Add files via upload

FortiGate/Standalone/Existing-VCN/terraform/block.tf

@@ -0,0 +1,12 @@
+resource "oci_core_volume" "vm_volume" {
+ availability_domain = data.oci_identity_availability_domain.ad.name
+ compartment_id = var.compartment_ocid
+ display_name = "vm_volume"
+ size_in_gbs = var.volume_size
+}
+
+resource "oci_core_volume_attachment" "vm_volume_attach" {
+ attachment_type = "paravirtualized"
+ instance_id = oci_core_instance.FortiGate.id
+ volume_id = oci_core_volume.vm_volume.id
+}

FortiGate/Standalone/Existing-VCN/terraform/compute.tf

@@ -0,0 +1,93 @@
+resource "oci_core_instance" "FortiGate" {
+ availability_domain = data.oci_identity_availability_domain.ad.name
+ compartment_id = var.compartment_ocid
+ display_name = "FortiGate"
+ shape = var.instance_shape
+
+ // Uncomment and addapt if you are yousing newer instance types like VM.Standard.E3.Flex
+ # shape_config {
+ # memory_in_gbs = "16"
+ # ocpus = "4"
+ # }
+
+ create_vnic_details {
+ subnet_id = oci_core_subnet.untrust_subnet.id
+ display_name = "FortiGate"
+ assign_public_ip = true
+ hostname_label = "vma"
+ private_ip = var.untrust_private_ip
+ }
+
+ source_details {
+ source_type = "image"
+ source_id = var.vm_image_ocid
+
+ //for PIC image: source_id = var.vm_image_ocid
+
+ # Apply this to set the size of the boot volume that's created for this instance.
+ # Otherwise, the default boot volume size of the image is used.
+ # This should only be specified when source_type is set to "image".
+ #boot_volume_size_in_gbs = "60"
+ }
+
+ # Apply the following flag only if you wish to preserve the attached boot volume upon destroying this instance
+ # Setting this and destroying the instance will result in a boot volume that should be managed outside of this config.
+ # When changing this value, make sure to run 'terraform apply' so that it takes effect before the resource is destroyed.
+ #preserve_boot_volume = true
+
+
+ //required for metadata setup via cloud-init
+ metadata = {
+ // ssh_authorized_keys = var.ssh_public_key
+ user_data = base64encode(data.template_file.FortiGate_userdata.rendered)
+ }
+
+ timeouts {
+ create = "60m"
+ }
+}
+
+resource "oci_core_public_ip" "untrust_public_ip" {
+ #Required
+ compartment_id = var.compartment_ocid
+ lifetime = var.untrust_public_ip_lifetime
+
+}
+
+resource "oci_core_vnic_attachment" "vnic_attach_trust" {
+ depends_on = [oci_core_instance.FortiGate]
+ instance_id = oci_core_instance.FortiGate.id
+ display_name = "vnic_trust"
+
+ create_vnic_details {
+ subnet_id = oci_core_subnet.trust_subnet.id
+ display_name = "vnic_trust"
+ assign_public_ip = false
+ skip_source_dest_check = true
+ private_ip = var.trust_private_ip
+ }
+}
+
+resource "oci_core_private_ip" "trust_private_ip" {
+ #Get Primary VNIC id
+ vnic_id = element(oci_core_vnic_attachment.vnic_attach_trust.*.vnic_id, 0)
+
+}
+
+data "template_file" "FortiGate_userdata" {
+
+ template = file(var.bootstrap_FortiGate)
+
+ vars = {
+ untrust_ip = var.untrust_private_ip
+ untrust_ip_mask = "255.255.255.0"
+ trust_ip = var.trust_private_ip
+ trust_ip_mask = "255.255.255.0"
+ untrust_subnet_gw = var.untrust_subnet_gateway
+ trust_subnet_gw = var.trust_subnet_gateway
+ vcn_cidr = var.vcn_cidr
+
+ tenancy_ocid = var.tenancy_ocid
+ compartment_ocid = var.compartment_ocid
+ }
+}

