base_config.tftpl

config system global
  set hostname ${hostname}
end

config sys interface
%{ for port, address in prv_ips ~}
  edit ${port}
    set mode static
    set ip ${address}/32
    %{ if port==mgmt_port ~}
    set allowaccess ping https ssh
    %{ endif ~}
  next
%{ endfor ~}
end

config sys interface
%{ for port, ilb in ilb_ips ~}
  edit ${port}
    set secondary-IP enable
    config secondaryip
      edit 0
      set ip ${ilb.address}/32
      set allowaccess probe-response
      next
    end
  next
%{ endfor ~}
end

config system interface
  edit port1
    set secondary-IP enable
    config secondaryip
      %{ for eip in frontends}
        edit 0
        set ip ${eip}/32
        set allowaccess probe-response
        next
      %{ endfor }
    end
  next
end

config route static
%{ for subnet, info in subnets ~}
  edit 0
    set dst ${subnet}
    set gateway ${gateways[info.dev]}
    set device ${info.dev}
    set comment ${info.name}
  next
%{ endfor ~}
  edit 0
    set device port1
    set comment "default via external load balancer"
    set gateway ${gateways["port1"]}
    set priority 5
    %{ if length(frontends)>0 ~}
    set preferred-source ${frontends[0]}
    %{ endif ~}
  next
%{ if mgmt_port_public ~}  
  edit 0
    set device ${mgmt_port}
    set comment "default via public management port"
    set priority 2
    set gateway ${gateways[mgmt_port]}
  next
%{ endif ~}
%{ for port,ilb in ilb_ips ~}
  edit 0
    set device ${port}
    set gateway ${gateways[port]}
    set dst 35.191.0.0/16
    comment "GCP load balancer health checks"
  next
  edit 0
    set device ${port}
    set gateway ${gateways[port]}
    set dst 130.211.0.0/22
    comment "GCP load balancer health checks"
  next
%{ endfor ~}
end

config system probe-response
    set mode http-probe
    set http-probe-value OK
    set port ${healthcheck_port}
end
config system sdn-connector
    edit "gcp"
        set type gcp
        set ha-status disable
    next
end
config system dns
  set primary 169.254.169.254
  set protocol cleartext
  unset secondary
end

config system ha
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-nat enable
end

config system standalone-cluster
    set group-member-id ${ha_indx}
    config cluster-peer
        %{ for peer in ha_peers }
        edit 0
        set peerip ${peer}
        next
        %{ endfor }
    end
end

%{ if fortimanager.ip != null ~}
config system central-management
  set type fortimanager
  set serial-number ${fortimanager.serial}
  set fmg ${fortimanager.ip}
end
%{ endif }

config firewall ippool
%{ for name, eip in frontends ~}
  edit ${name}
  set startip ${eip}
  set endip ${eip}
  set comment "GCP load balancer frontend"
  next
%{ endfor ~}
end

${fgt_config}