Azure internet edge inbound/DNAT use case

This feature is in preview. For information on Azure destination NAT (DNAT), see How to configure Destination NAT (DNAT) for Network Virtual Appliance in an Azure Virtual WAN hub.

FortiOS 7.4.4 and later versions support internet inbound deployment. The following shows the topology for this deployment scenario:

In this topology, FortiGate NVAs are deployed in hybrid mode with both SD-WAN and next generation firewalls (NGFW) into the vWAN hub. The size of the VMs is determined by the scale units, considering performance and capacity requirements. The NVAs must be managed by a centralized management system like FortiManager for a single source of truth and management interface for all your FortiGates. The centralized management system can be hosted on any cloud platform or on-premises. For log management and reporting, the FortiGates can be integrated with FortiAnalyzer.

The hybrid use case is best suited for:

Deployment	Description
Spoke (VNET) to Spoke (VNET) Inspection in Azure or Spokes in Two Different Regions Peered to Different Hubs	For example, when user wants to inspect Staging to Production traffic or block staging to production traffic
Internet Inbound Inspection to Azure:	For any internet inbound traffic to your workloads or web services in Azure, FortiGate will proxy and inspect the traffic before it forwards to the backend virtual machines or services.
Branch office, Data Center, On-prem connectivity	For all remote connections, the FortiGate inspects traffic to/from Azure to remote sites via SD-WAN tunnels that help optimize traffic routing by providing increased security, application performance, resiliency and high availability.

The internet inbound use case will have an External Load Balancer (ELB) deployed as part of the managed application. Load balancing rules will be configured from the FortiGate CLI, and once configured, they will be automatically pushed with an API call to the ELB.