Deploy Azure Marketplace’s Fortigate Firewall into Azure Step By Step

FortiGate delivers:

• End-to-end security across the full attack cycle
• Top-rated security validated by third-party testing
• Tight integration and multitenancy with Azure
• Centralized management across physical, virtual, and cloud deployments
• Automation templates for rapid deployment

FortiGate virtual appliances offer protection from a broad array of threats, with support for all of the security and networking services offered by the FortiOS operating system.

IPS technology protects against current and emerging network-level threats. In addition to signature-based threat detection, IPS performs anomaly-based detection which alerts users to any traffic that matches attack behavior profiles.

• FortiGate Azure Virtual Machine Deployment Guide
• Tutorial: Microsoft Entra single sign-on (SSO) integration with FortiGate SSL VPN
• https://github.com/fortinet/azure-templates/tree/main/FortiGate

• FortiCare Premium Support
• FortiGuard App Control Service
• FortiGuard IPS Service
• FortiGuard Advanced Malware Protection
• FortiGuard Web Filtering Service
• FortiGuard Antispam Service

• DS1_v2 – 1vCPU, 3.5GiB RAM, 2 vNIC – $41.61/Month
• DS2_v2 – 2vCPU, 7GiB RAM, 2 vNIC – $83.22/Month
• DS3_v2 – 4vCPU, 14GiB RAM, 4 vNIC – $167.17/Month

FortiGate Subscription Cost

• 1 vCPU – $0.36/hr – $260 / Month
• 2 vCPU – $0.88/hr – $634 / Month
• 4 vCPU – $1.02/hr – $735 / Month

Steps

• Enable SSL VPN on FortiGate and Connect SSL VPN Using FortiClient (Free Lab with Test Drive)

# diagnose debug cloudinit show

# diagnose debug vm-print-license 

# execute vm-license 
PAYG license exists.

3. Go Dashboard > Status and in the Licenses widget verify the FortiCare Support status.

   

4. Once the registration is complete, you can log in to a FortiGate Cloud account and download the two free tokens that come standard with FortiGates (see FortiTokens).

then you can see details in FortiGuard license information page. Currently we are using a free license:

Get system status 

Conserve Mode default settings:

# diag hardware sysinfo conserve
memory conserve mode: off
total RAM: 3443 MB
memory used: 1285 MB 37% of total RAM
memory freeable: 474 MB 13% of total RAM
memory used + freeable threshold extreme: 3270 MB 95% of total RAM
memory used threshold red: 3029 MB 88% of total RAM
memory used threshold green: 2823 MB 82% of total RAM

If we assume that the memory will keep increasing from 70% until 98% here is what is supposed to happen: 

extreme>red>green
-when it reaches 95% it goes in extreme mode >>>>starts dropping new connections

-when it reaches 88% goes into red >>>>>>> begins conserve mode, but not to drop connections

-and when it goes below 82% it turns to green which should be the normal value >>>>> acts as nothing is happening, everything flows normal.

Monitoring and Alarming

We can configure an automated stitch to send an e-mail every time a threshold is reached on a FortiGate.

For CPU it could be:


1. First configure a threshold for CPU use:

config system global

    set cpu-use-threshold <percent> <- 80% in this case.

end



2. On the FortiGate

Security Fabric -> Automation -> Stitch -> Create New -> Add Trigger -> High CPU.

Add Action -> Email Notification.


For memory usage:


1. Security Fabric -> Automation -> Stitch -> Create New -> Add Trigger -> Conserve Mode.

 Add Action -> Email Notification.


For the moment Automation Stitch does not count for event log for session count.