Creating an MVE Integrated with Fortinet

​

Basic steps

• Obtain a license from Fortinet.
• Generate an SSH key pair for authentication.
• Create the Fortinet MVE in the Megaport Portal.
• View the MVE public IP address assignment in the Megaport Portal.
• Set an admin password for the FortiGate.
• Allow secure console access to the FortiGate.
• Add the FortiGate to FortiManager Cloud (optional).

​

Licensing

1. Log in to your registration account at Fortinet Support.
2. Choose Register Product and enter the provided registration code.
3. Follow the registration process.
   Fortinet generates the serial number and displays it on the Registration Completion page.
4. Choose Manage > View Products and click the serial number.
5. Click the download link and save the license file.
   You will upload the license file later in the Megaport Portal.

1. Deploy the FortiGate VM on MVE without choosing to upload a license file.
2. Access the FortiGate VM CLI by establishing a using the SSH session.
3. Copy the license token provided from your FortiFlex portal.
4. Inject the license token into the VM using the CLI.
5. Reboot the FortiGate VM when prompted.

​

Administrative access to MVE

• Enter the SSH keygen command in the terminal.
  ssh-keygen -f ~/.ssh/megaport-mve-instance-1-2048 -t rsa -b 2048
  

• megaport-mve-instance-1-2048 - contains the private key.
• megaport-mve-instance-1-2048.pub - contains the public key that is authorized to log in to the vendor account.

1. Open PuTTYgen.
2. In the Key section, choose RSA 2048 bit and click Generate.
3. Move your mouse randomly in the small screen to generate the key pairs.
4. Enter a key comment to identify the key.
   This is convenient when you use several SSH keys.
5. Enter a Key passphrase, and re-enter to confirm.
   The passphrase is used to protect your key. You will be asked for it when you connect via SSH.
6. Click Save private key, choose a location, and click Save.
7. Click Save public key, choose a location, and click Save.

​

Creating an MVE in the Megaport Portal

1. In the , go to the Services page.
2. Click Add Service, then select Virtual Edge (MVE). The Create Virtual Edge page opens. Complete the sections on this page to configure your MVE. The order summary updates as you make selections. On wider screens, the summary is displayed in a panel on the right. On narrower screens, it is displayed in a bar at the bottom of the page that you can expand.
3. In the Details section, specify these fields:
   • MVE Name — Specify a name that helps you identify the MVE, particularly if you plan to have more than one MVE. This name appears in the Megaport Portal.
   • Service Level Reference (optional) — Specify a unique identifying number for your Megaport service to be used for billing purposes, such as a cost center number, unique customer ID, or purchase order number. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.
   • Project (optional) — Select a project to add the MVE to, or leave the default (No Project).
     You can type in the field to search by project name. The selected project appears in the order summary, and the MVE is added to it when provisioned. To create a project without leaving the page, select New Project at the bottom of the list, then specify a project name and description. The new project is automatically selected for the order.
     You need permission to manage projects to create a project. Without this permission, the New Project option does not appear, but you can still select an existing project.
4. In the Select Vendor / Product section, select Fortinet FortiGate-VM, then select the software version.
   To find the product, browse the category tabs or use the Search vendors field. The locations, sizes, and configuration fields available on the rest of the page depend on the product you select.
5. In the Location section, specify these fields:
   • Location — Select your preferred location. Use the Search field to find a location by metro or country name. Alternatively, browse the region tabs, then select a location.
     Only locations where the selected product is available are listed. Select a location geographically close to your target branch or on-premises locations. The country you choose must be a market in which you have already registered. If you have not registered a billing market in the location where you will deploy the MVE, follow the procedure in Enabling Billing Markets.
   • Mode — Select Auto to have Megaport automatically choose a provider and data center at the selected location. Select Manual to choose the provider and data center yourself.
   • Diversity Zone — Select Red or Blue, or select Auto to have Megaport select the zone for you. The selected diversity zone appears in the order summary. For more information, see MVE Diversity.
6. If you selected Manual mode, select a data center provider in the Provider section, then select a data center from the drop-down list in the Data Center section.
   Only providers and data centers available at your selected location are listed.
7. In the MVE Size section, select a size.
   Each size shows its vCPU and RAM allocation. For example, Small (MVE 2/8) has 2 vCPUs and 8 GB of RAM. Only sizes supported by the selected product are listed, and sizes that are not available at the selected location are grayed out and labeled Not available here. The sizes support varying numbers of concurrent connections, and individual partner product metrics vary slightly.
   If the MVE size you want is not available, there is not enough capacity at the selected location. You can either select another location with enough capacity or contact your Account Manager to discuss requirements.
8. In the Vendor Configuration section, specify the Fortinet-specific settings:
   • Appliance Licence (optional) — If you have purchased a license from Fortinet, click Choose file, then select the appliance license file generated earlier from Fortinet.
     If you are using FortiFlex, skip this field.
   • SSH Key — Copy and paste the contents of your public SSH key here. You can find the public key in the megaport-mve-instance-1-2048.pub file generated earlier.
   • Virtual Interfaces (vNICs) — Fortinet is configured with one vNIC named Data Plane by default. To change a name, type over the name text in the box. You can also change the vNIC name later, after the MVE has been deployed. You cannot remove a default vNIC. You can add a total of five vNICs to the MVE, including the one added by default. To add a vNIC, click Add, then specify a name for the vNIC. For more information, see Types of vNIC Connections.
     If you want to increase or decrease the number of vNICs on this MVE after it has been deployed, you must delete the entire MVE and recreate it. You cannot add or delete vNICs on a deployed MVE.
9. In the Pricing section, specify these fields:
   • Contract Term — Select a contract term: No Minimum Term, 12 Months, 24 Months, 36 Months, 48 Months, or 60 Months. Longer terms result in a lower monthly rate. The default is 12 Months.
   • Contract Renewal — Automatically renews the contract at the same price and term length when the current term ends. The initial setting comes from your company default. If you disable it, the contract rolls over to a month-to-month term at the end of the current term, without the term discount. Contract Renewal is not available when you select No Minimum Term. For more information, see Managing Minimum Term Renewal and MVE Pricing and Contract Terms.
10. In the Resource Tags section, add any tags you want to apply to this MVE.
    To add a tag, click Add New Tag, then specify these fields:
    • Key — Specify a lowercase string with a maximum length of 128 characters. Valid characters are lowercase letters, numbers, and - . _ : / \.
    • Value — Specify a string with a maximum length of 256 characters. Valid characters are letters, numbers, spaces, and - . _ : @ / + \. Repeat for each tag. You can add up to 50 tags.
    Never include sensitive information in a resource tag. Sensitive information includes commands that return existing tag definitions and information that identifies a person or company.
    The price in the order summary updates dynamically based on your selections. Note that some partner-managed accounts do not display the pricing details.
11. Review the order summary, then click Add MVE. The newly created MVE is added to your cart under Configured Services, ready for checkout. You are prompted to create a Megaport Internet connection. A Megaport Internet connection provides connectivity and allows MVE to register and communicate with Fortinet SD-WAN.

