Create an IPSec VPN connection FROM an on-prem FortiGate TO an Azure VPN Gateway

Question

Create an IPSec VPN connection FROM an on-prem FortiGate TO an Azure VPN Gateway

LIGEngelsen 75

I am attempting to create an IPSec VPN connection from my on-prem FortiGate to an Azure VPN Gateway. I have followed the instructions outlined here, but currently the Connection (in Azure) is "Not Connected".

Screenshot 2025-04-21 at 10.32.03 AM

I would like to set-up a troubleshooting session between myself, Fortinet support, and Microsoft.

LIGEngelsen 75 Reputation points

2025-04-21T14:41:20.86+00:00

When I attempt to run "VPN Troubleshoot" within Azure, I'm told that both the "Connection" and the "VPN Gateway" are Unhealthy.

When I run a packet capture on the (on-prem) FortiGate I can see outbound UPD traffic on port 500, which is trying to contact the Azure Public IP. However, from the FortiGate's perspective, there is no inbound traffic (from Azure).
LIGEngelsen 75 Reputation points

2025-04-21T18:09:49.85+00:00

Here are the screenshots that show that the Phase 1 & 2 settings from both the FortiGate and Azure side:

Accepted answer

0 additional answers

Your answer

LIGEngelsen 75 Reputation points

2025-04-21T14:41:20.86+00:00

When I attempt to run "VPN Troubleshoot" within Azure, I'm told that both the "Connection" and the "VPN Gateway" are Unhealthy.

When I run a packet capture on the (on-prem) FortiGate I can see outbound UPD traffic on port 500, which is trying to contact the Azure Public IP. However, from the FortiGate's perspective, there is no inbound traffic (from Azure).
LIGEngelsen 75 Reputation points

2025-04-21T18:09:49.85+00:00

Here are the screenshots that show that the Phase 1 & 2 settings from both the FortiGate and Azure side:

Answer 1

Praveen Bandaru 5,520 Microsoft External Staff Moderator

Hello LIGEngelsen

I understand that you're experiencing issues with your VPN connection between your on-prem FortiGate and Azure VPN Gateway.

To assist with further investigation, could you please provide the following information:

Share the parameters for both phase 1 and phase 2 of your Azure and on-prem VPN configurations screen shot.
The IPSec lifetime values for your VPN setup screen shot.
If you're using default parameters, the on-prem parameters should be listed as below. Please check the reference document for Default IPsec/IKE parameters

Check the below document for more understanding:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator

2025-04-21T19:29:32.4966667+00:00

Hello LIGEngelsen

Using Azure Private IP Address is enabled in Azure connections; we just disabled it. In Azure VPN configuration, if possible, could you set the IPsec SA lifetime to 102400000 kilobytes and 27000 seconds.

For on-prem, you need to add 28800 in Phase-1 and 27000 in Phase-2. Also, you need to disable the PFS checkbox.

Using Azure Private IP Address is enabled in Azure connections; we just disabled it.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
LIGEngelsen 75 Reputation points

2025-04-21T19:33:20.5733333+00:00

Share via

Create an IPSec VPN connection FROM an on-prem FortiGate TO an Azure VPN Gateway

0 additional answers

Your answer