FortiGate/Standalone/Existing-VCN/terraform/datasources.tf

@@ -0,0 +1,13 @@
+# Gets a list of Availability Domains
+data "oci_identity_availability_domain" "ad" {
+ compartment_id = var.tenancy_ocid
+ ad_number = var.availability_domain
+}
+
+# Gets the boot volume attachments for each instance
+data "oci_core_boot_volume_attachments" "block_attach" {
+ depends_on = [oci_core_instance.FortiGate]
+ availability_domain = data.oci_identity_availability_domain.ad.name
+ compartment_id = var.compartment_ocid
+ instance_id = oci_core_instance.FortiGate.id
+}

FortiGate/Standalone/Existing-VCN/terraform/image_subscription.tf

@@ -0,0 +1,38 @@
+//Local variables pointing to the Marketplace catalog resource
+locals {
+ mp_listing_id = var.mp_listing_id
+ mp_listing_resource_id = var.vm_image_ocid
+ mp_listing_resource_version = var.mp_listing_resource_version
+}
+
+//Get Image Agreement
+resource "oci_core_app_catalog_listing_resource_version_agreement" "mp_image_agreement" {
+ listing_id = local.mp_listing_id
+ listing_resource_version = local.mp_listing_resource_version
+}
+
+//Accept Terms and Subscribe to the image, placing the image in a particular compartment
+resource "oci_core_app_catalog_subscription" "mp_image_subscription" {
+ compartment_id = var.compartment_ocid
+ eula_link = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.eula_link
+ listing_id = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.listing_id
+ listing_resource_version = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.listing_resource_version
+ oracle_terms_of_use_link = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.oracle_terms_of_use_link
+ signature = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.signature
+ time_retrieved = oci_core_app_catalog_listing_resource_version_agreement.mp_image_agreement.time_retrieved
+
+ timeouts {
+ create = "30m"
+ }
+}
+
+// Gets the partner image subscription
+data "oci_core_app_catalog_subscriptions" "mp_image_subscription" {
+ #Required
+ compartment_id = var.compartment_ocid
+ listing_id = local.mp_listing_id
+ filter {
+ name = "listing_resource_version"
+ values = ["${local.mp_listing_resource_version}"]
+ }
+}