1. Click Create Megaport Internet to proceed (recommended), or click Not now to provision internet access at a later time.
   MVE requires connectivity to the internet onto the management plane virtual interface. You can either provision a Megaport Internet connection or configure a third-party internet connection using a private VXC. We strongly recommend that you create a Megaport Internet connection for the initial MVE startup and deployment to ensure that the MVE is provisioned and functioning correctly.
2. Select the target Port (the internet router).
   The B-End of a Megaport Internet connection can be anywhere that Megaport Internet is available.
   You can use the Search field to find the Port name, Country, Metro City, or address of your destination Port. You can also filter by diversity zone.
3. Click Next.
4. Specify the connection details:
   • Connection Name — The name of your Megaport Internet connection to be shown in the .
   • Service Level Reference (optional) — Specify a unique identifying number for your Megaport service to be used for billing purposes, such as a cost center number, unique customer ID, or purchase order number. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.
     Use the same Service Level Reference numbers for the Megaport Internet connection and MVE to help identify the matching pair in your invoice.
   • Rate Limit — The speed of your connection in Mbps. The rate limit is configurable starting from 20 Mbps and can scale to several Gbps or more, in 1 Mbps increments. Available speed tiers might vary by location and service type. You can change the speed as required after you create the Megaport Internet connection. Monthly billing details appear based on location and rate limit.
   • VXC State — Select Enabled or Shut Down to define the initial state of the connection. For more information, see Shutting Down a VXC for Failover Testing.
     If you select Shut Down, traffic will not flow through this service and it will behave as if it was down on the Megaport network. Billing for this service will remain active and you will still be charged for this connection.
   • A-End vNIC — Select vNIC-0 for initial management access.
   • Preferred A-End VLAN (optional) — Select Untagged to remove VLAN tagging and allow first-time administrative login to the device.
   • Minimum Term — Select No Minimum Term, 12 Months, 24 Months, 36 Months, 48 Months, or 60 Months. Longer terms result in a lower monthly rate. 12 Months is selected by default. Take note of the information on the screen to avoid early termination fees (ETF). Select Automatically Renew at the same price at the end of Contract Term for services with a 12, 24, 36, 48 or 60-month term to automatically renew the contract at the same discounted price and term length at the end of the contract. If you don’t renew the contract, at the end of the term, the contract will automatically roll over to month-to-month contract for the following billing period, at the same price, without term discounts. For more information, see Managing Minimum Term Renewal. For more information, see Megaport Internet Pricing and Contract Terms and VXC, Megaport Internet, and IX Billing.
   • Resource Tags — You can use resource tags to add your own reference metadata to a Megaport service.
     To add a tag:
     1. Click Add Tags.
     2. Click Add New Tag.
     3. Enter details into the fields:
        • Key — String, maximum length 128 characters. Valid values are a-z 0-9 _ : . / \ -
        • Value — String, maximum length 256 characters. Valid values are a-z A-Z 0-9 _ : . @ / + \ - and spaces
     4. Click Save. If you already have resource tags for that service, you can manage them by clicking Manage Tags.
     Never include sensitive information in a resource tag. Sensitive information includes commands that return existing tag definitions and information that will identify a person or company.
5. Click Next to proceed to the connection detail summary.
6. Click Add VXC to move this configuration to your cart.
7. Click Review Order to proceed through the checkout process, or click Save to save the configured services before placing the order.
8. Review the Important Information section and confirm agreement with the Service Agreements. If you do not have a promotion code, skip to the Order Now step. If you do have a promotion code, enter it into the Enter discount code field then click Apply. Alternatively, if a code already appears in the Discounts field, verify it is correct and click Apply. The promotional discount appears below the Standard Term discount. This discount is not reflected in the Monthly Rate shown here, it is applied at the time of billing. If an invalid or expired code causes an error with your order, contact your Megaport Account Manager for a replacement code. If you entered an incorrect promotion code, you can remove it by clicking Remove.
   In addition to entering a promotion code manually, there are two other ways to apply promotion codes.

