Configure FortiGate firewall policies and virtual IPs

This recipe is part of the process of deploying FortiGate HA Active Active for Microsoft Azure using Azure load balancer. See below for the rest of the recipes in this process:

1. Basic concepts
   • Traffic flow
   • Azure load balancer
     • Inbound NAT rules
     • Load balancing rules
2. Locate FortiGate HA for Azure in the Azure portal or Azure marketplace
3. Determine your licensing model
4. Configure FortiGate initial parameters
5. Create VNet and subnets in network settings
6. Select Azure instance type
7. Assign Azure IP address
8. Validate deployment resources
9. Create FortiGate instances
10. Connect to the FortiGate
11. [Use case] Set up a Windows Server in the protected network
12. Configure FortiGate firewall policies and virtual IPs
13. [Failover test] Create load balancing rules and access the Windows Server via remote desktop

1. First, configure FortiGate A. In the FortiGate-VM console, select Policy & Objects > IPv4 Policy and create two new policies, as shown in this example. Create one policy for outgoing traffic from the private subnet, through the public subnet, to the Internet. Create another policy for incoming traffic from the Internet, through the public subnet, to the private subnet.

2. Select Virtual IPs and create a new virtual IP, as shown in the example. This is Static NAT configuration.

3. Edit the second policy. In the Destination field, enter the Windows Server’s IP address. In this example, it is 10.0.1.6.
4. Repeat the same configuration on FortiGate B to have a virtual IP address for RDP and IPv4 firewall policies for incoming and outgoing traffic.

The post Configure FortiGate firewall policies and virtual IPs appeared first on Fortinet Cookbook.