Skip to content
/ fortiproxy-terraform Public
forked from fortinet/fortiproxy-terraform

Terraform deployment code for FPX on cloud platforms

License

MIT license
0 stars 1 fork Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

Jackmeson1/fortiproxy-terraform

BranchesTags
 
 

Repository files navigation

🚀 FortiProxy Terraform Deployment Scripts

Terraform Azure AWS FortiProxy License

Enterprise-grade Infrastructure as Code (IaC) templates for automated FortiProxy Web Application Firewall deployment across AWS and Azure cloud platforms

🌟 Overview

Deploy Fortinet FortiProxy - the industry-leading Web Application Firewall (WAF) and SSL VPN solution - instantly across cloud environments using Terraform Infrastructure as Code. This repository provides production-ready, enterprise-tested deployment templates for both single-instance and high-availability configurations.

🎯 Why Choose This Repository?

  • ✅ Multi-Cloud Support: Deploy on Azure and AWS with identical configurations
  • ✅ Version Flexibility: Support for FortiProxy 7.2, 7.4, and 7.6
  • ✅ Deployment Options: Single-instance and HA active-passive clusters
  • ✅ Production-Ready: Enterprise-tested templates with security best practices
  • ✅ Infrastructure as Code: Version-controlled, repeatable deployments
  • ✅ Zero-Downtime HA: Cross-zone high availability configurations
  • ✅ Easy Customization: Modular design with comprehensive variable support
  • ✅ Authentication Testing: Complete AD integration with Ubuntu client for Kerberos/LDAP testing

🏗️ Architecture Support

🔧 Deployment Types

Deployment Type Description Use Case Availability Zones
Single Instance Standalone FortiProxy deployment Development, Testing, POC Single Zone
HA Active-Passive High-availability cluster Production, Critical workloads Cross-Zone
HA with Management HA cluster with dedicated mgmt Enterprise, Compliance Cross-Zone
AD + Client Environment Windows AD + Ubuntu client Authentication Testing, LDAP/Kerberos Cross-Zone

☁️ Cloud Platform Support

Microsoft Azure

  • Regions: All Azure regions with availability zone support
  • VM Sizes: Standard_F4, Standard_B4ms, and larger
  • Networking: VNet with multiple subnets, NSGs, Load Balancers
  • Storage: Managed disks with diagnostics

Amazon Web Services (AWS)

  • Regions: All AWS regions with Multi-AZ support
  • Instance Types: M5, C5, and T3 families
  • Networking: VPC with public/private subnets, Security Groups
  • Storage: EBS volumes with CloudWatch integration

🚀 Quick Start Guide

Prerequisites

  1. Terraform ≥ 1.0 installed (Download)
  2. Cloud CLI configured:
  3. FortiProxy BYOL License (for production deployments)

📦 Repository Structure

fortiproxy-terraform/
├── azure/
│   ├── 7.2/
│   │   ├── single/                    # Single instance deployment
│   │   └── ha-ap-port1-mgmt-crosszone/ # HA cluster deployment
│   ├── 7.4/
│   │   ├── single/                    # Single instance deployment
│   │   └── ha-ap-port1-mgmt-crosszone/ # HA cluster deployment
│   ├── 7.6/
│   │   ├── single/                    # Single instance deployment
│   │   └── ha-ap-port1-mgmt-crosszone/ # HA cluster deployment
│   └── win2019-ad/                    # Windows Server 2019 AD + Ubuntu client for authentication testing
├── aws/
│   └── 7.0/
│       └── ha-active-passive/         # AWS HA deployment
└── CLAUDE.md                          # AI-assisted development guide

🎯 Deploy Your First FortiProxy

Azure Single Instance (Recommended for beginners)

# 1. Clone the repository
git clone https://github.com/fortinet/fortiproxy-terraform.git
cd fortiproxy-terraform/azure/7.6/single

# 2. Configure your deployment
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your Azure credentials and preferences

# 3. Deploy with Terraform
terraform init
terraform plan
terraform apply

# 4. Access your FortiProxy
# URL, username, and password will be displayed after deployment

Azure High Availability Cluster

# Navigate to HA deployment
cd fortiproxy-terraform/azure/7.6/ha-ap-port1-mgmt-crosszone

# Configure and deploy
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your configuration
terraform init
terraform plan
terraform apply

🔧 Configuration Options

Essential Variables

Variable Description Example Required
subscription_id Azure Subscription ID 12345678-1234-... ✅
client_id Azure Service Principal ID 87654321-4321-... ✅
location Azure region eastus2, westeurope ✅
fpxversion FortiProxy version 7.6.0, 7.4.4 ✅
license License file path ./license.lic ✅
size VM size Standard_F4s_v2 ⚠️

Advanced Customization

# terraform.tfvars example
subscription_id = "your-subscription-id"
client_id       = "your-client-id"
client_secret   = "your-client-secret"
tenant_id       = "your-tenant-id"

