obriensystems
commented
1 year ago following https://github.com/fortinet/fortigate-tutorial-gcp#how-to-deploy to https://github.com/fortinet/fortigate-tutorial-gcp/tree/main/terraform to https://github.com/fortinet/fortigate-tutorial-gcp/tree/main/terraform/day0
michael@cloudshell:~$ gcloud config set project fortigate-tutorial-gcp-lgz
Updated property [core/project].
michael@cloudshell:~ (fortigate-tutorial-gcp-lgz)$ cd github/
michael@cloudshell:~/github (fortigate-tutorial-gcp-lgz)$ git clone https://github.com/fortinet/fortigate-tutorial-gcp.git
Cloning into 'fortigate-tutorial-gcp'...
michael@cloudshell:~/github (fortigate-tutorial-gcp-lgz)$ cd fortigate-tutorial-gcp/
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ chmod 755 service_account_create.sh
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ ./service_account_create.sh
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ ./service_account_create.sh
Your active configuration is: [cloudshell-10076]
Creating FortigateSdnReader role in project fortigate-tutorial-gcp-lgz...
WARNING: API is not enabled for permissions: [compute.zones.list, compute.instances.list, container.clusters.list, container.nodes.list, container.pods.list, container.services.list]. Please enable the corresponding APIs to use those permissions.
Created role [FortigateSdnReader].
etag: BwXrZN1m7_k=
includedPermissions:
- compute.instances.list
- compute.zones.list
- container.clusters.list
- container.nodes.list
- container.pods.list
- container.services.list
name: projects/fortigate-tutorial-gcp-lgz/roles/FortigateSdnReader
stage: ALPHA
title: FortiGate SDN Connector Role (read-only)
Creating new service account (FortiGate SDN Connector)...
Created service account [fortigatesdn-ro].
Granting fortigatesdn-ro service account access to project fortigate-tutorial-gcp-lgz...
Updated IAM policy for project [fortigate-tutorial-gcp-lgz].
bindings:
- members:
- serviceAccount:fortigatesdn-ro@fortigate-tutorial-gcp-lgz.iam.gserviceaccount.com
role: projects/fortigate-tutorial-gcp-lgz/roles/FortigateSdnReader
- members:
- user:michael@landing.gcp.zone
role: roles/owner
etag: BwXrZN2P0Qs=
version: 1
serviceAccount:fortigatesdn-ro@fortigate-tutorial-gcp-lgz.iam.gserviceaccount.com
Service account created succesfully
enabling services separately
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ gcloud services enable compute.googleapis.com
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ gcloud services enable container.googleapis.comUse fortigate pay as you go - comment out 31-34 of https://github.com/fortinet/fortigate-tutorial-gcp/blob/main/terraform/day0/main.tf#L31
license_files = [
"lic1.lic",
"lic2.lic"
]data "google_compute_image" "fgt_image" {
project = "fortigcp-project-001"
#family = "fortigate-70-byol"
family = "fortigate-70-payg"modify terraform.tfvars
GCP_PROJECT = "fortigate-tutorial-gcp-lgz"
GCE_REGION = "northamerica-northeast1"
prefix = "fgt-"add to step 7 by cd into the terraform/day0 dir https://github.com/fortinet/fortigate-tutorial-gcp/tree/main/terraform/day0#how-to-deploy
michael@cloudshell:~/github/fortigate-tutorial-gcp (fortigate-tutorial-gcp-lgz)$ cd terraform/
michael@cloudshell:~/github/fortigate-tutorial-gcp/terraform (fortigate-tutorial-gcp-lgz)$ cd day0
michael@cloudshell:~/github/fortigate-tutorial-gcp/terraform/day0 (fortigate-tutorial-gcp-lgz)$ terraform init
Terraform has been successfully initialized!
