Azure Site To site doubt with fortiGate

orlando sanchez 1

Good afternoon I have a query, I have created a VPN site to Site with a client that has a FortiClient 6.0.3. Firewall, I have the tunnel established and connected but it does not generate traffic, now on the side where they have the firewall they told us that the traffic Since it is unidirectional and it must be generated from Azure to onpremise, I understood that the Site to site Azure communications were bidirectional but I am not sure, if they are unidirectional as it should do the configuration of the Azure side, they mentioned on the firewall side that we should do NAT-T, NAT-T is supported by Azure, what alternative do I have to avoid putting a VPN appliance in the middle?

thanks in advance

GitaraniSharma-MSFT 49,581 Reputation points Microsoft Employee

2020-08-03T12:07:56.267+00:00

Hello @orlandosanchez-2095 ,

The Azure VPN Gateway act both as initiator and responder for VPN access. And NAT-T is not supported by Azure.
Please refer the following article for Azure S2S route based VPN configuration with Fortinet client :
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/255100/ipsec-vpn-to-azure

May I know what is the end goal of your setup?

Thanks,
Gita
orlando sanchez 1 Reputation point

2020-08-03T15:24:06.357+00:00

Thank you very much for the information, I will check the documentation that you send me, the, the installation was made by another person and when I could not move forward, I will pass it to me, I will check this documentation, grateful for your help. The purpose is that the client connects to an onpremise service, but whoever provides onpremise accepts only public IP addresses to make the site-to-site connection and that any virtual machine within azure must leave with public IP for the connection

1 answer

orlando sanchez 1 Reputation point

2020-08-03T15:13:47.38+00:00

Thank you very much for the information, I will check the documentation that you send me, the, the installation was made by another person and when I could not move forward, I will pass it to me, I will check this documentation, grateful for your help. The purpose is that the client connects to an onpremise service, but whoever provides onpremise accepts only public IP addresses to make the site-to-site connection and that any virtual machine within azure must leave with public IP for the connection
Please sign in to rate this answer.
GitaraniSharma-MSFT 49,581 Reputation points Microsoft Employee

2020-08-05T08:43:18.82+00:00

Hello @orlando sanchez ,

Azure VPN gateway doesn't support NAT. So your requirement will not be possible using an Azure VPN gateway. You may however go for any NVA (Network Virtual Appliance) from the Azure Marketplace which supports NAT/VPN and consult the respective vendor for the configuration support.

GitaraniSharma-MSFT 49,581 Reputation points Microsoft Employee

2020-08-07T12:26:54.543+00:00

Hello @orlando sanchez ,

Could you please provide an update on this post?

Thanks,
Gita

GitaraniSharma-MSFT 49,581 Reputation points Microsoft Employee

2020-08-10T09:38:08.043+00:00

Hello @orlando sanchez ,

Could you please provide an update on this post?

Thanks,
Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Site To site doubt with fortiGate

1 answer

Your answer