# Deployment customization
location = "eastus2"
size     = "Standard_F4s_v2"
fpxversion = "7.6.0"

# Network configuration
vnetcidr    = "172.16.0.0/16"
publiccidr  = "172.16.0.0/24"
privatecidr = "172.16.1.0/24"

# License files
license  = "./license-active.lic"
license2 = "./license-passive.lic"

📚 Deployment Scenarios

🏢 Enterprise Production

Scenario: High-traffic web application protection Recommended: Azure 7.6 HA Active-Passive

cd azure/7.6/ha-ap-port1-mgmt-crosszone
# Configure for Standard_F8s_v2 or larger
# Enable all security features

🧪 Development & Testing

Scenario: Application development and testing Recommended: Azure 7.6 Single Instance

cd azure/7.6/single
# Configure for Standard_B4ms (cost-effective)
# Simplified configuration

🔒 Compliance & Security

Scenario: Regulated industries, PCI-DSS compliance Recommended: Azure 7.6 HA with Active Directory

cd azure/7.6/ha-ap-port1-mgmt-crosszone
cd ../win2019-ad  # Deploy AD for authentication
# Configure LDAP/RADIUS integration

🧪 Authentication Testing

Scenario: Testing FortiProxy LDAP/Kerberos authentication Recommended: Azure AD + Ubuntu Client Environment

cd azure/win2019-ad
# Complete testing environment with:
# - Windows Server 2019 Active Directory
# - Ubuntu 20.04 client with Kerberos/LDAP tools
# - Pre-configured test users and scripts
# - Comprehensive authentication testing suite

🛡️ Security Best Practices

🔐 Network Security

  • Default Deny: All NSGs/Security Groups use explicit allow rules
  • Segmentation: Separate management and data plane networks
  • Encryption: All traffic encrypted in transit and at rest
  • Monitoring: Built-in logging and diagnostics

🚨 Operational Security

  • Secrets Management: Use Azure Key Vault or AWS Secrets Manager
  • Access Control: Implement RBAC with least privilege
  • Monitoring: Enable Azure Monitor or CloudWatch integration
  • Backup: Automated configuration backups

🔍 Troubleshooting

Common Issues & Solutions

❌ VM Size Not Available

Error: SkuNotAvailable: Standard_F4 not available in westus2

Solution: Use different VM size or region:

size = "Standard_B4ms"
location = "eastus2"

❌ License File Not Found

Error: no file exists at "license.txt"

Solution: Create placeholder or provide valid license:

echo "# Placeholder license" > license.txt

❌ Network Interface Reserved

Error: NicReservedForAnotherVm

Solution: Wait 3 minutes and retry terraform destroy

📞 Getting Help

  1. Documentation: Check individual README files in deployment folders
  2. Community: FortiProxy Documentation
  3. Issues: GitHub Issues
  4. Commercial Support: Contact Fortinet Support

🧪 Testing & Validation

Automated Testing

# Validate Terraform configuration
terraform validate

# Check security compliance
tfsec .

# Test deployment (dry-run)
terraform plan -out=plan.tfplan

Manual Validation

  • ✅ Web GUI accessible via HTTPS
  • ✅ SSH access to management interface
  • ✅ HA synchronization (for cluster deployments)
  • ✅ Log forwarding to SIEM systems

🤝 Contributing

We welcome contributions! Here's how you can help:

  1. 🐛 Report Bugs: Use GitHub Issues for bug reports
  2. 💡 Feature Requests: Suggest new deployment scenarios
  3. 📝 Documentation: Improve README files and examples
  4. 🔧 Code: Submit pull requests for enhancements

Development Workflow

# Fork and clone the repository
git clone https://github.com/yourusername/fortiproxy-terraform.git

# Create feature branch
git checkout -b feature/new-deployment-type

# Make changes and test
terraform validate
terraform plan

# Submit pull request
git push origin feature/new-deployment-type

📈 Roadmap

Upcoming Features

  • 🎯 FortiProxy 7.8 support
  • 🎯 Google Cloud Platform deployments
  • 🎯 Kubernetes integration
  • 🎯 Ansible automation playbooks
  • 🎯 CI/CD pipeline templates

Version History

  • v3.0 (Current): FortiProxy 7.6 support, single deployments
  • v2.0: FortiProxy 7.4 support, enhanced HA
  • v1.0: Initial release with FortiProxy 7.2

📄 License & Support

📜 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

🏢 Support Policy

Fortinet-provided scripts in this and other GitHub projects do not fall under the regular Fortinet technical support scope and are not supported by FortiCare Support Services.

🌟 Star this repository if it helped you! 🌟

GitHub stars GitHub forks

Made with ❤️ by the Fortinet Community

🔗 Fortinet.com | 📚 Documentation | 💬 Community

About

Terraform deployment code for FPX on cloud platforms

Resources

Readme

License

MIT license
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages

  • HCL 54.1%
  • Shell 27.7%
  • PowerShell 18.2%