The ticket
Azure VM in 10.40.0.0/16 cannot reach Priya 10.20.30.80. Connection shows Not connected. Junior typed the Azure public 203.0.113.50 into the Local Network Gateway. LNG is the on-prem map: 203.0.113.10 + 10.20.30.0/24. The FortiGate remote-gw is 203.0.113.50.
Azure S2S uses three objects: virtual network gateway (Gateway type VPN, VPN type Route-based, public 203.0.113.50, subnet named GatewaySubnet), local network gateway (on-prem public 203.0.113.10 + address space 10.20.30.0/24), connection (Site-to-site IPsec, shared key, IKE Protocol IKEv2). FortiOS: route-based tunnel to 203.0.113.50, route 10.40.0.0/16 via that if, policies both ways. Prefer route-based. Azure PolicyBased is Basic + IKEv1 and is no longer created in the portal. SKU/active-active: later, from the Learn SKU table - do not quote folklore Mbps.
FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.
Mental model
| Object | Job | This lab |
|---|---|---|
| Virtual network gateway (VPN) | Azure IPsec endpoint | Route-based, public 203.0.113.50, hub 10.40.0.0/16 |
| GatewaySubnet | Required name for GW VMs | A subnet inside 10.40.0.0/16, nothing else deployed there |
| Local network gateway | Azure’s map of on-prem | IP 203.0.113.10, address space 10.20.30.0/24 |
| Connection | PSK + IKE + links GW to LNG | Site-to-site (IPsec), IKEv2, policy-based selectors off |
| FortiGate vpn-azure | Route-based IKEv2 peer | Remote 203.0.113.50, route 10.40.0.0/16, NAT off |
If the LNG IP is 203.0.113.50, Azure is trying to peer with itself.
Local network gateway lng-fgthq
How to choose
New hybrid: Route-based VNet GW + IKEv2 + FortiGate route-based. Do not stand up PolicyBased/Basic to match an old FortiGate policy-based habit. Use policy-based traffic selectors on a route-based GW only when the on-prem device cannot do 0/0 and Microsoft’s doc for that peer says to enable them - then mirror the selector list (lesson 3). Active-active is a second FortiGate Phase-1 to the second Azure public; leave it for a later change window.
Runbook
Side A - Azure objects
GatewaySubnet exists and is empty. VNet GW VPN / Route-based / public 203.0.113.50. LNG = 203.0.113.10 + 10.20.30.0/24. Connection: shared key, IKEv2, Connected after IKE.
Side B - FortiGate
vpn-azure remote-gw 203.0.113.50, IKEv2, same PSK, Phase-2 0.0.0.0/0 (route-based) or the agreed prefixes. Route 10.40.0.0/16 via vpn-azure. Policies LAN ↔ vpn-azure, NAT off.
Side C - prove
IKE + child SA on FortiGate. Azure connection Connected. Sourced ping 10.20.30.1 → a hub test IP. Effective routes on the Azure NIC show 10.20.30.0/24 via the VNet GW.
diagnose vpn ike gateway list name vpn-azure # remote: 203.0.113.50 IKE version: 2 IKE SA: established diagnose vpn tunnel list name vpn-azure # dest: 203.0.113.50 status: up get router info routing-table details 10.40.0.0 # 10.40.0.0/16 via vpn-azure execute ping-options source 10.20.30.1 execute ping 10.40.0.4 # pick a real hub IP that exists in the dummy; do not invent a SKU limit
Four failures
1 · LNG IP is the Azure public
Swap: LNG = on-prem 203.0.113.10. FortiGate remote-gw = 203.0.113.50.
2 · LNG address space missing 10.20.30.0/24
IKE can come up. Azure has nowhere to send return packets for Priya.
3 · 0.0.0.0/0 vs /24 on a policy-based or “use policy based traffic selectors” peer
Lesson 3. Prefer route-based and turn that checkbox off.
4 · Invented SKU / active-active “because HA”
SKU, throughput, and active-active second public are a change-control item. Read About gateway SKUs. Do not quote a remembered Mbps in the interview.
How to prove it
1) LNG IP and prefixes are on-prem. 2) IKE + child SA + Azure Connected. 3) Route 10.40.0.0/16 is vpn-azure. 4) Bidirectional ping with LAN source. 5) You did not invent a SKU number.
Traps
| Symptom | Object | Wrong fix |
|---|---|---|
| Not connected | PSK / IKE / LNG IP swapped | New VpnGw SKU |
| Connected, no return | LNG address space / Azure UDR | Another Phase-1 |
| Phase-2 flaps | Selectors 0/0 vs /24 | Convert GW to PolicyBased |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview
Sources
- About Azure VPN Gateway.
- Azure VPN Gateway configuration settings (VPN type, GatewaySubnet, local network gateway, connection).
- About Azure VPN Gateway SKUs (do not memorise folklore Mbps).
- FortiOS 7.4 - IPsec VPN.
- RFC 7296 - IKEv2.
Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.