FortiGate Terraform for Azure

Azure RM Terraform Providers 5.0 and 4.0

• There is no difference in the Azure RM provider 5.0 and 4.0 resources utilized for the FortiGate deployments.
• Going forward changes/updates will only be made to the 5.0 provider.

In the 5.0 deployment directories the Terraform provider local_sensitive_file replaces Terraform provider local_file which was used in the 4.0 deployment directories. This Terraform provider in not related to or required by the Azure RM provider. The local_sensitive_file resource is used to output the generated FortiGate cloudinit file that is used during VM deployment.

3 Nic HA A/P architecture

The HA A/P deployments, SDN or ELB/ILB, utilize the 3 Nic architecture where both the HA Synchronization an HA Management services are configured on port3.

This configuration allows for the utilization of 2-CPU/3-Nic Azure instances.

FortiGate SKUs/Plans

There are multiple SKUs/Plans for FortiGate in Azure, make sure to select the correct one for your license type and desired version

As of 2026-07-01, the latest available SKUs are:

7.0

• 7.0.19
  • BYOL/FLEX
    • fortinet_fg-vm_byol_70 - Gen1 Intel/AMD
  • PAYG
    • fortinet_fg-vm_payg_70 - Gen1 Intel/AMD

7.2

• 7.2.13
  • BYOL/FLEX
    • fortinet_fg-vm_byol_72 - Gen1 Intel/AMD
    • fortinet_fg-vm_byol_72_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_72 - Gen1 Intel/AMD
    • fortinet_fg-vm_payg_72_arm64 - Gen2 Arm64

7.4

• 7.4.11

  • BYOL/FLEX
    • fortinet_fg-vm_byol_74 - Gen1 Intel/AMD
    • fortinet_fg-vm_byol_74_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_byol_74_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_74 - Gen1 Intel/AMD
    • fortinet_fg-vm_payg_74_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_payg_74_arm64 - Gen2 Arm64

• 7.4.12

  • BYOL/FLEX
    • fortinet_fg-vm_byol_74_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_byol_74_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_74_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_payg_74_arm64 - Gen2 Arm64

7.6

• 7.6.6

  • BYOL/FLEX
    • fortinet_fg-vm_byol_76 - Gen1 Intel/AMD
    • fortinet_fg-vm_byol_76_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_byol_76_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_76 - Gen1 Intel/AMD
    • fortinet_fg-vm_payg_76_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_payg_76_arm64 - Gen2 Arm64

• 7.6.7

  • BYOL/FLEX
    • fortinet_fg-vm_byol_76_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_byol_76_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_76_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_payg_76_arm64 - Gen2 Arm64

8.0

• 8.0.0
  • BYOL/FLEX
    • fortinet_fg-vm_byol_80 - Gen1 Intel/AMD
    • fortinet_fg-vm_byol_80_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_byol_80_arm64 - Gen2 Arm64
  • PAYG
    • fortinet_fg-vm_payg_80 - Gen1 Intel/AMD
    • fortinet_fg-vm_payg_80_g2 - Gen2 Intel/AMD
    • fortinet_fg-vm_payg_80_arm64 - Gen2 Arm64

Azure Marketplace Terms

The Azure Marketplace Terms for the FortiGate-VM PAYG or BYOL/FLEX image in the Azure Marketplace need to be accepted once before usage. This is done automatically during deployment via the Azure Portal. When using Terraform the Azure CLI commands below can be used to accept the agreement or use the Terraform resource before the first deployment of a FortiGate-VM in a subscription.

If using a Service Principal with Terraform, accept the Azure Marketplace Terms using the Service Principal

• az login using a service principal

  az login --service-principal --username <client_id> --password <client_secret> --tenant <tenant_id> --subscription <subscription_id>

• BYOL/FLEX

  az vm image terms accept --publisher fortinet --offer fortinet_fortigate-vm --plan fortinet_fg-vm-byol_80

• PAYG

  az vm image terms accept --publisher fortinet --offer fortinet_fortigate-vm --plan fortinet_fg-vm_payg_80

• Terraform resource

    resource "azurerm_marketplace_agreement" "marketplace_agreement_fortinet" {
    publisher = "fortinet"
    offer     = "fortinet_fortigate-vm"
    plan      = "fortinet_fg-vm_payg_80"
  }