Technical Tip: Allowing Inbound Internet for VIP access on FortiGate Azure VM using vWAN configuration

Description

This article describes how to enable Inbound Internet functionality on Azure Cloud VM vWAN.

Scope

FortiGate Azure-VM v7.4.0 and above.

Solution

In cases where the vWAN configuration cannot be pushed through FortiManager, or if FortiManager is not available, this can be achieved via the Azure FortiGate-VM CLI.

Configure the VIP and mention the external IP as the SLB-associated public IP.

After, set up the following vwan-sla config in the FortiGate CLI:

config azure vwan-slb
set mode active
config permanent-security-rules
config rules
edit "rule1"
set protocol TCP
set source-address-prefix "0.0.0.0/0" 
set destination-port-ranges "44540" 
set applies-on "Test-slb-pip" 
end
end
end

Source address prefix should be the actual server IP/Range. This can be kept as 0.0.0.0/0 as well.

Destination port range is the real server listening port.

Once the above command has been executed on Forti-VM CLI, verify the status using below :

execute azure vwan-slb show
Ingress Public IP associated on SLBs :1
1. Test-slb-pip:
permanentSecurityRules: 1, ver: 1
1: rule1: TCP [0.0.0.0/0] to dst port [44540] on [Test-slb-pip]     
temporarySecurityRules: 0

Above output should show the pushed security rules to the Azure SLB. It should be a non-zero value in the case of a successful push.

The VIP can be called in the firewall policy to allow access from outside. In case the FortiGate is in NGFW mode, call the real mapped IP in the security policy destination field.

Note: For the large-scale deployment, it is recommended to use FortiManager to push the SLB security policies and configuration.