# FortiGate to Azure: route-based IKEv2, LNG is the on-prem map Source: https://ai.techclick.in/blog_vpn_fortigate_to_azure Markdown: https://ai.techclick.in/blog_vpn_fortigate_to_azure.md Publisher: Techclick Infosec Pvt Ltd FortiGate route-based IKEv2 to Azure VPN Gateway. Local Network Gateway = 203.0.113.10 + 10.20.30.0/24. ## The ticket Azure VM in 10.40.0.0/16 cannot reach Priya 10.20.30.80. Connection shows Not connected. Junior typed the Azure public 203.0.113.50 into the Local Network Gateway. LNG is the on-prem map: 203.0.113.10 + 10.20.30.0/24. The FortiGate remote-gw is 203.0.113.50. Quick interview answer Azure S2S uses three objects: virtual network gateway (Gateway type VPN, VPN type Route-based, public 203.0.113.50, subnet named GatewaySubnet), local network gateway (on-prem public 203.0.113.10 + address space 10.20.30.0/24), connection (Site-to-site IPsec, shared key, IKE Protocol IKEv2). FortiOS: route-based tunnel to 203.0.113.50, route 10.40.0.0/16 via that if, policies both ways. Prefer route-based. Azure PolicyBased is Basic + IKEv1 and is no longer created in the portal. SKU/active-active: later, from the Learn SKU table - do not quote folklore Mbps. Hero · hybrid LNG faces on-prem. VNet GW faces Azure. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Object Job This lab Virtual network gateway (VPN) Azure IPsec endpoint Route-based, public 203.0.113.50, hub 10.40.0.0/16 GatewaySubnet Required name for GW VMs A subnet inside 10.40.0.0/16, nothing else deployed there Local network gateway Azure’s map of on-prem IP 203.0.113.10, address space 10.20.30.0/24 Connection PSK + IKE + links GW to LNG Site-to-site (IPsec), IKEv2, policy-based selectors off FortiGate vpn-azure Route-based IKEv2 peer Remote 203.0.113.50, route 10.40.0.0/16, NAT off Who holds which IP On-prem FortiGate to Azure VPN Gateway HQ LAN 10.20.30.0/24 fgt-hq 203.0.113.10 - IKEv2 S2S route-based VpnGw 203.0.113.50 Hub VNet 10.40.0.0/16 If the LNG IP is 203.0.113.50, Azure is trying to peer with itself. https://portal.azure.com/#view/Microsoft_Azure_Network Training mock · not live Azure portal Virtual networks VPN gateways Connections Virtual networks → VPN gateways → Connections ### Local network gateway lng-fgthq Name lng-fgthq Endpoint IP address IP address 203.0.113.10 Address space 10.20.30.0/24 Virtual network gateway Route-based · public 203.0.113.50 Connection type Site-to-site (IPsec) · IKE Protocol IKEv2 Use policy based traffic selectors No (route-based peer) SKU / active-active Later - current Learn SKU table, not folklore Cancel Save Azure VPN Gateway + local network gateway + connection. Training mock. Not a live tenant. ## How to choose New hybrid: Route-based VNet GW + IKEv2 + FortiGate route-based . Do not stand up PolicyBased/Basic to match an old FortiGate policy-based habit. Use policy-based traffic selectors on a route-based GW only when the on-prem device cannot do 0/0 and Microsoft’s doc for that peer says to enable them - then mirror the selector list (lesson 3). Active-active is a second FortiGate Phase-1 to the second Azure public; leave it for a later change window. ## Runbook #### Side A - Azure objects GatewaySubnet exists and is empty. VNet GW VPN / Route-based / public 203.0.113.50. LNG = 203.0.113.10 + 10.20.30.0/24. Connection: shared key, IKEv2, Connected after IKE. - #### Side B - FortiGate vpn-azure remote-gw 203.0.113.50, IKEv2, same PSK, Phase-2 0.0.0.0/0 (route-based) or the agreed prefixes. Route 10.40.0.0/16 via vpn-azure. Policies LAN ↔ vpn-azure, NAT off. - #### Side C - prove IKE + child SA on FortiGate. Azure connection Connected. Sourced ping 10.20.30.1 → a hub test IP. Effective routes on the Azure NIC show 10.20.30.0/24 via the VNet GW. fgt-hq · Azure proof diagnose vpn ike gateway list name vpn-azure # remote: 203.0.113.50 IKE version: 2 IKE SA: established diagnose vpn tunnel list name vpn-azure # dest: 203.0.113.50 status: up get router info routing-table details 10.40.0.0 # 10.40.0.0/16 via vpn-azure execute ping-options source 10.20.30.1 execute ping 10.40.0.4 # pick a real hub IP that exists in the dummy; do not invent a SKU limit ## Four failures ### 1 · LNG IP is the Azure public Swap: LNG = on-prem 203.0.113.10. FortiGate remote-gw = 203.0.113.50. ### 2 · LNG address space missing 10.20.30.0/24 IKE can come up. Azure has nowhere to send return packets for Priya. ### 3 · 0.0.0.0/0 vs /24 on a policy-based or “use policy based traffic selectors” peer Lesson 3. Prefer route-based and turn that checkbox off. ### 4 · Invented SKU / active-active “because HA” SKU, throughput, and active-active second public are a change-control item. Read About gateway SKUs. Do not quote a remembered Mbps in the interview. ## How to prove it Close only when 1) LNG IP and prefixes are on-prem. 2) IKE + child SA + Azure Connected. 3) Route 10.40.0.0/16 is vpn-azure. 4) Bidirectional ping with LAN source. 5) You did not invent a SKU number. ## Traps Symptom Object Wrong fix Not connected PSK / IKE / LNG IP swapped New VpnGw SKU Connected, no return LNG address space / Azure UDR Another Phase-1 Phase-2 flaps Selectors 0/0 vs /24 Convert GW to PolicyBased ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Azure local network gateway in this lab holds… 203.0.113.50 and 10.40.0.0/16 On-prem 203.0.113.10 and 10.20.30.0/24 AWS VGW 203.0.113.60 SSL-VPN pool 10.20.40.0/24 Correct: b . LNG is the on-prem map. Q2 FortiGate remote gateway for Azure is… 203.0.113.50 203.0.113.10 10.40.0.4 198.51.100.10 Correct: a . VNet GW public. Q3 Preferred Azure VPN type for this FortiGate? Route-based + IKEv2 Policy-based Basic + IKEv1 SSL-VPN ExpressRoute without a connection Correct: a . Learn + this series. Q4 Gateway subnet must be named… GatewaySubnet AzureFirewallSubnet ssl.root vpn-branch Correct: a . Azure VPN Gateway settings. Q5 IKE up, Azure VM cannot reach Priya. First Azure object to re-read? LNG address space 10.20.30.0/24 VpnGw Mbps folklore ssl.root AWS Customer Gateway Correct: a . Failure 2. Q6 Where do you pick a VpnGw SKU from? Memory of a blog Mbps table The current Microsoft Learn gateway SKU page FortiOS get system status RFC 7296 Correct: b . Do not invent SKUs. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - About Azure VPN Gateway . - Azure VPN Gateway configuration settings (VPN type, GatewaySubnet, local network gateway, connection) . - About Azure VPN Gateway SKUs (do not memorise folklore Mbps) . - FortiOS 7.4 - IPsec VPN . - RFC 7296 - IKEv2 . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt