• After login, you should see the Azure dashboard
• Locate your assigned resource group: flex[XX]

  

1. Click the Cloud Shell icon in the top navigation bar and Select Bash as the shell type

2. Wait for the Cloud Shell to initialize

• Next, you will see a “Getting started” page.

  • Select Mount Storage Account
  • Choose Internal-Training as the Storage account subscription
  • Click Apply

  

• On the Mount storage account screen

  • click Select existing storage account

  • click Next

    

• On the Select storage account screen (values in drop down)

  • choose Internal-Training as description

  • resource group will be “student number”-flex105-workshop

  • storage account name will be “student number” followed by some random numbers and letters

  • File share will be cloudshellshare

  • Click Select

    

Enter the credentials provided in the email you got from fortinetsecdevops@gmail.com

• Username: “flex[XX]@fortinetcloud.onmicrosoft.com”

• Temporary Access Password: “[TemporaryPassword]”

• You can choose No to “stay Signed In”

• You may have to click “Login” at the SAML Login Portal

From the FortiCloud Main Portal, look for “FortiFlex” in the main navigation menu

• Click to enter the FortiFlex dashboard

Navigate to Configurations

• In the FortiFlex dashboard, click “Configurations”

• You should see an empty list or existing lab configurations

  

• Click the + New Configuration button

You’ll see the configuration wizard. Enter details as follows:

• Name: XPerts25-FGT-VM (or any name you prefer)
• Select Form Factor: Virtual Machines
• Product Type: FortiGate Virtual Machine - Service Bundle
• Click Next

  

On the next screen, set the following details:

• Number of CPU’s: 2
• Service Package: UTP
• Leave Virtual domains set to 0
• Click Next

  

Review the details of your configuration and click Submit

You’ll see the config successfully created

Fill in the following details in the entitlement wizard:

• Product Type: Select FortiGate Virtual Machine - Service Bundle
• Select the configuration you created above in Step 1 from the dropdown
• Click Next

  

Review the details of your entitlement and click Submit

You’ll see the entitlement successfully created. Serial Number for future reference.

Click on List to go back to the Entitlement Listing and retrieve the Entitlement Token

From the entitlement details page, copy the License File Token. You will need this token to activate your FortiGate VM in the next step.

1. Under the Basics tab, the Subscription and Resource Groups should already be filled in with your assigned info. If not, see the screen shot below for details.

• Under Instance details, select/enter the following:
  • Region: East US
  • FGT VM instance Architecture: ARM64
  • FortiGate administrative username: flex[XX]
  • FortiGate password/Confirm password: FortinetAzure2025!
  • Fortigate Name Prefix: flex[XX]
  • Resource Group: flex[XX]-flex104-workshop
• Select Next.

In the Instance Details tab, scroll down to the License section, and check the box for Use FortiFlex Entitlement entering the License File Token you copied earlier.

In the Networking tab, scroll down to the Accelerated Networking section and select Disabled. This feature can be enabled with specific instance types but for this example it’s not relevant.

Review all the settings in the Review + create tab. Ensure that everything is correct, especially the License File Token. Click on Create to deploy the FortiGate VM.

You’ll see the deployment in progress. This may take a few minutes. Once completed, you can navigate to the resource to manage your FortiGate VM.

• In a new browser tab, enter the public IP address of the FortiGate VM in the address bar
• Accept the security warnings for the unsigned Cert.
• You will be prompted to log in.
• Use the username and password you set during the VM creation (e.g., flexXX and FortinetAzure2025!).

You can skip the inital setup be choosing Later

You’ll see the FortiGate Status Dashboard where the License will show 2 vCPU. The SN will match the entitlement you created in FortiFlex.

You can also verify the license via CLI. get system status You will see the matching SN, with Valid License, and the number of vCPU’s allowedreflecting the assigned entitlement.

Update the number of CPU’s to 4 and click Next until you reach the review screen.

Click Submit to save the changes

You will see a warning message, and you should click to Confirm the changes.

The entitlement linked this configuration will automatically reflect the vCPU change.

After resizing, start the FortiGate VM again from the Azure portal.

On the VM Overview Page, you can verify that the VM size has been updated to reflect the new vCPU count.

• In a new browser tab, enter the public IP address of the FortiGate VM in the address bar
• Accept the security warnings for the unsigned Cert.
• You will be prompted to log in.
  • Use the username and password you set during the VM creation (e.g., flexXX and FortinetAzure2025!).
  • You can skip the inital setup by choosing Later
  • You’ll see the FortiGate Status Dashboard where the License will show 2/4 Allocated vCPU
  • You can also verify the vCPU via CLI.
  • get system status
  • You will 2/4 vCPU.

    

To add the additional CPU’s to the FortiGate configuration, open the system CLI and run the following commands:

exec cpu add 2

Then verify the CPU count again:

get system status

You should now see 4/4 vCPU allocated.

• All variables used in the collection are stored at the highest level of the Collection.
• Click on Collection Title in the left sidebar, then click on the Variables tab
• You’ll see variables for
  • The API Base URLs
  • api_username and api_password for authentication
  • client_id for authentication (only used to override the automated client_id in the script)
  • access_token, and expires_as for storing Bearer tokens returned from authentication request for each client_id/request

• We’ve set up the FortiCloud Postman collection to automate the authentication process and store the access token for use in subsequent requests
  • You can see the scripting used to fetch Bearer tokens by clicking on the Scripts tab at the top level of the Collection, and viewing the Pre-request Script
  • Pseudocode

    1. Grab the URL of the request, along with the API Username and Password
    2. Set the authentication client_id depending on the path in the URL
    3. If (No bearer token or it's already ): get a new bearer token with api_username, api_password, and client_id
    4. Set the bearer token in the request header for the given request type

• 

Click on Add New –> API User

• Enter a username for the API User such as: flexapiuser
• Choose the SysAdmin Permission Profile
• Click Next

• When the API User is created, you will see a message to download the credentials.
• Click to download, and enter a password to encrypt the file, such as FortiFlex2025!

