Simplify Azure Fabric connector configuration for a FortiGate-VM deployed on Azure

For a FortiGate-VM deployed on Azure, the new Use managed identity setting allows FortiOS to connect to Azure based on the FortiGate-VM's user-assigned managed identity. Using user-assigned managed identities enables a FortiGate-VM deployed on Azure to authenticate to cloud services without storing credentials in FortiOS.

When you enable Use managed identity for an Azure Fabric connector, you do not need to configure the Tenant ID, Client ID, and Client secret fields on the Fabric connector creation page. FortiOS hides these fields when you enable Use managed identity for an Azure Fabric connector.

This feature only applies for a FortiGate-VM deployed on Azure. For a FortiGate that is not deployed on Azure, you must still configure the Tenant ID, Client ID, and Client secret fields for an Azure Fabric connector. This feature also does not apply for a FortiGate-VM deployed on Azure Stack.

This configuration consists of the following steps:

1. Configure a user-managed identity in Azure.
2. Configure an Azure Fabric connector in FortiOS:
   1. GUI instructions
   2. CLI instructions

To configure a user-managed identity in Azure:

1. In Azure, go to All services > Managed Identities. Create a managed identity.

   

2. Go to the FortiGate-VM instance, then go to Identity. Set the managed identity created in step a as the user-assigned identity.
3. Search for subscriptions to assign the level of scope. Select the subscription, then go to Access control (IAM). Click Add role assignment. From the Role dropdown list, select Contributor.

To configure an Azure Fabric connector in the FortiOS GUI:

1. Configure the Fabric connector in FortiOS:
   1. On the FortiGate-VM deployed on Azure, go to Security Fabric > External Connectors.
   2. Click Create New.
   3. Under Public SDN, select Microsoft Azure.
   4. Enable Use managed identity.
   5. Configure other settings as desired.
   6. Click OK.
2. Create a dynamic firewall address associated to the Fabric connector:
   1. Go to Policy & Objects > Addresses.
   2. From the Type dropdown list, select Dynamic.
   3. From the Sub Type dropdown list, select Fabric Connector Address.
   4. From the SDN Connector dropdown list, select the Fabric connector that you created in step 1.
   5. Configure other settings as desired.
   6. Click OK.
3. To confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter, go to Policy & Objects > Addresses. Hover over the address that you created in step 2.

   

To configure an Azure Fabric connector in the FortiOS CLI:

1. Configure the Fabric connector in FortiOS:

   config system sdn-connector

   edit "azure"

   set status enable

   set type azure

   set azure-region global

   set use-metadata-iam enable

   next

   end

2. Create a dynamic firewall address associated to the Fabric connector:

   config firewall address

   edit "azure-iam-1"

   set type dynamic

   set sdn "azure"

   set color 2

   set filter "ResourceGroup=azuretest"

   next

   end

3. Confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter:

   config firewall address

   edit "azure-iam-1"

   set type dynamic

   set sdn "azure2"

   set color 2

   set filter "ResourceGroup=azuretest"

   config list

   edit "10.0.0.4"

   next

   edit "10.0.0.5"

   next

   edit "10.0.1.10"

   next

   edit "10.0.1.4"

   next

   edit "10.0.1.5"

   next

   edit "10.0.2.10"

   next

   edit "10.0.2.4"

   next

   edit "10.0.2.5"

   next

   edit "10.0.3.10"

   next

   edit "10.0.3.4"

   next

   edit "10.0.3.5"

   next

   edit "10.5.0.4"

   next

   edit "10.5.0.5"

   next

   edit "10.8.0.5"

   next

   edit "10.8.1.6"

   next

   end

   next

   end