Technical Tip: Azure East-West Traffic Routing Over Fortinet in Virtual WAN (VWAN)

[subramanis]

Description	This article explains how to prevent east-west traffic from being routed through external interfaces on Fortinet in Azure Virtual WAN (VWAN)
Scope	Fortinet.
Solution	In Azure Virtual WAN (VWAN), VNets 192.168.0.0/24 and 192.168.1.0/24 are attached. In some deployments, the following issues may arise: Traffic from 192.168.0.10/24 to 192.168.1.10/24 is routed through Fortinet Port1 (internal). Traffic from 192.168.0.10/24 to 192.168.1.11/24 is routed through Fortinet Port2 (external). However, as per the intended architecture, the attached VNets should be connected to an Internal Load Balancer (ILB), ensuring that east-west VNet-to-VNet traffic does not route through the External Load Balancer (ELB). The Azure External Load Balancer incorrectly attempts to route east-west traffic through Port1 (external). Since this traffic should never be routed externally, this behavior leads to an unintended routing scenario. config system interface     edit "port1"         set vdom "root"         set mode dhcp         set allowaccess ping https probe-response ftm         set type physical         set snmp-index 1         set dns-server-override disable     next     edit "port2"         set vdom "root"         set mode dhcp         set allowaccess ping https ssh probe-response ftm         set type physical         set snmp-index 2         set defaultgw disable         set dns-server-override disable     next To prevent east-west traffic from being routed through the External Load Balancer (ELB), disable probe-response on Port1: config system interface     edit "port1"         set allowaccess ping https ftm     next end Without probe-response on Port1, Fortinet will not respond to Azure Load Balancer health checks. As a result, the External Load Balancer (ELB) will consider the Fortinet instances down and will not send traffic towards them. This effectively ensures that east-west traffic remains within the Internal Load Balancer (ILB) and does not route externally. This issue stems from Microsoft Azure's Load Balancer handling of health probes, which incorrectly influences routing decisions. While the root cause lies with Microsoft, the recommended workaround effectively mitigates the issue by ensuring that Fortinet instances do not respond to external health probes on Port1, preventing unintended traffic routing.