Deploy a Virtual FortiGate Firewall on Proxmox VE

Network Topology

Prerequisites

Knowledge Prerequisites

Lab Administrator — Pre-Lab Setup Script

#!/usr/bin/env bash
# ============================================================
#  setup-virtual-fortigate-proxmox.sh
#  Lab Administrator Pre-provisioning Script
#  Platform  : Proxmox VE Shell (Bash)
#  Purpose   : Verify host resources, create Linux bridges,
#              and import the FortiGate .qcow2 disk image.
#              Does NOT create the VM — learner does that step.
#  Run as    : root on the Proxmox node shell
# ============================================================

# ── Configurable Variables ───────────────────────────────────
FORTIGATE_IMAGE="/var/lib/vz/template/iso/FGT_VM64_KVM.qcow2"
STORAGE_POOL="local-lvm"          # Target storage pool for disk import
RESERVED_VMID="200"               # VM ID reserved for learner's FortiGate VM
BRIDGE_WAN="vmbr10"               # WAN / Management bridge
BRIDGE_LAN="vmbr20"               # Internal LAN bridge
MIN_FREE_MEM_MB=2048              # Minimum free RAM required (MB)
MIN_FREE_DISK_GB=10               # Minimum free disk space required (GB)
LOG="/var/log/simgym-fortigate-setup.log"

# ── Logging Helper ──────────────────────────────────────────
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG"; }
err() { log "ERROR: $*"; exit 1; }

log "=== SimGym FortiGate Pre-lab Setup START ==="

# ── 1. Prerequisite Checks ──────────────────────────────────
log "Checking required tools..."
for cmd in qm pvesm ip grep awk free df; do
  command -v "$cmd" &>/dev/null || err "Required command not found: $cmd"
done
log "All required tools present."

# ── 2. Verify FortiGate Image Exists ────────────────────────
log "Checking for FortiGate image at: $FORTIGATE_IMAGE"
[ -f "$FORTIGATE_IMAGE" ] || err "FortiGate .qcow2 image not found at $FORTIGATE_IMAGE.
  Download from https://support.fortinet.com and place at the path above."
log "FortiGate image found: $(du -sh "$FORTIGATE_IMAGE" | cut -f1)"

# ── 3. Check Free Memory ────────────────────────────────────
FREE_MEM=$(free -m | awk '/^Mem:/{print $7}')
log "Available memory: ${FREE_MEM} MB (minimum required: ${MIN_FREE_MEM_MB} MB)"
[ "$FREE_MEM" -ge "$MIN_FREE_MEM_MB" ] || \
  err "Insufficient free memory. ${FREE_MEM} MB available, ${MIN_FREE_MEM_MB} MB required."

# ── 4. Check Free Disk Space ─────────────────────────────────
FREE_DISK=$(df -BG /var/lib/vz | awk 'NR==2{gsub("G",""); print $4}')
log "Available disk: ${FREE_DISK} GB (minimum required: ${MIN_FREE_DISK_GB} GB)"
[ "$FREE_DISK" -ge "$MIN_FREE_DISK_GB" ] || \
  err "Insufficient disk space. ${FREE_DISK} GB available, ${MIN_FREE_DISK_GB} GB required."

# ── 5. Create vmbr10 (WAN/Management) if missing ────────────
if ip link show "$BRIDGE_WAN" &>/dev/null; then
  log "Bridge $BRIDGE_WAN already exists — skipping creation."
else
  log "Creating Linux bridge: $BRIDGE_WAN (WAN/Management)"
  ip link add name "$BRIDGE_WAN" type bridge
  ip link set "$BRIDGE_WAN" up
  log "$BRIDGE_WAN created and brought up."
  log "NOTE: Persist this bridge in /etc/network/interfaces for reboot survival."
fi

