Microsoft Azure vWAN and NVA overview

Microsoft Azure virtual WAN (vWAN) architecture brings together networking, security, and routing functionality to allow branches and endpoints to connect to virtual networks (VNets) located in Azure. The Azure vWAN uses a hub and spoke architecture, where virtual WAN hubs within the vWAN are connected in full mesh, creating the backbone for a global transit network for any-to-any connectivity. Branches and endpoints form the spokes, connecting to the vWAN hub for connectivity. The default vWAN caters to different types of spokes that can connect to the vWAN hub by using different methods, such as ExpressRoute, site-to-site VPN, and point-to-site VPN. Point-to-site VPN is only possible through IPsec with ports 4500/500.

For more information, see What is Azure Virtual WAN?

Microsoft also partners with third-party solution providers, such as Fortinet, to deploy network virtual appliances (NVAs) to a vWAN hub.

In this way, Microsoft customers can deploy FortiGate NVAs to provide SD-WAN connectivity and NGFW security across regions. The FortiGate NVAs running in the vWAN hub can inspect all North-South, East-West, and internet-bound traffic. At the same time, the FortiGate NVAs offer SD-WAN connectivity for performance and redundancy.

For more information about Microsoft support for NVAs, see Security Provided by NVA firewalls.