Technical Tip: Add additional interface on Azure FortiGate Single VM Appliance

[Francesko]

Description	This article describes how to add and configure additional interfaces for 'Single VM' deployments of FortiGate in Azure.
Scope	FortiGate, Single-VM FortiGate Azure.
Solution	By default, FortiGate deployments in Azure have only 2 NICs associated with them. To add NIC, the following requirements should be met: Virtual Machine size should support more than 2 NICs. Refer to the 'Sizes for virtual machines in Azure' documentation to determine the maximum number of NICs supported for each VM Series: Sizes for virtual machines in Azure A new interface should be created in the same resource group and region as the FortiGate VM. If a public IP is associated with the new NIC, it should have the same SKU as other public IPs attached to the FortiGate VM. To attach the interface to the FortiGate, the VM must be in a stopped state. This will cause downtime and a maintenance window is recommended to implement the changes. The following steps must be followed to add interface to the FortiGate VM: Step 1: Create a new dedicated subnet in the FortiGate VNET. The size of the subnet may differ for each case, depending on the initial deployment. Step 2: Create a new network interface by searching for 'Network interfaces' in the Azure search bar. Virtual Network: Select FortiGate VNET. Subnet: Select the new subnet created in step 1. Private IPv4 address: First three (3) IP addresses of the new subnet are reserved and cannot be used here. Step 3: In the newly created interface, enable IP forwarding and optionally, associate a public IP address to it. Step 4: On the same interface, under the Network Security Group settings, select the NSG (Network Security Group) which the other FortiGate interfaces are part of. Step 5: Stop the VM and attach the new interface to FortiGate by going to FortiGate VM -> Networking -> Network Settings -> Attach Network Interface. Step 6: Turn on the VM and configure the network interface on the FortiGate side, with the IP and subnet used in Step 2. Step 7: Adjust the static routes to match the newly created subnet and create a new default route to prevent asymmetric routing if a public IP is associated with the new interface. Note: The gateway IP for the new subnet is the first usable IP address. If everything is configured correctly, both interfaces should be reachable from the internet. 'sriovslv1' in the packet sniffer means that the 'Accelerated Networking' feature is enabled for the NIC on Azure.