• You’ll get a password-protected zip file with the API credentials. Open it using the same password you entered when downloading the file.
• The folder will contain a single text file with the apiId and password
• You’ll enter the apiId and password into a Postman Collection Variables the next step

• Back in Postman, enter the newly created apiId and password into the Postman Collection Variables
• Copy the apiId from the credentials text file into the api_user Postman Current value variable
• Copy the password from the credentials text file into the api_password Postman Current value variable
• Click Save to save the collection variables

• From the top level FortiCloud Collection, open folder: FortiFlex V2.0–>Programs, and then POST Request: List
• Click the Send button

• You should see a response with a 200 OK status and 2 different serialNumber in the response body

Congratulations, you’re now authenticated with the FortiFlex API!

Next, we can retrieve a list of Entitlements by sending a request to the /entitlements/list endpoint.

• Open the Post List request from Entitlements folder in the collection
• enter the configId returned from the previous request into the Body of the Get Entitlements request, and click Send

• Open the reactivate request from the Entitlements folder in the collection
• Under the Body tab, enter the serialNumber you got from the previous request
• Click Send to enable the entitlement
• You should see a response with a 200 OK status and the entitlement status updated to “ACTIVE”
• You can verify this by sending the list request and checking the status, or by checking the WebUI

Initialize and run a Terraform plan to see what resources will be created:

terraform init
terraform plan 

You will be asked to provide values for the following variables:

• FortiFlex Entitlement Token: You can get this from the FortiFlex portal.
• FortiGate VM Username: Use your Workshop Username Prefix (e.g. Flex01)

Once you’ve provided the variables, you should see output with a plan of the resources Terraform will create

In a real production environment you would review the plan output to ensure it matches your expectations, and then apply the plan to deploy the FortiGate VM licensed by FortiFlex with the following command:

terraform apply

Also in a real production environment:

• your entire cloud infrastructure would be defined in code (Terraform)
• you would be using a version control system like Git to manage changes to your infrastructure
• all of your system variables would be stored securely in a secrets manager or environment variables, not hardcoded into your Terraform files
• You’d be using the FortiFlex Terraform provider to directly integrate with FortiFlex, not passing the Entitlement Token or Username “manually” as a variable
• This terraform deployment would ideally be running as part of a CI/CD pipeline to ensure consistent and repeatable deployments across your environments

Disregard the front page…those 5 products are just to test frontend to backend connectivity.

The real magic is on the FortiFlex Configs and Entitlements pages….which are Empty presently, because we haven’t provided any credentials yet!

The Demo hasn’t implemented any kind of secure storage for credentials, because FortiCloud doesn’t offer API creation of IAM accounts yet.

So for now, we’ll just use the IAM API credentials you created earlier in the workshop.

Click on the API Credentials link in the top menu

Enter the following information:

• FortiFlex IAM API Username: <IAM_API_Username_you_created_earlier>
• FortiFlex IAM API Password: <IAM_API_password_you_created_earlier>
• FortiFlex Program Serial Number: ELAVMS0000000518
• FortiCloud Account ID: You can get this from your FortiCloud account info (top right).

then click Submit

If you provided all the info correctly, the FortiFlex Configs page, will show the XPerts25-FGT-VM Config you created manually back in the beginning of the hands on section!

You’ll notice the parameters show the config is set for 4 CPUs, and the Create Entitlement is disabled. This is purposeful as we’re trying to conserve resources for this workshop.

From the FortiFlex Configurations Page, Click on Modify Configuration for the XPerts25-FGT-VM Flex Config and set it back to 2 CPU’s.

Confirm the changes and you’ll see the Create Entitlement Button Activate.

Once the Configuration is back at 2 CPU, Click Create Entitlement and confirm

You’ll be redirected to the FortiFlex Entitlements Page to view the newly created Entitlement named CloudCSE MKPL VM. You’ll also notice the entitlement you previously created manually at the WebUI.

Click on Launch VM on the Cloud CSE MKPL VM Entitlement, and confirm the prompts.

Behind the scenes, the MSSP Marketplace is launch a combination of API calls and Terraform to automatically deploy a FortiGate into your Azure account. That FortiFate is already licensed with the FortiFlex Entitlement Token you just created at the MSSP Portal!

It will take approx 5 mins to fully deploy, and then you can go check in your Azure Portal in the resource group for your account.

Imagine the possibilities for MSSP’s to customize the deployment options (single VM’s, A/P, A/A, Azure vWAN, AWS GWLB, AutoScaling, etc)

You will know the VM is ready when you see the Flex Entitlement Card:

• Launch Azure VM Button turn Grey
• RED STOP Button Appear
• Status turn to Active
• Token Status turn to Used

Go to the Azure Portal and check your resource group for a Virtual Machine prefixed with cat-. This is the VM deployed from the Flex Catalog.

Click on it, and copy the Public IP opening it in a new browser window.

Login using the following:

• Username:
• Password: ChangeMe123#@!

You will see the Serial number of the Flex Entitlement you used to provision this VM.

In the FortiCloud Portal, Go to the IAM Portal, Users section, Select the API account you created for this workshop and delete it.