Fortinet Document Library

Version:


Table of Contents

New Features

6.4.0
Download PDF
Copy Link

Simplify Azure Fabric connector configuration for a FortiGate-VM deployed on Azure

For a FortiGate-VM deployed on Azure, the new Use managed identity setting allows FortiOS to connect to Azure based on the FortiGate-VM's user-assigned managed identity. Using user-assigned managed identities enables a FortiGate-VM deployed on Azure to authenticate to cloud services without storing credentials in FortiOS.

When you enable Use managed identity for an Azure Fabric connector, you do not need to configure the Tenant ID, Client ID, and Client secret fields on the Fabric connector creation page. FortiOS hides these fields when you enable Use managed identity for an Azure Fabric connector.

This feature only applies for a FortiGate-VM deployed on Azure. For a FortiGate that is not deployed on Azure, you must still configure the Tenant ID, Client ID, and Client secret fields for an Azure Fabric connector. This feature also does not apply for a FortiGate-VM deployed on Azure Stack.

This configuration consists of the following steps:

  1. Configure a user-managed identity in Azure.
  2. Configure an Azure Fabric connector in FortiOS:
    1. GUI instructions
    2. CLI instructions
To configure a user-managed identity in Azure:
  1. In Azure, go to All services > Managed Identities. Create a managed identity.

  2. Go to the FortiGate-VM instance, then go to Identity. Set the managed identity created in step a as the user-assigned identity.
  3. Search for subscriptions to assign the level of scope. Select the subscription, then go to Access control (IAM). Click Add role assignment. From the Role dropdown list, select Contributor.
To configure an Azure Fabric connector in the FortiOS GUI:
  1. Configure the Fabric connector in FortiOS:
    1. On the FortiGate-VM deployed on Azure, go to Security Fabric > External Connectors.
    2. Click Create New.
    3. Under Public SDN, select Microsoft Azure.
    4. Enable Use managed identity.
    5. Configure other settings as desired.
    6. Click OK.
  2. Create a dynamic firewall address associated to the Fabric connector:
    1. Go to Policy & Objects > Addresses.
    2. From the Type dropdown list, select Dynamic.
    3. From the Sub Type dropdown list, select Fabric Connector Address.
    4. From the SDN Connector dropdown list, select the Fabric connector that you created in step 1.
    5. Configure other settings as desired.
    6. Click OK.
  3. To confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter, go to Policy & Objects > Addresses. Hover over the address that you created in step 2.

To configure an Azure Fabric connector in the FortiOS CLI:
  1. Configure the Fabric connector in FortiOS:

    config system sdn-connector

    edit "azure"

    set status enable

    set type azure

    set azure-region global

    set use-metadata-iam enable

    next

    end

  2. Create a dynamic firewall address associated to the Fabric connector:

    config firewall address

    edit "azure-iam-1"

    set type dynamic

    set sdn "azure"

    set color 2

    set filter "ResourceGroup=azuretest"

    next

    end

  3. Confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter:

    config firewall address

    edit "azure-iam-1"

    set type dynamic

    set sdn "azure2"

    set color 2

    set filter "ResourceGroup=azuretest"

    config list

    edit "10.0.0.4"

    next

    edit "10.0.0.5"

    next

    edit "10.0.1.10"

    next

    edit "10.0.1.4"

    next

    edit "10.0.1.5"

    next

    edit "10.0.2.10"

    next

    edit "10.0.2.4"

    next

    edit "10.0.2.5"

    next

    edit "10.0.3.10"

    next

    edit "10.0.3.4"

    next

    edit "10.0.3.5"

    next

    edit "10.5.0.4"

    next

    edit "10.5.0.5"

    next

    edit "10.8.0.5"

    next

    edit "10.8.1.6"

    next

    end

    next

    end

Simplify Azure Fabric connector configuration for a FortiGate-VM deployed on Azure

For a FortiGate-VM deployed on Azure, the new Use managed identity setting allows FortiOS to connect to Azure based on the FortiGate-VM's user-assigned managed identity. Using user-assigned managed identities enables a FortiGate-VM deployed on Azure to authenticate to cloud services without storing credentials in FortiOS.

When you enable Use managed identity for an Azure Fabric connector, you do not need to configure the Tenant ID, Client ID, and Client secret fields on the Fabric connector creation page. FortiOS hides these fields when you enable Use managed identity for an Azure Fabric connector.

This feature only applies for a FortiGate-VM deployed on Azure. For a FortiGate that is not deployed on Azure, you must still configure the Tenant ID, Client ID, and Client secret fields for an Azure Fabric connector. This feature also does not apply for a FortiGate-VM deployed on Azure Stack.

This configuration consists of the following steps:

  1. Configure a user-managed identity in Azure.
  2. Configure an Azure Fabric connector in FortiOS:
    1. GUI instructions
    2. CLI instructions
To configure a user-managed identity in Azure:
  1. In Azure, go to All services > Managed Identities. Create a managed identity.

  2. Go to the FortiGate-VM instance, then go to Identity. Set the managed identity created in step a as the user-assigned identity.
  3. Search for subscriptions to assign the level of scope. Select the subscription, then go to Access control (IAM). Click Add role assignment. From the Role dropdown list, select Contributor.
To configure an Azure Fabric connector in the FortiOS GUI:
  1. Configure the Fabric connector in FortiOS:
    1. On the FortiGate-VM deployed on Azure, go to Security Fabric > External Connectors.
    2. Click Create New.
    3. Under Public SDN, select Microsoft Azure.
    4. Enable Use managed identity.
    5. Configure other settings as desired.
    6. Click OK.
  2. Create a dynamic firewall address associated to the Fabric connector:
    1. Go to Policy & Objects > Addresses.
    2. From the Type dropdown list, select Dynamic.
    3. From the Sub Type dropdown list, select Fabric Connector Address.
    4. From the SDN Connector dropdown list, select the Fabric connector that you created in step 1.
    5. Configure other settings as desired.
    6. Click OK.
  3. To confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter, go to Policy & Objects > Addresses. Hover over the address that you created in step 2.

To configure an Azure Fabric connector in the FortiOS CLI:
  1. Configure the Fabric connector in FortiOS:

    config system sdn-connector

    edit "azure"

    set status enable

    set type azure

    set azure-region global

    set use-metadata-iam enable

    next

    end

  2. Create a dynamic firewall address associated to the Fabric connector:

    config firewall address

    edit "azure-iam-1"

    set type dynamic

    set sdn "azure"

    set color 2

    set filter "ResourceGroup=azuretest"

    next

    end

  3. Confirm that the Fabric connector resolves the dynamic firewall IP addresses with the supported filter:

    config firewall address

    edit "azure-iam-1"

    set type dynamic

    set sdn "azure2"

    set color 2

    set filter "ResourceGroup=azuretest"

    config list

    edit "10.0.0.4"

    next

    edit "10.0.0.5"

    next

    edit "10.0.1.10"

    next

    edit "10.0.1.4"

    next

    edit "10.0.1.5"

    next

    edit "10.0.2.10"

    next

    edit "10.0.2.4"

    next

    edit "10.0.2.5"

    next

    edit "10.0.3.10"

    next

    edit "10.0.3.4"

    next

    edit "10.0.3.5"

    next

    edit "10.5.0.4"

    next

    edit "10.5.0.5"

    next

    edit "10.8.0.5"

    next

    edit "10.8.1.6"

    next

    end

    next

    end