Fortigate VM in Azure not listening for Virtual IPs

[kalpesh6331]

Hi Team,

I am new to Fortigate here and would really appreciate your help!

My usecase is that I want to do a port forward request to the Azure App Gateway from the Fortigate VM.

As per the Azure documentation, I have created the "Virtual IP" for the port that I need to use with following configuration:

1. External IP: My WAN IP (User will hit Fortigate VM public IP from the request)

2. Map to IPv4 Address: My App Gateway IP

3. Port Forwarding enabled 8443 -> 8443

Now my assumption is that with the above Virtual IP configuration, Fortigate VM should start listening on port 8443.

I have also setup firewall policy for the same.
The issue is that I am not able to connect to the Fortigate IP on port 8443, it seems like the VM is not listening for it.

Is this correct configuration? or am I missing something here?
Your guidance will be really helpful.

[JoerVan]

Hi,

In Azure the public IP is never seen by the VM running inside of a VNET. The public IP is translated to the private IP attached to the VM. In case of a FortiGate VM this means you will have a private IP on the external side of the FortiGate linked to a public IP address. You will need to create a VIP for the private IP address on the external side instead of the public IP address.

You can check the logs of the FortiGate and also run a sniffer (diag sniffer packet port1 'port 8443' 4 0) to see what is going on.

Also make sure to verify the network security group if any is deployed to verify that the port is allowed.

For more information on the integration of FortiGate with an Azure App Gateway you can check the below link:

https://github.com/40net-cloud/fortinet-azure-solutions/tree/main/FortiGate/AzureApplicationGateway

Regards,

Joeri