   • Auto-apply — Megaport automatically applies the promotion code to your order. It appears automatically on the Checkout page.
   • Manual list — Eligible promotion codes appear at checkout for any applicable services in your cart. You can then select and apply them.
9. Click Order Now.

​

Viewing the MVE in the Megaport Portal

• Go to the Services page.

1. On the Services page, click Details in the Actions section for the Megaport Internet connection.
   The Connection Details page appears. From here, you can modify any of the Megaport Internet connection details.
2. Select the Details tab.
3. Locate the Assigned IPv4 Address and Assigned IPv6 Address fields.
   These are the public IP addresses assigned to the MVE.

​

Allow console access to the FortiGate

1. SSH to the Fortinet MVE instance using the SSH private key generated earlier. The default username is admin, followed by the public IP address assigned to the device by Megaport.
   ssh -i ~/.ssh/megaport-mve-instance-1-2048 admin@162.43.xx.x
   
   Once in the FortiOS CLI, you can view system status and allow access to the device using CLI commands.
   The FortiOS CLI differs from the standard NOS CLI or Linux shell.
2. Configure a password for the user admin account.
   FGVM08TM21001375 # config system admin
   FGVM08TM21001375 (admin) # edit admin
   FGVM08TM21001375 (admin) # set password xxxxxxxx
   FGVM08TM21001375 (admin) # next
   FGVM08TM21001375 (admin) # end
   
3. Allow HTTPS access to the public interface GUI on port 1.
   FGVM08TM21001375 # config system interface
   FGVM08TM21001375 (interface) # edit port1
   FGVM08TM21001375 (port1) # append allowaccess https
   FGVM08TM21001375 (port1) # next
   FGVM08TM21001375 (interface) # end
   
   FGVM08TM21001375 #
   
4. Verify that HTTPS access is allowed.
   FGVM08TM21001375 # show system interface
   

​

Supply the FortiFlex license token

exec vm-license <license_token>

exec vm-license 58923569A3FFB7F46879

​

Add the FortiGate to FortiManager Cloud

1. Log in to the FortiGate GUI: https://162.43.xx.x
2. Select Device Manager.
3. From the Device Dashboard, Choose Security Fabric > Fabric Connectors.
4. Select FortiManager and click Edit.
5. Select the following settings:
   • Status - Enabled
   • Type - FortiManager Cloud
   • Mode - Normal
6. Click OK. The FortiCloud contacts your registered FortiManager Cloud for approval. The registration process does not require an IP address but instead uses backend authentication through prior registration and licensing.

​

Authorize the FortiGate in FortiManager

1. Log in to your FortiManager Cloud instance at Fortinet Support.
2. Choose Services > FortiManager. You will see an unauthorized device awaiting approval.
3. Click Unauthorized Devices, and then select the device to authorize.
4. Click Authorize.
5. You can optionally change the device name, apply a preconfigured policy package, or apply a preconfigured provisioning template to the device.
6. Click OK when you are satisfied with the configuration.
   A green check mark indicates the FortiGate was authorized by FortiManager.
7. Click Close.

​

Next steps