The Software-defined network (SDN) connector allows FortiGate to dynamically pull metadata such as tags, IP addresses, and resource groups from Azure resources. This enables automatic policy updates based on dynamic IP changes, such as those of a Linux server in a protected subnet.

Enabling the IP forwarding setting on FortiGate (or any NVA) in Azure allows the VM to route traffic that is not destined for itself , effectively enabling it to act as a router or firewall . This is essential for scenarios where FortiGate inspects or filters traffic between subnets or from on-premises to Azure.

Infrastructure-as-a-Service (IaaS) allows you to deploy FortiWeb as a virtual machine in Azure, giving you granular control over vCPU and memory allocation . This model provides full flexibility over the compute resources and network configuration, which is essential for deploying and scaling security appliances like FortiWeb.

They support the use of availability zones – Standard public IP addresses are zone-redundant and support availability zone deployments for high availability.

They can be dynamic or static – Azure standard public IPs can be configured as static or dynamic, offering flexibility based on deployment needs.

A Microsoft Entra tenant is the primary administrative unit that represents an organization within Microsoft’s identity platform. It defines the boundary for identity management, access control, and resource governance , and serves as the core entity that connects the organization to Microsoft ' s cloud services such as Azure and Microsoft 365.

The FortiGate VM and the Windows Server VM are in different subnets but within the same Production virtual network , which means they can communicate by default unless restricted. Azure allows ICMP between subnets, but Windows VMs have ICMP blocked by default in their firewall settings. Therefore, the likely reason for the ping failure is that the Windows Server’s firewall is blocking ICMP (ping) traffic .

The route server subnet in Azure is a dedicated subnet that hosts the Azure Route Server , which functions as the hub for dynamic routing information exchange between Azure virtual networks and BGP-enabled network virtual appliances (NVAs) or on-premises routers. It enables seamless and centralized route propagation.

Enhanced protection for application and data in a single Azure region – Availability Zones provide physical separation of infrastructure within a single Azure region, protecting against datacenter-level failures.

Protect applications and data through high availability with fault isolation and redundancy – They offer fault isolation and redundancy, enabling high availability for applications and services by distributing them across multiple zones within the same region.

Azure does not allow you to view an existing client secret’s value after creation for security reasons. If you did not save the client secret when it was first generated, the quickest and only option is to create a new client secret under the existing app registration and use the new value in your FortiGate configuration.

The first and most direct diagnostic step is to verify the BGP peering status on both the FortiGate VM and Azure Route Server . If BGP peering is not established or is in an idle or down state, route propagation will fail. This check confirms whether the two systems are communicating and exchanging routes as expected.