Azure FG Cloud Deployment and Existing VNETS

[AeroSpaceAdmin]

Hey everyone,

So I need some help/guidance in figuring this out. I have deployed plenty of FortiGate's at the physical level but have never done a Cloud Firewall deployment and I am little bit confused. We just finished deploying and setting up some FG200Fs across 7 locations. We have SD-WAN and ADVPNs setup for all the locations.

I need to now deploy a FW into an existing Azure environment. Right now one of the resource groups and VNETs is being used as the Hub which only the locations that need access to the apps are connecting to via an IPSEC tunnel.

So now we want to install the FW in place of that hub. I can create a new VNET and RG for the firewall, but I am thinking it's just easier to drop it in there. I know I will need a new PIP for the firewall, but my question comes to the rest of the VNETS. The firewall is asking for an External Subnet, Internal Subnet, and Protected Subnet. This is where I get confused.

How do I get the existing VNETS to work with this? Any help or guidance would be greatly appreciated. I've seen videos and walkthrough on creating this from scratch, but how do I get this implemented into an existing network setup.

[Jean-Philippe_P]

Hello AeroSpaceAdmin, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Nishtha_Baria]

Hello @AeroSpaceAdmin,

On Azure FortiGate the External subnet, Internal subnet and Protected subnet is just a way Azure and FortiGate understands the subnet.

External Subnet: External subnet used to connect the FortiGate-VM to the Internet.

Internal Subnet: Internal subnet used as a transit network to one or multiple protected networks containing backend services, such as the web server.

Protected Subnet: Protected subnet used to deploy services. You can deploy multiples of these subnets.

You should be able to add all the VNETs that are required on the FortiGate and on your ADVPN setup

~Nishtha