Hi Blair,
Unfortunately, no. Azure doesn’t allow any hosted VM to participate in BGP, or any dynamic routing with the local vswitch. So, there’s nothing we can do to alleviate this problem.
Regards,
Martin
From: "Blair Getz via Cloud Security:"
Reply-To: "cloudsecurity@lists.fusecommunity.fortinet.com"
Date: Tuesday, December 12, 2017 at 6:50 AM
To: "cloudsecurity@lists.fusecommunity.fortinet.com"
Subject: [Cloud Security:] - BGP filtering with introduction of Express Route
Resent-From:
Resent-Date: Tuesday, December 12, 2017 at 6:50 AM
Hello,
I'm working with a client that has their Azure environment completely zoned and they are looking at implementing Express route. Their major concern here will be the routes that will be added via BGP:
"
all routes that are propagated from On-Prem via BGP will automatically be added to all subnet route tables pointing directly to the ExpressRoute GW deployed for the subnet.
This initially breaks the zoning model and we would need to override these routes manually with UDRs to steer the traffic back through our firewall(s) AND manually configure the firewall VMs routing to send traffic to the ExpressRoute Gateway."
The Firewall at the edge of the premise is a CheckPoint so I've asked that they approach CheckPoint and see if they can filter them there, I've also asked if they could approach the service provider implementing the Express Route to filter the routes being populated.
I was wondering if we could also do route filtering on the FortiGates in the Azure space or would the route population take place prior to the FortiGates?
I'm just trying to cover all the bases and present as many options as possible.
Regards,
Blair
-----End Original Message-----
*** Please note that this message and any attachments may contain confidential and proprietary material and information and are intended only for the use of the intended recipient(s). If you are not the intended recipient, you are hereby notified that any review, use, disclosure, dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this email in error, please immediately notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed. Please also note that any views, opinions, conclusions or commitments expressed in this message are those of the individual sender and do not necessarily reflect the views of Fortinet, Inc., its affiliates, and emails are not binding on Fortinet and only a writing manually signed by Fortinet's General Counsel can be a binding commitment of Fortinet to Fortinet's customers or partners. Thank you. ***
