FortiGate-VM on serverplus: a virtual firewall

FortiGate-VM is a virtual next-generation firewall (NGFW) from Fortinet running on its own FortiOS. Essentially it is a software equivalent of the hardware FortiGate: it filters traffic, builds VPNs, catches attacks and controls what happens on the network — only as a virtual machine in the cloud.

On serverplus you do not need to assemble it by hand — the panel has a ready-made FortiGate image. You create a server from the image and get a full security gateway with a web management interface.

What FortiGate can do

• Firewall and NAT. Rules for who can go where; address translation, port forwarding.
• VPN. Site-to-site (IPsec) between locations and remote employee access (IPsec/SSL-VPN).
• IPS and application control. Detecting and blocking attacks, restricting unwanted apps and site categories (web filter).
• Threat protection (UTM). Traffic antivirus, anti-bot, SSL inspection — as a single node on the perimeter.
• SD-WAN and routing. Link balancing, flexible traffic routing.
• Logs and reports. Visibility: who, where, how much — and what was blocked.

Why FortiGate in the serverplus cloud

• Perimeter protection. A single control point for inbound and outbound traffic of your cloud servers.
• Secure remote access. VPN for employees and branches to cloud resources — without exposing services directly to the internet.
• Segmentation. Separating environments (web, database, office) and rules between them.
• A single standard. The same FortiOS as on physical FortiGates — familiar management and policies.

About the license — important up front. The license is not included in the image — you must bring your own (BYOL): buy it from Fortinet or a partner and upload the license file into FortiGate. Without a license FortiGate-VM runs only in evaluation mode (a ~15-day trial, with limits: reduced performance, weak encryption, no IPS/antivirus database updates).

Recommended configuration

• CPU and RAM. To start — 1–2 vCPU and 2–4 GB RAM. For real traffic with UTM enabled (IPS, antivirus, SSL inspection) — more cores and memory; performance also depends on the license.
• Disk. Small for the OS itself; leave headroom for logs (type ssd-universal). The more events, the more space.
• Network. A public IP for the external interface and management access; internal interfaces — to the protected networks.

Step 1. Create a server from the FortiGate image

In the cloud.serverplus.uz panel, start creating a server and, at the image selection step, choose FortiGate:

• Location. Choose the region (for example uz-tas1 / RegionOne).
• Image. In the image list select FortiGate and, if available, the FortiOS version.
• Configuration. Set vCPU/RAM per the recommendations and a disk with headroom for logs.
• Network. Enable a public IP. If you plan FortiGate as a gateway — provide external and internal interfaces (networks).
• Create the server and wait for it to boot.

Step 2. First login to the web interface

• Open the management panel in a browser at the management interface address: https://your_server_IP (in evaluation mode only http:// may be available).
• Log in with the default: username admin, password empty (just press log in).
• Set the administrator password immediately — the system asks for it on first login. Management is also available over SSH (the FortiOS CLI).

Evaluation mode and HTTPS. Without a license only weak encryption is available, and secure management access (HTTPS) may not work until the license is activated. Install the license as early as possible — then the full functionality and proper HTTPS open up.

Step 3. Basic configuration

Everything else is configured in the FortiGate interface. The minimal set:

• Interfaces. Check the addresses and allowed access on the ports (System → Interfaces). Example via the CLI:

config system interface  edit port1    set ip 10.0.0.10/24    set allowaccess ping https ssh  next end

• Firewall policies. Policy & Objects → Firewall Policy — rules for what traffic is allowed and where, with NAT. By default everything not explicitly allowed is denied.
• VPN (if needed). IPsec to connect locations or SSL-VPN for remote access — in the VPN section.

Step 4. License and updates

• Activate the license (BYOL). The license is bought separately from Fortinet or a partner — it is not included in the image. In the licensing section / System → FortiGuard upload your license file: this removes the evaluation-mode limits.
• Updates. With an active subscription the IPS/antivirus/web-filter databases (FortiGuard) update and FortiOS updates are available. Update the firmware on a schedule, taking a snapshot beforehand.

Security

• Change the admin password and create separate administrator accounts; enable two-factor authentication.
• Restrict management access. Allow the GUI/SSH only from trusted addresses (trusted hosts); do not expose the management interface openly to the internet.
• A separate management port. Where possible, move admin access to an internal interface or through a VPN.
• Backups. Regularly save the FortiGate configuration (System → Configuration) and take a server snapshot in the serverplus panel before changes.
• Update FortiOS — fresh versions close vulnerabilities.

FAQ

What is FortiGate-VM in simple terms?

It is Fortinet's virtual firewall — a "smart" gateway through which your servers' traffic passes: it filters the traffic, builds VPNs, blocks attacks and keeps logs. The same as a hardware FortiGate, but as a VM in the cloud.

Is a license needed and what happens without one?

Yes. The license is not included in the serverplus image — you need your own (BYOL): it is bought from Fortinet or a partner and uploaded into FortiGate. Without it the device stays in evaluation mode: limited performance, weak encryption, no security database updates, and reduced features.

What are the default login and password?

Username admin, an empty password on first login — set your own right away. Management is the web interface by IP and the CLI over SSH.

How is this different from ufw/firewalld on a regular server?

ufw/firewalld is a simple packet filter on a single server. FortiGate is a security gateway for the whole network: besides rules, it provides VPN, IPS, application control, web filtering, traffic antivirus and centralized logs.

How many resources are needed?

To start — 1–2 vCPU and 2–4 GB RAM. For traffic with UTM enabled — more; the actual throughput is also limited by the license.

How do you manage FortiGate?

Through the web interface (GUI) at the device address, via the CLI over SSH, and for a fleet of devices — centrally from FortiManager. Logs and reports are conveniently collected in FortiAnalyzer.