FortiGate with public IP

Karol 0

Hi,

I'm trying to deploy FortiGate in Azure, but I want FortiGate to be able send out the traffic with public IP. I set up public load balancer with floating IP, created VIP on FGT with public IP and it works, but outbound traffic doesn't work. FortiGate SNATs traffic to public IP and Azure denies it. Is there a way to force Azure to accept it?

ChaitanyaNaykodi-MSFT 23,341 Reputation points Microsoft Employee

2024-05-04T03:32:15.69+00:00

@Karol

Thank you for reaching out.

I understand that you are facing issue with outbound connectivity from the FortiGate NVA's Public IP

There can be a NSG rule which might be blocking the connectivity. You can use IP flow verify to check if any NSG present in the network is blocking the connectivity.

If this does not help, can you share a rough network diagram and routes applied? The scenario above can also be caused by asymmetric routing configuration.

Thanks
Karol 0 Reputation points

2024-05-05T17:17:35.6133333+00:00

Hi,

Thanks for the answer. No, it's not NSG rule, it permits any to any. Outbound traffic works if FortiGate doesn't do source NAT to public IP. Traffic with a private IP address goes out normally..
ChaitanyaNaykodi-MSFT 23,341 Reputation points Microsoft Employee

2024-05-09T02:42:13.5966667+00:00

@Karol

Thank you for getting back.

Can you try the troubleshooting steps mentioned here? and see if you are able to diagnose a routing problem by viewing the routes that are effective for a network interface.

If this does not help, can you share a rough network diagram? Thanks

1 answer

Karol 0 Reputation points

2024-05-10T19:33:10.0033333+00:00

I checked NSG and it permits any to any. Also checked routing and it's ok. If FortiGate forwards traffic with private address and doesn't do SNAT to public adres, it works.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

FortiGate with public IP

1 answer