-
Notifications
You must be signed in to change notification settings - Fork 0
/
fortigate.tf
107 lines (92 loc) · 4.58 KB
/
fortigate.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# tflint-ignore: terraform_required_providers
resource "random_password" "apikey" {
count = var.api_key == null ? 0 : 1
length = 30
special = false
}
# tflint-ignore: terraform_required_providers
resource "random_password" "haenc" {
length = 30
special = false
}
resource "azurerm_virtual_machine" "fortigate" {
count = local.nva.type == "fortigate" ? 2 : 0
name = "${local.nva.name_prefix}-${count.index}-vm-nva"
location = azurerm_resource_group.rsg.location
resource_group_name = azurerm_resource_group.rsg.name
network_interface_ids = [azurerm_network_interface.nva_vm_internal[count.index].id, azurerm_network_interface.nva_vm_external[count.index].id]
primary_network_interface_id = azurerm_network_interface.nva_vm_external[count.index].id
vm_size = var.vm_size
delete_data_disks_on_termination = true
delete_os_disk_on_termination = true
availability_set_id = var.availability_zone_support == true ? null : azurerm_availability_set.nva_availability_set[0].id
zones = var.availability_zone_support == true ? ["${count.index + 1}"] : null
identity {
type = "SystemAssigned"
}
storage_image_reference {
publisher = "fortinet"
offer = "fortinet_fortigate-vm_v5"
sku = var.fortigate_licenses == null ? var.fortigate_sku["payg"] : var.fortigate_sku["byol"]
version = var.fortios_version
}
plan {
publisher = "fortinet"
product = "fortinet_fortigate-vm_v5"
name = var.fortigate_licenses == null ? var.fortigate_sku["payg"] : var.fortigate_sku["byol"]
}
storage_os_disk {
name = "${local.nva.name_prefix}-${count.index}-vm-nva-osdisk"
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}
os_profile {
computer_name = "${local.nva.name_prefix}-${count.index}-vm-nva"
admin_username = var.username
admin_password = var.password
custom_data = data.template_file.fortigate_custom_data[count.index].rendered
}
os_profile_linux_config {
disable_password_authentication = false
}
}
# tflint-ignore: terraform_required_providers
data "template_file" "fortigate_custom_data" {
count = local.nva.type == "fortigate" ? 2 : 0
template = file("${path.module}/fortigate.tpl")
vars = {
fortigate_vm_name = upper("${local.nva.name_prefix}-${count.index}-vm-fortigate")
fortigate_ha = true
fortigate_ha_peerip = local.nva_ha_peer_ip[count.index]
fortigate_license = var.fortigate_licenses == null ? "" : var.fortigate_licenses[count.index]
fortigate_ssh_public_key = null
fortigate_external_ipaddr = azurerm_network_interface.nva_vm_external[count.index].private_ip_address
fortigate_external_mask = cidrnetmask(azurerm_subnet.transit_external.address_prefixes[0])
fortigate_external_gw = cidrhost(azurerm_subnet.transit_external.address_prefixes[0], 1)
fortigate_internal_ipaddr = azurerm_network_interface.nva_vm_internal[count.index].private_ip_address
fortigate_internal_mask = cidrnetmask(azurerm_subnet.transit_internal.address_prefixes[0])
fortigate_internal_gw = cidrhost(azurerm_subnet.transit_internal.address_prefixes[0], 1)
apikey = var.api_key == null ? random_password.apikey[0].result : var.api_key
ha_enc_psk = random_password.haenc.result
ha_memberid = count.index + 1
elb = var.create_sslvpn == true ? var.create_sslvpn : false
elb_ip = var.create_sslvpn == true ? azurerm_public_ip.elb_pip[0].ip_address : false
route_server_1 = cidrhost(azurerm_subnet.transit_vhub.address_prefixes[0], 4)
route_server_2 = cidrhost(azurerm_subnet.transit_vhub.address_prefixes[0], 5)
bgp_asn = local.nva.bgp_asn
bgp_offset = -4000
routerid = azurerm_public_ip.nva_pip[count.index].ip_address
ilb = var.internal_lb
ilb_ip = var.internal_lb == true ? azurerm_lb.ilb[0].private_ip_address : false
}
}
data "azurerm_subscription" "primary" {
count = var.assign_global_reader ? 1 : 0
}
resource "azurerm_role_assignment" "global_reader" {
count = var.assign_global_reader ? 2 : 0
scope = data.azurerm_subscription.primary[0].id
role_definition_name = "Reader"
principal_id = azurerm_virtual_machine.fortigate[count.index].identity.0.principal_id
}