FortiGate/Standalone/Existing-VCN/terraform/network.tf

@@ -0,0 +1,160 @@
+#######################################
+# VCN & IGW SETTINGS #
+#######################################
+// Pointing to existing VCN
+data "oci_core_vcn" "my_vcn" {
+ vcn_id = var.vcn_ocid
+}
+
+// Pointing to existing Internet Gateway
+data "oci_core_internet_gateways" "igw" {
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+}
+#######################################
+# UNTRUST NETWORK SETTINGS #
+#######################################
+// Untrust Route Table
+resource "oci_core_route_table" "untrust_routetable" {
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ display_name = "untrust-rt"
+
+ route_rules {
+ destination = "0.0.0.0/0"
+ network_entity_id = var.igw_ocid
+ }
+}
+// Untrust Subnet
+resource "oci_core_subnet" "untrust_subnet" {
+ cidr_block = var.untrust_subnet_cidr
+ display_name = "untrust"
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ route_table_id = oci_core_route_table.untrust_routetable.id
+ security_list_ids = [data.oci_core_vcn.my_vcn.default_security_list_id, oci_core_security_list.untrust_security_list.id]
+ dhcp_options_id = data.oci_core_vcn.my_vcn.default_dhcp_options_id
+ dns_label = "untrust"
+}
+
+// Untrust Security List
+# Protocols are specified as protocol numbers.
+# http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+resource "oci_core_security_list" "untrust_security_list" {
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ display_name = "untrust-security-list"
+
+ // allow outbound tcp traffic on all ports
+ egress_security_rules {
+ destination = "0.0.0.0/0"
+ protocol = "6" //tcp
+ }
+
+ // allow inbound http (port 80) traffic
+ ingress_security_rules {
+ protocol = "6" // tcp
+ source = "0.0.0.0/0"
+ stateless = false
+
+ tcp_options {
+ min = 80
+ max = 80
+ }
+ }
+
+ // allow inbound http (port 443) traffic
+ ingress_security_rules {
+ protocol = "6" // tcp
+ source = "0.0.0.0/0"
+ stateless = false
+
+ tcp_options {
+ min = 443
+ max = 443
+ }
+ }
+
+ // allow inbound traffic to port 5901 (vnc)
+ ingress_security_rules {
+ protocol = "6" // tcp
+ source = "0.0.0.0/0"
+ stateless = false
+
+ tcp_options {
+ min = 5901
+ max = 5901
+ }
+ }
+
+ // allow inbound ssh traffic
+ ingress_security_rules {
+ protocol = "6" // tcp
+ source = "0.0.0.0/0"
+ stateless = false
+
+ tcp_options {
+ min = 22
+ max = 22
+ }
+ }
+
+ // allow inbound icmp traffic of a specific type
+ ingress_security_rules {
+ protocol = 1
+ source = "0.0.0.0/0"
+ stateless = false
+
+ icmp_options {
+ type = 3
+ code = 4
+ }
+ }
+}
+
+#######################################
+# TRUST NETWORK SETTINGS #
+#######################################
+// Trust Subnet
+resource "oci_core_subnet" "trust_subnet" {
+ cidr_block = var.trust_subnet_cidr
+ display_name = "trust"
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ route_table_id = oci_core_route_table.trust_routetable.id
+ security_list_ids = [data.oci_core_vcn.my_vcn.default_security_list_id, oci_core_security_list.trust_security_list.id]
+ dhcp_options_id = data.oci_core_vcn.my_vcn.default_dhcp_options_id
+ dns_label = "trust"
+ prohibit_public_ip_on_vnic = "true"
+}
+
+// Trust Route Table
+resource "oci_core_route_table" "trust_routetable" {
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ display_name = "trust-routetable"
+}
+
+// Trust Security List
+# Protocols are specified as protocol numbers.
+# http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+resource "oci_core_security_list" "trust_security_list" {
+ compartment_id = var.compartment_ocid
+ vcn_id = data.oci_core_vcn.my_vcn.id
+ display_name = "trust-security-list"
+
+
+ // allow outbound traffic on all ports
+ egress_security_rules {
+ destination = "0.0.0.0/0"
+ protocol = "all"
+ stateless = false
+ }
+
+ // allow inbound traffic on all ports from network
+ ingress_security_rules {
+ protocol = "all"
+ source = var.vcn_cidr
+ stateless = false
+ }
+}

FortiGate/Standalone/Existing-VCN/terraform/output.tf

@@ -0,0 +1,9 @@
+# Output the private and public IPs of the instance
+
+output "Mgmt-FortiGate-PublicIP" {
+ value = [oci_core_instance.FortiGate.*.public_ip]
+}
+
+output "FortiGate-ID" {
+ value = [oci_core_instance.FortiGate.id]
+}

FortiGate/Standalone/Existing-VCN/terraform/provider.tf

@@ -0,0 +1,18 @@
+provider "oci" {
+ tenancy_ocid = var.tenancy_ocid
+ user_ocid = var.user_ocid
+ fingerprint = var.fingerprint
+ private_key_path = var.private_key_path
+ region = var.region
+}
+
+terraform {
+ required_version = ">=1.0"
+ required_providers {
+ oci = {
+ source = "oracle/oci"
+ version = ">=3.69.0"
+ }
+ template = ">=2.1.2"
+ }
+}

FortiGate/Standalone/Existing-VCN/terraform/terraform.tfvars

@@ -0,0 +1,7 @@
+// Change to your own variables
+tenancy_ocid = "ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a"
+compartment_ocid = "ocid1.compartment.oc1..aaaaaaaam6bypzy7et2h3xepldc7mjpaqdxp6a65mkbwvhrfnvphsz35r73a"
+user_ocid = "ocid1.user.oc1..aaaaaaaapbaqbra7ms64ti76bnoupkcuce7l3yiemgvqsucqv4ghf5qfrsta"
+fingerprint = "c7:32:ba:fa:d3:59:d0:9b:84:dc:0e:a0:ca:15:0f:d0"
+private_key_path = "/Users/ozanoguz/.oci/oraclekey.pem"
+region = "eu-frankfurt-1"