Traffic shaping

• WebUI and command line management interface

Copyright IBM Corporation 2017 Page 6 of 9

2 Design

2.1 Overview

The FortiGate Security Appliance solution complements the IBM Cloud for VMware Solutions offerings

by providing perimeter firewall and gateway services. These services are provided by dedicated physical

FortiGate devices within the IBM Cloud network.

Figure 2 FortiGate Security Appliance on VMware Cloud Foundation High Level Components

2.2 FortiGate Security Appliance Deployment

The FortiGate Security Appliance offering is deployed to an existing IBM Cloud public VLAN in the same

data center and POD as your VMware instance. As part of deployment, your instance’s existing public

VLAN is attached to the “inside” interfaces of the appliances, and a new public VLAN is allocated and

attached to the “outside” interfaces of the appliances. All traffic destined to your instance’s public network

is routed through the FortiGate appliances as shown in Figure 3, which act as a perimeter firewall and

gateway for your instance. In this figure, the original public VLAN is now denoted as a protected VLAN.

Copyright IBM Corporation 2017 Page 7 of 9

Figure 3 FortiGate Security Appliance network topology

Appliance configuration

The FortiGate Security Appliance offering is deployed as a pair of physical appliances configured to be

highly available in active–passive mode. Configuration is automatically replicated between the appliances.

The configuration of the appliances is as follows:

Attribute Configuration

Appliance FortiGate 300 series or better

Location Same data center and POD as VMware instance

High availability Two appliances deployed in active–passive configuration

Network Dual 1 GbE bonded on both inside and outside networks

Upstream IBM Cloud public VLAN (new)

Downstream IBM Cloud public VLAN (existing)

Table 1 FortiGate Security Appliance summary

Firewall configuration

Depending on your security requirements, you can configure the FortiGate Security Appliance to route

traffic, NAT traffic, or offer VPN services. When initially deployed by IBM Cloud for VMware, the

appliance is configured in one of two configurations depending on the time of deployment:

Deployment time Configuration

Together with VMware

instance deployment • Outbound management traffic is permitted (see below)

• All other traffic is blocked

After VMware instance

is deployed • Outbound management traffic is permitted (see below)

• All other traffic is permitted

The reason for this difference is that an existing VMware instance is assumed to have existing public

connections, so the FortiGate appliances are deployed in such a way that those connections are not

interrupted other than a brief outage as traffic is rerouted through the FortiGate appliances.

Copyright IBM Corporation 2017 Page 8 of 9

In all cases, after deployment, configuring the FortiGate Security Appliances to suit your application’s

needs and your security requirements is beyond the scope of this design.

However, you are required to allow network traffic required by the IBM Cloud for VMware offering itself.

IBM’s offerings require outbound public connectivity from the IBM Cloud Driver virtual machine through

the management NSX ESG to the public network. The Cloud Driver uses these connections to access your

instance’s database and message queues in the IBM Cloud. Optional solution components such as Zerto

Virtual Replication and F5 BIG–IP may also route public connections through the management NSX ESG

for product registration and billing, product support, or diagnostics. Therefore, you must minimally permit

the following outbound traffic through the FortiGate Security Appliances:

Field Configuration

Source Zone Inside

Source IP Management NSX ESG public IP

Destination Zone Outside

Destination IP All

Service All

Action ACCEPT

NAT Disable

Table 2 Permitted outbound traffic

Other than this rule and any other rules necessary for your application traffic, you should ensure that a

default deny policy is configured for all traffic traversing from the inside to outside interfaces, and from the

outside to inside interfaces.

Optionally, you can enable FortiGate management connections on the inside interface and disable

management connections on the outside interface. Note that this will require you to use the IBM Cloud

VPN to manage the FortiGate.

High Availability

The FortiGate Security Appliances are already configured by IBM Cloud as a highly available pair.

Configuration is automatically replicated between the two, and management and network functions failover

from the active node to the primary node in case of failure.

User Management

The FortiGate Security Appliances are initially deployed with a single administrative user for your use.

You can create additional users with differing privileges using the FortiGate administrative interface.

Caveats

The FortiGate Security Appliance is not compatible with Microsoft Windows Network Load Balancing

(NLB).

Licensing

There are no licensing requirements for the physical FortiGate Security Appliance.

Copyright IBM Corporation 2017 Page 9 of 9

Appendix A—Reference Additional information about IBM Cloud and FortiGate Security Appliance on IBM Cloud can be found at

the following sites:

• IBM Cloud Architecture Center for Virtualization:

https://www.ibm.com/cloud/garage/content/architecture/virtualizationArchitecture/

• IBM Cloud Direct Link:

https://www.ibm.com/cloud-computing/bluemix/direct-link

• IBM Cloud FortiGate Security Appliance configuration:

https://knowledgelayer.softlayer.com/procedure/configure-fortigate-security-appliance-fsa

• Fortinet product datasheets:

https://www.fortinet.com/resources/datasheets.html