Global vent peering through Fortinet Firewall

Question

Hello,

we have a prod(UK South) and DR(UK West) setup on Azure. A global vnet peering is setup between these 2 regions.One of the requirement from security team is to route inter region traffic through a Fortinet firewall deployed in the hub.

Can we achieve this scenario? is it possible to route inter region traffic through FW and then over Azure backbone?
Please help.

Answer 1

Hello @Mohammed Thahif BK

Thank you for your post.

Please read the following article that may fit into your network design which is the one below:

https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

Looking forward to your feedback,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello @Mohammed Thahif BK ,

As per my understanding from the question above you have two regions (UK South) and (UK West) which have global peering set-up and now you have requirement to send all inter region communication via Fortinet firewall deployed in the Hub vnet.

As mentioned by @risolis this architecture is definitely achievable, you can refer this architecture which resembles your requirement. You can implement user-defined routes (UDRs) to force traffic destined to a spoke to be sent to Azure Firewall or a network virtual appliance acting as a router at the hub. For spoke connectivity you can create routes to forward traffic from the spoke to the firewall or network virtual appliance, which can then route to the second spoke. In this scenario, you must configure the peering connections to allow forwarded traffic.

Based on your questions above.

is it possible to route inter region traffic through FW and then over Azure backbone?

Once peered, the virtual networks exchange traffic by using the Azure backbone.

Do we need to have a S2S vpn b/n these 2 firewalls? using their private IP as peer addresses?

As mentioned in the architecture documentation shared above you can also use a VPN gateway to route traffic between spokes but since your requirement is to send traffic via Firewall in your Hub vnet, global vnet peering with UDR will be a better option here.

You can also go through this documentation for additional details on Requirements and constraints for Vnet peering.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.