# ── 6. Create vmbr20 (Internal LAN) if missing ──────────────
if ip link show "$BRIDGE_LAN" &>/dev/null; then
  log "Bridge $BRIDGE_LAN already exists — skipping creation."
else
  log "Creating Linux bridge: $BRIDGE_LAN (Internal LAN)"
  ip link add name "$BRIDGE_LAN" type bridge
  ip link set "$BRIDGE_LAN" up
  log "$BRIDGE_LAN created and brought up."
  log "NOTE: Persist this bridge in /etc/network/interfaces for reboot survival."
fi

# ── 7. Check VM ID availability ──────────────────────────────
if qm status "$RESERVED_VMID" &>/dev/null; then
  err "VM ID $RESERVED_VMID is already in use. Free it before running this script."
fi
log "VM ID $RESERVED_VMID is available."

# ── 8. Import Disk Image into Proxmox Storage ────────────────
log "Importing FortiGate disk image into storage pool: $STORAGE_POOL under VM ID $RESERVED_VMID"
qm importdisk "$RESERVED_VMID" "$FORTIGATE_IMAGE" "$STORAGE_POOL" --format qcow2 \
  2>&1 | tee -a "$LOG" || err "Disk import failed. Check log at $LOG."
log "Disk import complete. The learner will attach this disk when creating the VM."

# ── 9. Post-Setup Validation ─────────────────────────────────
log "--- Validation ---"
log "Bridge $BRIDGE_WAN state : $(ip link show $BRIDGE_WAN | grep -o 'state [A-Z]*')"
log "Bridge $BRIDGE_LAN state : $(ip link show $BRIDGE_LAN | grep -o 'state [A-Z]*')"
log "Imported disk location   : $(pvesm list $STORAGE_POOL | grep "vm-${RESERVED_VMID}" || echo 'Check storage manually')"
log "=== Setup COMPLETE. Learner may now begin the lab. ==="

# ── Teardown Instructions ─────────────────────────────────────
# To clean up after the lab:
#   qm destroy 200                    # Remove VM (after learner finishes)
#   pvesm free local-lvm:vm-200-disk-0  # Free imported disk
#   ip link del vmbr10                # Remove WAN bridge (if created by script)
#   ip link del vmbr20                # Remove LAN bridge (if created by script)
#   rm -f /var/log/simgym-fortigate-setup.log
# ─────────────────────────────────────────────────────────────

Pre-Lab Checklist

Configuration

• Log in to the Proxmox Web UI Open your browser and navigate to https://192.168.128.191:8006. Log in with your Proxmox credentials. Select your node in the left-hand resource tree (e.g., pve).
• Start the Create VM Wizard Click the Create VM button in the top-right corner. The New Virtual Machine wizard will open.
• General Tab — Set VM ID and Name

  • Node: your Proxmox node
  • VM ID: 200 (reserved)
  • Name: fortigate-vm01

  Click Next.
• OS Tab — No ISO Media Select Do not use any media. We will attach the imported .qcow2 disk manually after the wizard completes. Set Guest OS Type to Linux, version 6.x - 2.6 Kernel. Click Next.
• System Tab — Machine Type

  • BIOS: SeaBIOS (default)
  • Machine: pc-i440fx (recommended; check the Fortinet VM compatibility matrix for your FortiOS version)
  • SCSI Controller: VirtIO SCSI

  Click Next.
• Disks Tab — Remove the Default Disk Delete the pre-created disk by clicking the 🗑 delete icon. We will attach the imported FortiGate image after the wizard. Click Next.
• CPU Tab — Assign vCPUs

  • Sockets: 1
  • Cores: 2 (minimum 1)
  • Type: host (best performance) or kvm64

  Click Next.
• Memory Tab — Assign RAM Set Memory (MiB) to 2048 (minimum 1024). Uncheck Ballooning Device for consistent FortiOS performance. Click Next.
• Network Tab — Add port1 (Management / WAN)

  • Bridge: vmbr10
  • Model: VirtIO (paravirt) or E1000
  • Uncheck Firewall (managed by FortiOS)

  Click Next.
• Confirm and Finish — Uncheck Start After Created Review the summary. Uncheck "Start after created" — we need to attach the disk first. Click Finish.

