NGFW in Azure VWan Hub - Firewall Capability Question

Hi,

To address your questions related to Azure routing policies and FortiGate NVAs in your vWAN environment: 1. **Sending Internet-bound traffic through FortiGate NVAs:** - Yes, you can send all internet-bound traffic through the FortiGate NVAs deployed in your vWAN hub. To achieve this, you need to configure User Defined Routes (UDRs) in Azure to direct traffic through the NVAs. If you are losing outbound connectivity after setting up the routing policy, it could be due to misconfigurations on the NVAs. Ensure that the NVAs are correctly configured to handle and filter the internet-bound traffic. Check the NVA's routing, security policies, and NAT configurations to troubleshoot the connectivity issue.

2. **Private traffic policy and connectivity between hub and spokes:** - When you enable private traffic policies through the FortiGate NVAs, and you lose connectivity between the hub and spokes, it could be related to how the traffic is being handled within the vWAN environment. - Ensure that the hub and spokes are correctly connected to the vWAN hub and that the routing configurations on the NVAs allow for proper communication between the different subnets. - If the hub and spokes are all connected to the vWAN hub but need to communicate with each other, consider peering the hub's VNet with the spokes' VNets to enable direct communication between the subnets. - You can manage traffic from one subnet to another subnet in the same VNet by configuring appropriate network security groups (NSGs) and routing within Azure. By verifying the configurations on the FortiGate NVAs, setting up proper routing policies in Azure, and ensuring correct connectivity between the hub and spokes, you should be able to achieve the desired traffic routing and filtering capabilities in your vWAN environment.