FortiGate VM

Why do you need FortiGate VM?

A policy that is written twice is a policy that will differ. That is the cybersecurity argument for running the same firewall software on an appliance and in the cloud — not performance, but the ability to say what the rule is without checking which environment you are in.

A policy maintained separately in each cloud drifts apart at the first change you do not repeat everywhere. Separate tools on-premises and in the cloud leave blind spots in the virtual infrastructure.

FortiGate VM is a virtual NGFW running the same FortiOS that runs on physical appliances, in containers and as a cloud service. vSPU technology moves part of packet processing to user space, bypassing the operating system kernel. Fortinet states that FortiGate VM enforces uniform policies across all clouds and the transit paths between them.

How does it work?

vSPU Acceleration

Software acceleration:

• Virtual Security Processing Unit (vSPU) and vNP
• Kernel bypass using DPDK
• The same policy set as on physical appliances, with no rule translation
• Intel QuickAssist (QAT) accelerates IPsec VPN tunnels

Multi-Cloud Deployment

Integration with cloud networks:

• AWS — Marketplace; SD-WAN with AWS Cloud WAN and AWS Transit Gateway
• Azure — Azure vWAN
• Google Cloud — Google Cloud Interconnect
• Oracle OCI, Alibaba Cloud, IBM Cloud
• Terraform modules, CloudFormation templates, Ansible playbooks

FortiOS Foundation

The same system as on appliances:

• All FortiOS security and networking services
• One policy and one management framework
• FortiGuard services
• Central management with FortiManager
• A consistent security posture across clouds and on-premises

Key Features

Full NGFW Capabilities

• Firewall policies
• Application control
• IPS with virtual patching
• Antivirus and sandboxing (FortiGate Cloud Sandbox)
• URL and DNS filtering
• SSL inspection

Cloud Integration

• REST API and JSON-RPC
• Auto-scaling and load balancing
• Policies based on cloud tags and identity
• Integration with Azure Security Center, AWS Security Hub and Google Cloud Security Command Center

SD-WAN & ZTNA

• Secure SD-WAN across the hybrid cloud
• ZTNA enforcement in FortiOS
• VPN gateway for VPCs and remote access VPN
• Site-to-site IPsec VPN for the hybrid cloud

Visibility & Control

• East-west and north-south traffic in VMware NSX-T
• Virtual domains (VDOMs) to separate segments
• Log forwarding to cloud SIEM and SOAR platforms
• FortiAnalyzer Cloud in the service offering

FortiGate VM Models

Licensing by number of vCPUs: 1, 2, 4, 8, 16, 32 and unlimited vCPUs, with no RAM restrictions. Fortinet lists firewall throughput for each model on the product page; in practice it depends on the platform, the instance type and the features enabled.

Supported private platforms:

• VMware ESXi and VMware NSX-T
• Microsoft Hyper-V and Azure Stack
• KVM/QEMU
• Nutanix AHV
• Citrix XenServer and Xen

Licensing Models

BYOL (Bring Your Own License):

• Your own license assigned to an instance in the cloud or on-premises
• Annual subscriptions by number of vCPUs

On-demand (pay-as-you-go):

• Billing through the cloud provider’s marketplace
• An instance bought through the marketplace comes with the FortiGuard UTP bundle
• FortiFlex — usage-based licensing when workloads change

Who is it for?

• Organizations with workloads in several public clouds
• Companies moving applications to the cloud that want to keep their headquarters policies
• Teams automating deployments (Terraform, Ansible, REST API)
• Data centers on VMware, Hyper-V or KVM

Benefits

For IT: the same FortiOS skills, one management framework, deployment as code

For security: uniform policies, FortiGuard services, a full NGFW in the cloud

For business: a choice of licensing model (BYOL, on demand, FortiFlex), scaling as needs change

Specification

OS	FortiOS (the same as on appliances)
Platforms	VMware, Hyper-V, KVM, Nutanix, AWS, Azure, Google Cloud, OCI
vCPU	from 1 to unlimited, no RAM limit
Licensing	BYOL, on demand, FortiFlex

When does FortiGate VM make sense for your organization?

A virtual firewall makes sense where there should be one policy but there are several environments: your own data center, a private cloud, a public cloud. Below are three typical situations.

Segmentation in the data center

In a VMware data center, traffic between virtual machines often does not pass through any firewall, because the physical appliance sits at the network edge. FortiGate VM integrated with VMware NSX-T controls east-west and north-south traffic inside the virtualized data center. Rules can be based on tags and identity rather than only on IP addresses, which change quickly in a virtual environment. Virtual domains (VDOMs) let you separate segments — for example production and the development environment — with their own policies and administrators; additional VDOMs on the S-series require a separate license.