• Attach the Imported .qcow2 Disk In the Proxmox web UI, select VM 200 → Hardware → Add → Hard Disk. Alternatively, if the disk was already imported via the provisioning script, select Unused Disk 0 from the Hardware list and click Edit to add it as the primary boot disk.

  • Bus/Device: VirtIO Block or IDE — confirm against the Fortinet VM guide for your FortiOS version
  • Storage: local-lvm
  • Leave disk size as imported (typically 2 GB)

  Click Add.

  ℹ️

  Alternative: Import via Proxmox Shell

  If the disk was not pre-imported by the admin script, run this command on the Proxmox host shell:

  Proxmox Shell Copy

  root@pve:~# qm importdisk 200 /var/lib/vz/template/iso/FGT_VM64_KVM.qcow2 local-lvm --format qcow2

• Set Boot Order Go to VM 200 → Options → Boot Order. Enable the imported disk and move it to the top of the boot list. Disable network boot (PXE) if listed.
• Add port2 (Internal LAN NIC) Go to VM 200 → Hardware → Add → Network Device.

  • Bridge: vmbr20
  • Model: VirtIO (paravirt) or E1000
  • Uncheck Firewall

  Click Add. You should now have two network devices under Hardware: net0 → vmbr10 and net1 → vmbr20.
• Verify Hardware Summary Before booting, confirm the VM 200 Hardware tab shows:

  • ✅ 2 vCPU (Sockets: 1, Cores: 2)
  • ✅ 2 048 MiB RAM, Ballooning off
  • ✅ Boot disk: local-lvm:vm-200-disk-0
  • ✅ Network Device 0: vmbr10 (port1)
  • ✅ Network Device 1: vmbr20 (port2)

• Start the VM and Open the Console Click Start on VM 200. Then click Console to open the Proxmox noVNC console. Wait for FortiOS to boot — this typically takes 60–90 seconds. You should see the FortiOS login prompt.

  ✅

  Expected Output

  You should see: FortiGate-VM64 login: at the console. If you see BIOS errors or a boot loop, revisit the boot order and disk attachment settings.

• Log In with Default Credentials

  FortiOS Console — First Login Copy

  FortiGate-VM64 login: admin
  Password: (press Enter — no password on first boot)

  FortiOS will prompt you to set a new password immediately.
• Set the Admin Password

  FortiOS Console Copy

  You are forced to change your password. Please input a new password.
  New Password: YourSecurePass123!
  Confirm Password: YourSecurePass123!

  ⚠️

  Password Policy

  FortiOS requires a minimum 8-character password including uppercase, lowercase, and a number or symbol. Record your password in the ITSM asset record.

• Assign Management IP to port1 Configure port1 with the management IP address from the locked address table:

  FortiOS CLI — port1 Management IP Copy

  fortigate-vm01 # config system interface
  fortigate-vm01 (interface) # edit port1
  fortigate-vm01 (port1) # set mode static
  fortigate-vm01 (port1) # set ip 10.10.0.6 255.255.128.0
  fortigate-vm01 (port1) # set allowaccess https ssh ping
  fortigate-vm01 (port1) # set description "Management-WAN"
  fortigate-vm01 (port1) # next
  fortigate-vm01 (interface) # end

• Configure port2 for Internal LAN

  FortiOS CLI — port2 LAN IP Copy

  fortigate-vm01 # config system interface
  fortigate-vm01 (interface) # edit port2
  fortigate-vm01 (port2) # set mode static
  fortigate-vm01 (port2) # set ip 172.31.1.1 255.255.255.0
  fortigate-vm01 (port2) # set allowaccess ping
  fortigate-vm01 (port2) # set description "Internal-LAN"
  fortigate-vm01 (port2) # next
  fortigate-vm01 (interface) # end

