Cloud · On-prem → Azure / AWS · Lesson 6 of 8

Map the control: an NSG is not your FortiGate

On-prem, fgt-hq is policy, NAT, IPS, and often WAF. In Azure an NSG is a 5-tuple. In AWS a security group is a 5-tuple. Neither is an NGFW. Map each control — FortiGate policy → NSG/SG + Azure Firewall / AWS Network Firewall, FAZ → Sentinel / Security Hub. Do not drop IPS/WAF because “the cloud is secure.”

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Map each FortiGate control on pay-api to an Azure and AWS equivalent.
Say why NSG/SG is not a replacement for IPS or WAF.
Land FAZ-style logs in Sentinel or Security Hub before cutover.
Refuse “cloud is secure” as a reason to delete a control.

The ticket

Cutover checklist: “NSG allow 443 from the hub.” On-prem, policy 20 was VIP 443 plus IPS plus WAF signature plus FAZ logging. After lift, pay-api is a VM with an NSG. The WAF policy is “we will add it later.” Shared responsibility did not delete OWASP. It moved the owner.

Quick interview answer

Map controls, do not translate product names. FortiGate firewall policy → Azure NSG + Azure Firewall (or AWS SG + NACL + Network Firewall). FortiGate IPS / app control / WAF → Azure Firewall IDPS + App Gateway/Front Door WAF (or AWS Network Firewall IPS + AWS WAF). FAZ → Sentinel / Defender or Security Hub + CloudTrail/GuardDuty. An NSG that allows 443 is not an NGFW. “Cloud is secure” is not a control.

Spreadsheet mapping FortiGate controls to Azure and AWS — If a row has no owner in the cloud, you dropped it.

Lab data · dummy only

On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40.

Mental model

On-prem (fgt-hq / FAZ)	Azure landing	AWS landing
Policy 20 WAN→VIP pay-api-443	App Gateway / public LB + WAF, or Firewall DNAT	ALB + AWS WAF, or NFW + GWLB
Policy 31 LAN→app (east-west)	NSG on NIC/subnet + Azure Firewall 10.40.0.4	sg-web + acl-app + NFW on TGW
IPS / app control	Azure Firewall IDPS / Defender for Cloud	Network Firewall IPS / GuardDuty
WAF signatures	App Gateway or Front Door WAF	AWS WAF on ALB/CloudFront
FAZ Log View	Log Analytics + Sentinel	CloudTrail + Security Hub + VPC Flow Logs
Admin HTTPS on mgmt only	No public 3389/22 on the NIC	No 0.0.0.0/0:22 on sg-web

Layers, not a rename

NSG/SG is one row. The FortiGate was four rows.

https://portal.azure.com

Training mock · not live

Azure portal

HomeManagement groupsVirtual networksAzure MigrateMicrosoft Entra

Azure Firewall Manager → hub-fw

Control map · pay-api

North-south

Azure Firewall 10.40.0.4 · DNAT 443 → 10.41.1.40

WAF

App Gateway WAF_v2 · policy OWASP 3.2

East-west

NSG nsg-payapi · 443 from hub only

Logs

Diagnostic settings → Sentinel

Not equivalent

NSG alone ≠ FortiGate policy 20

Azure Firewall + NSG + WAF. Training mock.

How to choose

Every FortiGate feature that actually hits pay-api gets a cloud row or a written accept-risk. “We have an NSG” closes none of IPS, WAF, or logging. If budget kills Azure Firewall / AWS NFW, say so in the risk file — do not pretend the NSG grew signatures.

Runbook

Side A — export the on-prem truth
FortiGate policies that mention pay-api / VIP / 10.20.30.40. FAZ report: accepts, denies, IPS hits, 30 days. That list is the map.
Side B — write the cloud rows
Azure: NSG + Firewall 10.40.0.4 + WAF + Sentinel. AWS: sg-web + acl-app + NFW/WAF + Security Hub. Same rows, two landings, pick the one you are using.
Side C — prove a hit
From a test client, allowed 443 is logged in Sentinel or Security Hub / Flow Logs. A blocked path is also logged. Empty SIEM = you dropped FAZ.

map · dummy

on-prem  policyid=20  WAN → VIP pay-api-443  UTM=ips,waf  log=faz
azure    afw-dnat 443→10.41.1.40  +  agw-waf  +  nsg-payapi  +  sentinel
aws      alb:443  +  aws-waf  +  sg-web  +  acl-app  +  security-hub

# gap if any row is blank: that control was dropped

Four failures

1 · NSG = NGFW

5-tuple allow is not IPS. Interviewers fail this on purpose.

2 · “Cloud is secure”

Shared responsibility: Microsoft/AWS secure the hypervisor. You still own the HTTP app.

3 · FAZ with no successor

After cutover the only log is the VM disk. You cannot prove who hit 443.

4 · Open 22/3389 “for migrate”

The temporary any-any from first-day FortiGate class, now in an NSG. Delete it before soak.

How to prove it

Close only when

1) Spreadsheet has a cloud owner for every on-prem control that touched pay-api. 2) WAF or an accepted risk exists. 3) A deny and an allow both show in Sentinel or Security Hub. 4) No 0.0.0.0/0 management ports.

Traps

Phrase	Reply
NSG is our firewall	NSG is a 5-tuple. Where is IPS/WAF/log?
NACL is stateful like FortiGate	NACL is stateless. SG is stateful. Neither inspects HTTP.
We will add WAF after go-live	Then you went live without the mapped control

On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview

Sources

Azure Network Security Groups.
Azure Firewall.
Amazon EC2 security groups.
AWS Security Hub.
Microsoft Sentinel.
FortiGate policy / FAZ logging from the FortiGate series — map those objects, do not assume they appear in the cloud.

Related: Azure landing zone · AWS Org / OU.