Azure Cookbook

• About FortiGate-VM for Azure
  • Instance type support
  • Region support
  • Models
  • Licensing
    • Order types
    • Creating a support account
• Deploying FortiGate-VM on Azure
  • Azure services and components
  • Deploying FortiGate-VM from a VHD image file
  • Deploying FortiGate with custom ARM templates
    • Invoking custom ARM templates
    • Bootstrapping the FortiGate CLI at initial bootup using user data
    • Bootstrapping the FortiGate CLI and BYOL license at initial bootup using user data
  • Deploying FortiGate-VM using Azure PowerShell
    • Running PowerShell to deploy FortiGate-VM
    • Bootstrapping the FortiGate CLI and BYOL license at initial bootup using user data
  • Deploying FortiGate-VM on regional Azure clouds
  • Enabling accelerated networking on the FortiGate-VM
  • Upgrading FortiOS
• Deploying auto scaling on Azure
  • Acronyms
  • Obtaining the deployment package
  • Usage and terms
    • Deployment templates
    • Configurable variables
  • Creating a template deployment
  • Pre-deployment activities
  • Deploying FortiGate Autoscale for Azure (PAYG instances)
    • Obtaining the endpoint URL of the Function App
    • Uploading configset files to the Storage account
    • Post-deployment configuration
    • Verifying the PAYG deployment
  • Connecting to the FortiGate-VM instances
  • Deploying FortiGate Autoscale for Azure (hybrid licensing)
    • Uploading files to the Storage account
    • Running the start commands
    • Verifying the hybrid licensing deployment
  • Connecting to the FortiGate-VM instances
  • Troubleshooting
  • Appendix
    • FortiGate Autoscale for Azure features
    • FortiGate Autoscale for Azure HA topology (PAYG instances)
    • Cloud-init (PAYG instances)
    • Cloud-init (hybrid licensing)
    • Architectural diagrams
• Single FortiGate-VM deployment
  • Registering and downloading your license
  • Subscribing the FortiGate-VM
  • Connecting to the FortiGate-VM
  • Network interfaces and routes
  • Using public IP addresses
• HA for FortiGate-VM on Azure
  • Deploying and configuring active-passive HA within one zone
    • About the ARM template
    • Reviewing the network topology
    • Checking the prerequisites
    • Invoking the ARM templates
    • Template parameters
    • Validating the deployment
    • Configuring the network via the CLI
    • Installing the FortiGate license (BYOL only)
    • Configuring multiple public IP addresses
    • Troubleshooting
  • Deploying and configuring active-passive HA between multiple zones
  • Deploying and configuring Azure load-balancing HA
    • Basic concepts
    • Locating FortiGate HA for Azure in the Azure portal marketplace
    • Determining your licensing model
    • Configuring FortiGate-VM initial parameters
    • Creating the VNet and subnets in network settings
    • Selecting the Azure instance type
    • Assigning the Azure IP address
    • Validating deployment resources
    • Creating the FortiGate-VM instances
    • Connecting to the FortiGate-VMs
    • Setting up a Windows server in the protected network
    • Configuring FortiGate firewall policies and virtual IP addresses
    • Public IP addresses with Azure public LB
    • (Failover test) Creating load balancing rules and accessing the Windows server via RDP
  • VNet peering
• Fabric connector integration with Azure or Azure Stack
  • Automatically updating dynamic addresses using Fabric connector (Azure)
    • Required information
    • Getting the Azure tenant ID
    • Getting the Azure subscription ID
    • Getting the Azure resource group
    • Azure client ID and Azure client secret
    • Configuring the FortiGate-VM
    • Tagging a resource
    • Creating an address
    • Azure Kubernetes (AKS) Fabric connector
    • Dynamic address in a policy
    • Troubleshooting Azure Fabric connector
  • Automatically updating dynamic addresses using Fabric connector (Azure Stack)
• VPN for FortiGate-VM on Azure
  • Connecting a local FortiGate to an Azure VNet VPN
  • Connecting a local FortiGate to an Azure FortiGate via site-to-site VPN
  • vWAN
• Azure Sentinel
  • Sending FortiGate logs for analytics and queries