FortiGate Security VPC Deployer

Customer & Cloud

Customer identity and AWS region. All resource names are derived from CID and Customer Name.

Deployment mode

Security VPC

Full deployment — VPC, subnets, TGW, 4-NIC FortiGate

Standalone FortiGate

FG only — deploys into existing Horizon VPC as VPN concentrator

Customer identity

CID

Customer ID — used as prefix on all resources

Customer name

AWS configuration

Region

Selecting a region validates your credentials against it

AWS credential method

VPC & Subnets

Enter the VPC CIDR — all subnet CIDRs and FortiGate static IPs are calculated automatically.

VPC

VPC name: —

VPC CIDR — must be a /23

Horizon VPC

Horizon VPC CIDR

ⓘ Click this field then click outside to auto-populate subnets from AWS

Horizon Infra01 CIDR

FortiGate address object + TGW attachment (AZ-A)

Horizon Infra02 CIDR

FortiGate address object + TGW attachment (AZ-B)

Horizon Desktop01 CIDR

FortiGate address object

Horizon Desktop02 CIDR

FortiGate address object

Security Group

A single security group is created and applied to all FortiGate interfaces. The FortiGate firewall policies enforce actual traffic control.

Security group — applied to all FortiGate NICs

CID-CUSTNAME-FG-SG

Direction	Protocol	Port	CIDR
Inbound	All	All	0.0.0.0/0
Outbound	All	All	0.0.0.0/0

Transit Gateway

Default route table association and propagation are disabled per design.

TGW mode

TGW name

—

Auto-named from CID and Customer Name

BGP ASN

FortiGate

Instance sizing, FortiFlex licensing, and initial configuration. Static IPs are set automatically from the VPC CIDR.

Instance

Instance type

FortiOS version

HA mode

FortiFlex licensing & credentials

⚠ Credentials required before deploying

The following secrets must be set in Step 5 before running a deployment:
fgt_api_token — REST API token (choose any strong random string, e.g. 32+ chars — created automatically on the FortiGate via cloud-init)
flex_token_a — FortiFlex token for FG01
flex_token_b — FortiFlex token for FG02 (HA only)
fgt_admin_pass — FortiGate admin password
ha_password — HA cluster password (HA only)
fortimanager_user — FortiManager API admin username
fortimanager_pass — FortiManager API admin password
fortianalyzer_user — FortiAnalyzer API admin username
fortianalyzer_pass — FortiAnalyzer API admin password

Edit with: Enter the credentials in Step 5 — FortiGate Settings.

Access

Admin username

EC2 key pair

PEM file (upload to store in DB)

No file selected

Static IP assignment (auto-calculated)

Interface	Port	Subnet	Static IP
Public (WAN)	port1	—	—
LAN	port2	—	—
HA	port3	—	—
MGMT	port4	—	—

System settings

Timezone

Enable IPS + security profiles

Credentials

FortiGate admin password

Stored securely in the database.

FG01 FortiFlex token

Unique per-device token from the FortiFlex portal

FG02 FortiFlex token (HA mode only)

Required when HA is enabled

HA cluster password (HA mode only)

Used to authenticate FG01↔FG02 heartbeat traffic. Auto-generated and saved on first HA deployment for this customer — leave blank unless you need to set a specific value.

Preview & Deploy

Review generated configuration before running.

Management platform registration

Deployment output

Waiting to start...

Ansible output

Ready. Press Run deployment on the previous step to begin.

← Back to Customer List

Manage:

Live configuration on the deployed FortiGate

Address Objects

Address Groups

Service Objects

Service Groups

Firewall Policies

Static Routes

CLI Console

Change Log

Address Objects