A branch in the private cloud

When a branch’s applications move to a private or public cloud, the connection to headquarters stops being a line between two buildings. FortiGate VM works as an IPsec VPN gateway for the hybrid cloud and as a remote access concentrator, and Secure SD-WAN connects to cloud transit services such as Azure vWAN or AWS Transit Gateway. Policies for the branch, headquarters and the cloud are maintained in FortiManager. In the public cloud, an instance can be bought from the marketplace with the FortiGuard UTP bundle or run on your own BYOL license.

A test environment before replacing hardware

In a mid-sized company with a small IT team, replacing a firewall is a downtime risk if the new configuration meets production traffic for the first time on cutover day. Because FortiGate VM runs the same FortiOS as physical appliances, a migrated configuration — including one converted from another vendor’s firewall with the FortiConverter service — can be checked on a virtual machine before it goes onto the new hardware. The test checks rules and objects, not the performance of the physical appliance’s SPU chips — cutover day then comes down to moving a configuration that has already been verified.

Which scenario to start with depends on the inventory: which environments already exist and where the boundary between them runs today.

Why deploy FortiGate VM with nFlo?

A virtual firewall installs in moments, but its value depends on whether traffic actually passes through it. In a FortiGate VM project, the nFlo team:

• inventories environments, virtual networks and traffic flows in the data center and in the cloud,
• designs segmentation, routing to the firewall, high availability and the licensing model,
• deploys and migrates policies, including testing the configuration on a virtual machine before replacing hardware,
• maintains the platform: rule reviews, FortiOS updates and ticket handling.

The project scope is described in the Firewall Implementation service. Start a conversation about your environment through contact; you can read about nFlo’s cooperation with the vendor on the Fortinet page.

FAQ

How does FortiGate VM differ from FortiGate CNF? FortiGate VM is a virtual machine the customer deploys and runs — with a choice of FortiOS version, scaling and availability. FortiGate CNF is a service (SaaS) on AWS and Azure in which Fortinet runs the infrastructure. VPN and SD-WAN in the cloud are provided by FortiGate VM.

What performance does FortiGate VM achieve? It depends on the number of vCPUs, the platform or instance type, and the features enabled; Fortinet publishes throughput for each model on the product page. vSPU moves part of packet processing to user space, and Intel QAT accelerates IPsec VPN. Performance is worth measuring on the target platform.

Does FortiGate VM have all FortiOS features? Yes. According to the data sheet, FortiGate VM supports all FortiOS security and networking services — firewall, SD-WAN, ZTNA, IPS, antivirus, URL filtering.

Which cloud platforms are supported? AWS, Azure, Google Cloud, Oracle OCI, Alibaba Cloud and IBM Cloud, and on-premises VMware ESXi and NSX-T, Hyper-V, KVM, Xen and Nutanix AHV.

How does licensing work? BYOL (a subscription by number of vCPUs) or on-demand billing through the cloud provider’s marketplace; a marketplace instance comes with the FortiGuard UTP bundle. For variable usage, FortiFlex licensing is available.

Can I use FortiManager for VM? Yes. FortiManager centrally manages FortiGate VM together with physical appliances, as well as FortiSwitch and FortiAP.

How does auto-scaling work? FortiGate VM uses cloud auto-scaling and load balancing, and the deployment is described as code: Terraform modules, CloudFormation templates, Ansible playbooks and the REST API.

Does FortiGate VM support containers? FortiOS also runs as a container, and FortiGate VM integrates with cloud security services. Protection for a specific container platform should be confirmed in the documentation before the project.

How to move license between clouds? The licensing model is chosen to fit where you deploy: BYOL for instances in different clouds and on-premises, on-demand billing in a given cloud’s marketplace, or FortiFlex for variable usage. The rules for moving a specific license are confirmed with Fortinet.

What does support look like? Fortinet provides vendor technical support through FortiCare. nFlo, as a Fortinet Advocate Partner, designs, deploys and maintains FortiGate VM.

Is FortiGate VM suitable for testing a configuration before replacing a hardware FortiGate? Yes, for testing rules and objects: FortiOS on the virtual machine is the same as on the appliance. A virtual machine will not reproduce the performance of hardware SPU chips, so the test does not replace model sizing.

What does vSPU technology provide? vSPU moves part of packet processing to user space and bypasses the operating system kernel (DPDK), which increases the throughput of the virtual firewall. IPsec tunnels additionally get Intel QuickAssist acceleration.

Does FortiGate VM protect east-west traffic in a VMware data center? Yes. FortiGate VM integrates with VMware NSX-T and controls east-west and north-south traffic in the virtualized data center as well as in private and public clouds.