# Map the control: an NSG is not your FortiGate Source: https://ai.techclick.in/blog_migrate_security_controls_map Markdown: https://ai.techclick.in/blog_migrate_security_controls_map.md Publisher: Techclick Infosec Pvt Ltd Map FortiGate policy to Azure NSG+Firewall or AWS SG+NACL+Firewall. NSG is not an NGFW. Keep IPS/WAF. ## The ticket Cutover checklist: “NSG allow 443 from the hub.” On-prem, policy 20 was VIP 443 plus IPS plus WAF signature plus FAZ logging. After lift, pay-api is a VM with an NSG. The WAF policy is “we will add it later.” Shared responsibility did not delete OWASP. It moved the owner. Quick interview answer Map controls, do not translate product names. FortiGate firewall policy → Azure NSG + Azure Firewall (or AWS SG + NACL + Network Firewall ). FortiGate IPS / app control / WAF → Azure Firewall IDPS + App Gateway/Front Door WAF (or AWS Network Firewall IPS + AWS WAF). FAZ → Sentinel / Defender or Security Hub + CloudTrail/GuardDuty. An NSG that allows 443 is not an NGFW. “Cloud is secure” is not a control. Hero · control spreadsheet If a row has no owner in the cloud, you dropped it. Lab data · dummy only On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40 . ## Mental model On-prem (fgt-hq / FAZ) Azure landing AWS landing Policy 20 WAN→VIP pay-api-443 App Gateway / public LB + WAF, or Firewall DNAT ALB + AWS WAF, or NFW + GWLB Policy 31 LAN→app (east-west) NSG on NIC/subnet + Azure Firewall 10.40.0.4 sg-web + acl-app + NFW on TGW IPS / app control Azure Firewall IDPS / Defender for Cloud Network Firewall IPS / GuardDuty WAF signatures App Gateway or Front Door WAF AWS WAF on ALB/CloudFront FAZ Log View Log Analytics + Sentinel CloudTrail + Security Hub + VPC Flow Logs Admin HTTPS on mgmt only No public 3389/22 on the NIC No 0.0.0.0/0:22 on sg-web Layers, not a rename - fgt-hq NGFW policy · IPS · WAF NSG / SG + NACL Azure FW / AWS NFW WAF Sentinel / Hub empty row = dropped control NSG/SG is one row. The FortiGate was four rows. https://portal.azure.com Training mock · not live Azure portal Home Management groups Virtual networks Azure Migrate Microsoft Entra Azure Firewall Manager → hub-fw ### Control map · pay-api North-south Azure Firewall 10.40.0.4 · DNAT 443 → 10.41.1.40 WAF App Gateway WAF_v2 · policy OWASP 3.2 East-west NSG nsg-payapi · 443 from hub only Logs Diagnostic settings → Sentinel Not equivalent NSG alone ≠ FortiGate policy 20 Cancel Save Azure Firewall + NSG + WAF. Training mock. ## How to choose Every FortiGate feature that actually hits pay-api gets a cloud row or a written accept-risk. “We have an NSG” closes none of IPS, WAF, or logging. If budget kills Azure Firewall / AWS NFW, say so in the risk file — do not pretend the NSG grew signatures. ## Runbook #### Side A — export the on-prem truth FortiGate policies that mention pay-api / VIP / 10.20.30.40 . FAZ report: accepts, denies, IPS hits, 30 days. That list is the map. - #### Side B — write the cloud rows Azure: NSG + Firewall 10.40.0.4 + WAF + Sentinel. AWS: sg-web + acl-app + NFW/WAF + Security Hub. Same rows, two landings, pick the one you are using. - #### Side C — prove a hit From a test client, allowed 443 is logged in Sentinel or Security Hub / Flow Logs. A blocked path is also logged. Empty SIEM = you dropped FAZ. map · dummy on-prem policyid=20 WAN → VIP pay-api-443 UTM=ips,waf log=faz azure afw-dnat 443→10.41.1.40 + agw-waf + nsg-payapi + sentinel aws alb:443 + aws-waf + sg-web + acl-app + security-hub # gap if any row is blank: that control was dropped ## Four failures ### 1 · NSG = NGFW 5-tuple allow is not IPS. Interviewers fail this on purpose. ### 2 · “Cloud is secure” Shared responsibility: Microsoft/AWS secure the hypervisor. You still own the HTTP app. ### 3 · FAZ with no successor After cutover the only log is the VM disk. You cannot prove who hit 443. ### 4 · Open 22/3389 “for migrate” The temporary any-any from first-day FortiGate class, now in an NSG. Delete it before soak. ## How to prove it Close only when 1) Spreadsheet has a cloud owner for every on-prem control that touched pay-api. 2) WAF or an accepted risk exists. 3) A deny and an allow both show in Sentinel or Security Hub. 4) No 0.0.0.0/0 management ports. ## Traps Phrase Reply NSG is our firewall NSG is a 5-tuple. Where is IPS/WAF/log? NACL is stateful like FortiGate NACL is stateless. SG is stateful. Neither inspects HTTP. We will add WAF after go-live Then you went live without the mapped control ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 An NSG or security group is… An NGFW with IPS and WAF A 5-tuple filter — not a FortiGate replacement The same as FAZ ExpressRoute encryption Correct: b . Core point. Q2 FortiGate IPS/WAF for pay-api should map to… Nothing — cloud is secure Azure Firewall IDPS + WAF, or AWS NFW + AWS WAF Only an NSG allow 443 Deleting FAZ Correct: b . Map the control. Q3 FAZ successor in this series? Sentinel and/or Security Hub The VM console screenshot FortiManager ADOM Route 53 Correct: a . Logging row. Q4 Azure Firewall in this lab sits at… 10.20.30.40 10.40.0.4 203.0.113.10 10.51.1.40 Correct: b . Azure series hub. Q5 “Cloud is secure” as a reason to drop WAF is… Correct — shared responsibility covers OWASP Wrong — you still own the HTTP app Required by CAF The same as retain Correct: b . Failure 2. Q6 A blank row on the control map means… The control was dropped NSG inherited it ER encrypts it MGN copies signatures Correct: a . Concept. Check answers Reset On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview ## Sources - Azure Network Security Groups . - Azure Firewall . - Amazon EC2 security groups . - AWS Security Hub . - Microsoft Sentinel . - FortiGate policy / FAZ logging from the FortiGate series — map those objects, do not assume they appear in the cloud. Related: Azure landing zone · AWS Org / OU . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt