Adding a Fortigate NVA in Azure as a spoke to an existing Hub and Spoke setup

[austinmas1987]

We have a working Hub and Spoke setup over the Internet and the Hub also has an express route to Azure.

We dont want the branch users going via the EXPRESSROUTE to Azure as its only for backup traffic from DC.

So we want to add a Fortigate NVA in Azure for branch to Azure connectivity. 

We  have a couple of servers in Azure that  the branches need access to but majority of the infra in an on-prem DC. Traffic to Azure is not critical or needs high priority.

For branches to Fortigate Azure connectivity. The way I see it, these are the options to deploy.

1. Setup ADVPN hub -2 on the Fortigate NVA in Azure.

2 . Setup Site to Site from DC HUB Fortigate to Azure and have the branches connect to Azure via the DC Fortigate. There would be some latency and bandwidth utilization but at least the design is simple.

3. Setup Dial UP Ipsec on Azure Fortigate and have the branches connect directly without ADVPN.

4. Configure the Azure Fortigate as a spoke in existing ADVPN.

Could someone please advice which option would be the simplest and something that doesnt a lot of overload and complexity to troubleshooting and operations.

Thanks.

[jezzy]

---

@austinmas1987 crypto signals wrote:

We have a working Hub and Spoke setup over the Internet and the Hub also has an express route to Azure. 

We dont want the branch users going via the EXPRESSROUTE to Azure as its only for backup traffic from DC.

So we want to add a Fortigate NVA in Azure for branch to Azure connectivity. 

We  have a couple of servers in Azure that  the branches need access to but majority of the infra in an on-prem DC. Traffic to Azure is not critical or needs high priority.

For branches to Fortigate Azure connectivity. The way I see it, these are the options to deploy.

1. Setup ADVPN hub -2 on the Fortigate NVA in Azure.

2 . Setup Site to Site from DC HUB Fortigate to Azure and have the branches connect to Azure via the DC Fortigate. There would be some latency and bandwidth utilization but at least the design is simple.

3. Setup Dial UP Ipsec on Azure Fortigate and have the branches connect directly without ADVPN.

4. Configure the Azure Fortigate as a spoke in existing ADVPN.

Could someone please advice which option would be the simplest and something that doesnt a lot of overload and complexity to troubleshooting and operations.

Thanks.

---

Option 3 setting up Dial-Up IPsec VPN on the Azure FortiGate and letting branches connect directly is the simplest and most operationally efficient choice if traffic to Azure isn’t critical. It avoids extra ADVPN complexity and keeps troubleshooting lightweight.

Just like a bull put spread in trading where you're managing risk and reward in a defined range we’re trying to achieve a balance between simplicity, control, and operational efficiency in our network design

[alicejeans]

---

@austinmas1987 hsrp wrote:

We have a working Hub and Spoke setup over the Internet and the Hub also has an express route to Azure.

We dont want the branch users going via the EXPRESSROUTE to Azure as its only for backup traffic from DC.

So we want to add a Fortigate NVA in Azure for branch to Azure connectivity. 

We  have a couple of servers in Azure that  the branches need access to but majority of the infra in an on-prem DC. Traffic to Azure is not critical or needs high priority.

For branches to Fortigate Azure connectivity. The way I see it, these are the options to deploy.

1. Setup ADVPN hub -2 on the Fortigate NVA in Azure.

2 . Setup Site to Site from DC HUB Fortigate to Azure and have the branches connect to Azure via the DC Fortigate. There would be some latency and bandwidth utilization but at least the design is simple.

3. Setup Dial UP Ipsec on Azure Fortigate and have the branches connect directly without ADVPN.

4. Configure the Azure Fortigate as a spoke in existing ADVPN.

Could someone please advice which option would be the simplest and something that doesnt a lot of overload and complexity to troubleshooting and operations.

Thanks.

---

(Dial-up IPsec on Azure Fortigate) is likely the simplest and avoids adding ADVPN complexity. It allows direct branch-to-Azure connectivity without routing through the DC or modifying existing ADVPN setups.