Technical Tip: Restricting HTTPS Admin access to a FortiGate VM deployed on Azure

To Restrict HTTPS/GUI access, Possible options are:

1. Configuring a trusted host (For HTTPS/GUI access, It may still show the FortiGate admin login page).
2. Configuring Local-in Policy (Traffic will hit the FortiGate-VM's NIC but the configured policy can block specific Sources accessing the FortiGate for admin access. This will not show the FortiGate HTTPS admin login page).
3. Another option for FortiGate-VM deployed on Azure is configuring the Network Security Group rule applied on the NIC of the VM. (Using this option, Traffic will not reach the FortiGate-VM's interface. This will also not show the FortiGate admin login page).

Rearrange the order of the NSG rule just like how the Firewall Policy on FortiGate works.

For this example, The first rule is set to deny HTTPS Inbound to the FortiGate. Any source from the Public Internet will not have access and will not see the FortiGate admin login page. The second rule will still allow other admin access such as SSH, Telnet, etc.
It is possible also to be more specific according to the requirements.

Related articles:
Technical Tip: System administrator best practices

Technical Tip: Use local-in policy to restrict unauthorized login attempts to administrative access of FortiGate