Many enterprises and service providers use Fortinet products like FortiGate, often running them as a VM’s. If running them virtually on vSphere, what are the current supported versions?

FortiOS supported vSphere versions

The vSphere 8 support status for FortiGate appliances in VM factor (including the pay-as-you-go variant) was until recently not clear in the Fortinet documentation.

After consulting a contact at Fortinet, he responded that FortiOS starting with version 7.2.0 is supported for vSphere 8 and that the release notes are updated accordingly.

In a nutshell the supported vSphere versions for FortiGate VM based deployments are:

FortiOS major versionsFortiGate VM supported vSphere versions
7.4.x8.0, 7.0, 6.7, 6.5
7.2.x8.0, 7.0, 6.7, 6.5
7.0.5 – 7.0.x7.0, 6.7, 6.5
7.0.0 –, 6.7, 6.5, 6.0, 5.5, 5.1, 5.0, (4.1, 4.0 incl. ESX and ESXi)
6.4.4 – 6.4.x7.0, 6.7, 6.5, 6.0, 5.5, 5.1, 5.0, (4.1, 4.0 incl. ESX and ESXi)
6.4.0 –, 6.5, 6.0, 5.5, 5.1, 5.0, (4.1, 4.0 incl. ESX and ESXi)
6.2.x6.7, 6.5, 6.0, 5.5, 5.1, 5.0, (4.1, 4.0 incl. ESX and ESXi)
6.0.x6.7, 6.5, 6.0, 5.5, 5.1, 5.0, (4.1, 4.0 incl. ESX and ESXi)
Only the bold vSphere versions are supported by VMware at time of writing

FortiOS VM hardware support

So how about the VM hardware version when deploying a new FortiGate instance. Fortinet itself does not specify a minumum VM hardware version in the documentation. In general I would advise to use the latest version possible in your environment. Practically that would be the VM hardware version supported by the lowest vSphere version in production.

For example: When running vSphere 7 U3 and 8.0 U1 in production, choosing VM hardware version 19 is the way to go. The VMware KB article “Virtual machine hardware versions (1003746)” shows the version overview.

Once a given VM hardware version is used, VMware does not advice to upgrade to a higher VM hardware version unless there is a specific reason to do so. For example: When you need a feature of a higher VM hardware version or when to a mitigate a security vulnerability. For the latter, think of the L1TF / Spectre / Metdown speculative execution vulnerabilities back in 2018 / 2019 which could required a VM hardware upgrade.

For a list of VM hardware features see the “Hardware Features Available with Virtual Machine Compatibility Settings” in the vSphere 8 documentation.

To conclude

The FortiGate VM based next-gen firewall appliances are fully supported for vSphere 8 in the last 2 major versions (7.2 / 7.4) as shown in the table above at time of writing this post

When deploying FortiGate appliances choose the VM hardware version that matches the lowest vSphere version used in your production environment to make sure the VM’s can be moved around using vMotion and to be able to restore to other hosts.

Useful links

Fortinet docs: VMware ESXi certification information

Fortinet docs: Compatibility for VM hardware versions

vSphere docs: Hardware Features Available with Virtual Machine Compatibility Settings

VMware KB: Upgrading a virtual machine to the latest hardware version (multiple versions) (1010675)

VMware KB: Virtual machine hardware versions (1003746)

VMware Marketplace: FortiGate Next-Generation Firewall 7.2


Leave a Reply

Avatar placeholder

Your email address will not be published. Required fields are marked *