Fix the license references to avoid the terraform errors around rendering the byol
michael@cloudshell:~/github/fortigate-tutorial-gcp/terraform/day0 (fortigate-tutorial-gcp-lgz)$ git diff
diff --git a/service_account_create.sh b/service_account_create.sh
old mode 100644
new mode 100755
diff --git a/terraform/day0/main.tf b/terraform/day0/main.tf
index 550804f..368a76e 100644
--- a/terraform/day0/main.tf
+++ b/terraform/day0/main.tf
@@ -28,10 +28,10 @@ module "fortigates" {
"${var.prefix}sb-mgmt"
]
- license_files = [
- "lic1.lic",
- "lic2.lic"
- ]
+# license_files = [
+# "lic1.lic",
+# "lic2.lic"
+# ]
# If creating sample VPC Networks in the same configuration - wait for them to be created!
# Remove this explicit dependency if using your own pre-existing networks.
diff --git a/terraform/day0/terraform.tfvars b/terraform/day0/terraform.tfvars
index bd73283..31bf187 100644
--- a/terraform/day0/terraform.tfvars
+++ b/terraform/day0/terraform.tfvars
@@ -1,3 +1,6 @@
-GCP_PROJECT = "forti-emea-se"
-GCE_REGION = "europe-west3"
+#GCP_PROJECT = "forti-emea-se"
+#GCE_REGION = "europe-west3"
+#prefix = "fgt-"
+GCP_PROJECT = "fortigate-tutorial-gcp-lgz"
+GCE_REGION = "northamerica-northeast1"
prefix = "fgt-"
diff --git a/terraform/modules/fgcp-ha-ap-lb/main.tf b/terraform/modules/fgcp-ha-ap-lb/main.tf
index c3db3e7..194d556 100644
--- a/terraform/modules/fgcp-ha-ap-lb/main.tf
+++ b/terraform/modules/fgcp-ha-ap-lb/main.tf
@@ -2,7 +2,8 @@
# an image different than the newest 7.0 BYOL series.
data "google_compute_image" "fgt_image" {
project = "fortigcp-project-001"
- family = "fortigate-70-byol"
+ #family = "fortigate-70-byol"
+ family = "fortigate-70-payg"
}
# Pull information about subnets we will connect to FortiGate instances. Subnets must
@@ -121,7 +122,7 @@ resource "google_compute_instance" "fgt-vm" {
metadata = {
user-data = (count.index == 0 ? local.config_active : local.config_passive )
- license = fileexists(var.license_files[count.index]) ? file(var.license_files[count.index]) : null
+ #license = fileexists(var.license_files[count.index]) ? file(var.license_files[count.index]) : null
}
network_interface {
diff --git a/terraform/modules/fgcp-ha-ap-lb/variables.tf b/terraform/modules/fgcp-ha-ap-lb/variables.tf
index 081eaa0..a1bc1c3 100644
--- a/terraform/modules/fgcp-ha-ap-lb/variables.tf
+++ b/terraform/modules/fgcp-ha-ap-lb/variables.tf
@@ -57,11 +57,11 @@ variable api_acl {
description = "List of CIDRs allowed to connect to FortiGate API (must not be 0.0.0.0/0)"
}
-variable license_files {
- type = list(string)
- default = ["",""]
- description = "List of license (.lic) files to be applied for BYOL instances."
-}
+#variable license_files {
+# type = list(string)
+# default = ["",""]
+# description = "List of license (.lic) files to be applied for BYOL instances."
+#}
variable healthcheck_port {
type = numberterraform plan
michael@cloudshell:~/github/fortigate-tutorial-gcp/terraform/day0 (fortigate-tutorial-gcp-lgz)$ terraform plan -out day0.plan
Plan: 35 to add, 0 to change, 0 to destroy.