• Set the Default Gateway

  FortiOS CLI — Default Route Copy

  fortigate-vm01 # config router static
  fortigate-vm01 (static) # edit 1
  fortigate-vm01 (1) # set device port1
  fortigate-vm01 (1) # set gateway 10.10.0.254
  fortigate-vm01 (1) # next
  fortigate-vm01 (static) # end

• Set Hostname

  FortiOS CLI — Hostname Copy

  fortigate-vm01 # config system global
  fortigate-vm01 (global) # set hostname fortigate-vm01
  fortigate-vm01 (global) # end

• Verify Current License Status via CLI

  FortiOS CLI Copy

  fortigate-vm01 # get system status
  Version: FortiGate-VM64 vX.X.X
  Serial-Number: FGVMEVXXXXXXXX
  License Status: Valid / Evaluation / Invalid

• Option A — Register License via FortiGate GUI

  1. Open your browser and go to https://10.10.0.6
  2. Log in with admin and the password you set
  3. If prompted by the license wizard, enter your FortiGate VM serial number and follow the Fortinet registration workflow
  4. Go to System → FortiGuard and click Update Now to pull license status from Fortinet's servers
• Option B — Register License via CLI (offline or eval)

  FortiOS CLI Copy

  fortigate-vm01 # execute update-now
  Updating license and signatures from FortiGuard...
  
  # Verify after update:
  fortigate-vm01 # diagnose debug vm-print-license

  ⚠️

  Internet Access Required for Online Activation

  The FortiGate must reach Fortinet's FortiGuard servers to validate licenses online. If the lab environment has no internet path via port1, use an offline license file supplied by your Fortinet account team or lab administrator.

Troubleshooting

root@pve:~# qemu-img info /var/lib/vz/template/iso/FGT_VM64_KVM.qcow2
image: FGT_VM64_KVM.qcow2
file format: qcow2
virtual size: 2 GiB (2147483648 bytes)
disk size: 1.2 GiB

root@pve:~# pvesm list local-lvm | grep vm-200

fortigate-vm01 # show system interface port1
config system interface
    edit "port1"
        set mode static
        set ip 10.10.0.6 255.255.128.0
        set allowaccess ping https ssh
    next
end

fortigate-vm01 # get hardware nic port1
name: port1
MAC: 00:xx:xx:xx:xx:xx
Link: up
Speed: 1000Mbps

fortigate-vm01 # get system status
fortigate-vm01 # diagnose debug vm-print-license
fortigate-vm01 # execute ping guard.fortinet.net

root@pve:~# qm list
root@pve:~# qm unlock 200
root@pve:~# qm start 200

root@pve:~# ip link show type bridge
root@pve:~# brctl show

Verification

Complete all verification steps in order. Each step corresponds to a success criterion from the service request. Document your results in the ITSM asset record.

root@pve:~# qm list
      VMID NAME                 STATUS     MEM(MB)    BOOTDISK(GB) PID
       200 fortigate-vm01       running    2048              2.00 12345

fortigate-vm01 login: admin
Password: YourSecurePass123!
Welcome!

fortigate-vm01 # get system status
Version                   : FortiGate-VM64 v7.x.x,build xxxx (GA)
Virus-DB                  : ...
IPS-DB                    : ...
Serial-Number             : FGVMEV0000000000
License Status            : Valid
VM Resources              : 2 CPU/2048MB RAM
Hostname                  : fortigate-vm01
Operation Mode            : NAT

C:\Users\Admin> ping 10.10.0.6
Pinging 10.10.0.6 with 32 bytes of data:
Reply from 10.10.0.6: bytes=32 time=1ms TTL=64
Reply from 10.10.0.6: bytes=32 time=1ms TTL=64
Reply from 10.10.0.6: bytes=32 time=1ms TTL=64
Reply from 10.10.0.6: bytes=32 time=1ms TTL=64

Ping statistics for 10.10.0.6:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Knowledge Check

Answer each question to test your understanding of FortiGate VM deployment on Proxmox VE. Select the best answer and click Check Answer.

Progress: 0 / 8 correct