Saved the plan to: day0.planterraform apply
14:27
michael@cloudshell:~/github/fortigate-tutorial-gcp/terraform/day0 (fortigate-tutorial-gcp-lgz)$ terraform apply day0.plan
module.sample_networks.google_compute_network.vpcs[3]: Still creating... [10s elapsed]
module.sample_networks.google_compute_network.vpcs[1]: Creation complete after 12s [id=projects/fortigate-tutorial-gcp-lgz/global/networks/fgt--internal-vpc]
module.sample_networks.google_compute_network.vpcs[0]: Still creating... [20s elapsed]
module.sample_networks.google_compute_network.vpcs[2]: Still creating... [20s elapsed]
module.sample_networks.google_compute_network.vpcs[3]: Still creating... [20s elapsed]
module.sample_networks.google_compute_network.vpcs[0]: Creation complete after 22s [id=projects/fortigate-tutorial-gcp-lgz/global/networks/fgt--external-vpc]
module.sample_networks.google_compute_network.vpcs[3]: Creation complete after 22s [id=projects/fortigate-tutorial-gcp-lgz/global/networks/fgt--mgmt-vpc]
module.sample_networks.google_compute_network.vpcs[2]: Creation complete after 22s [id=projects/fortigate-tutorial-gcp-lgz/global/networks/fgt--hasy
Error: Invalid function argument
│
│ on ../modules/fgcp-ha-ap-lb/main.tf line 63, in locals:
│ 63: unicast_peer_netmask = cidrnetmask(data.google_compute_subnetwork.subnets[2].ip_cidr_range)
│ ├────────────────
│ │ while calling cidrnetmask(prefix)
│ │ data.google_compute_subnetwork.subnets[2].ip_cidr_range is null
│
│ Invalid value for "prefix" parameter: argument must not be null.
╵
╷
│ Error: Invalid function argument
│
│ on ../modules/fgcp-ha-ap-lb/main.tf line 82, in locals:
│ 82: unicast_peer_netmask = cidrnetmask(data.google_compute_subnetwork.subnets[2].ip_cidr_range)
│ ├────────────────
│ │ while calling cidrnetmask(prefix)
│ │ data.google_compute_subnetwork.subnets[2].ip_cidr_range is null
│
│ Invalid value for "prefix" parameter: argument must not be null.
╵
╷
│ Error: Missing required argument
│
│ with module.fortigates.google_compute_firewall.allow-mgmt,
│ on ../modules/fgcp-ha-ap-lb/main.tf line 205, in resource "google_compute_firewall" "allow-mgmt":
│ 205: network = data.google_compute_subnetwork.subnets[3].network
│
│ The argument "network" is required, but no definition was found.
╵
╷
│ Error: Missing required argument
│
│ with module.fortigates.google_compute_firewall.allow-hasync,
│ on ../modules/fgcp-ha-ap-lb/main.tf line 216, in resource "google_compute_firewall" "allow-hasync":
│ 216: network = data.google_compute_subnetwork.subnets[2].network
│
│ The argument "network" is required, but no definition was found.
╵
╷
│ Error: Missing required argument
│
│ with module.fortigates.google_compute_firewall.allow-port1,
│ on ../modules/fgcp-ha-ap-lb/main.tf line 227, in resource "google_compute_firewall" "allow-port1":
│ 227: network = data.google_compute_subnetwork.subnets[0].network
│
│ The argument "network" is required, but no definition was found.
╵
╷
│ Error: Missing required argument
│
│ with module.fortigates.google_compute_firewall.allow-port2,
│ on ../modules/fgcp-ha-ap-lb/main.tf line 237, in resource "google_compute_firewall" "allow-port2":
│ 237: network = data.google_compute_subnetwork.subnets[1].network
│
│ The argument "network" is required, but no definition was found.
╵
╷
│ Error: Missing required argument
│
│ with module.fortigates.google_compute_router.nat_router,
│ on ../modules/fgcp-ha-ap-lb/main.tf line 249, in resource "google_compute_router" "nat_router":
│ 249: network = data.google_compute_subnetwork.subnets[0].network
│
│ The argument "network" is required, but no definition was found.
╵
fmichaelobrien
bartekmo
Good afternoon team,. I will be reviewing this your implementation. Thank you for the excellent work. Keeping this issue open for initial discussion on config/deploy/use items. /Michael