Azure SDN connector using service principal

FortiOS automatically updates dynamic addresses for Azure using Azure SDN connector, including mapping attributes from Azure instances to dynamic address groups in FortiOS.

This topic describes one of multiple configuration methods available with this SDN connector type. See More Links on the right sidebar for other methods.

To configure the Azure SDN connector using service principal:

1. Create an Azure SDN connector:
   1. Go to Security Fabric > External Connectors and click Create New.
   2. Select Microsoft Azure.
   3. Configure the connector. See Azure SDN connector service principal configuration requirements:

      

   4. Click OK.
2. Create a dynamic firewall address for the Azure connector.
   1. Go to Policy & Objects > Addresses and select Address.
   2. Click Create new.
   3. From the Type dropdown list, select Dynamic.
   4. From the Sub Type dropdown list, select Fabric Connector Address.
   5. From the SDN Connector dropdown list, select the Azure SDN connector.
   6. In the Filter field, add filters as desired. The Azure SDN connector supports the following filters:
      • vm=<VM name>
      • securitygroup=<nsg id>
      • vnet=<VNet id>
      • subnet=<subnet id>
      • vmss=<VM scale set>
      • tag.<key>=<value>
      • servicetag=<value>
      • tag.<key>=<value>
   7. Click OK.
   8. Hover the cursor over the address name to see the dynamic IP addresses that the connector resolves.

Configuring SDN connector proxy via FortiManager

FortiOS Azure SDN connector API calls can be relayed through a FortiManager proxy. FortiManager 7.4 supports this feature. This is recommended for large-scale deployments.

To configure Azure SDN connector relay through FortiManager support:

1. Configure the FortiManager:
   1. Provision an FMG_VM64_AZURE 7.4 instance in Azure. See Creating a FortiManager-VM.
   2. License the FortiManager instance. See Connecting to FortiManager.
   3. In FortiManager, go to System Settings > Administrators.
   4. Create a new administrator or edit an existing one.
   5. For JSON API Access, select Read-Write.
   6. Configure other fields as desired, then click OK.
2. Provision a FGT_VM64_AZURE pay as you go instance in Azure.
3. Configure the FortiManager proxy in the CLI:

   config system sdn-proxy
   	edit "FMG_proxy"
   		set type fortimanager
   		set server "fmg.labs.ca"
   		set server-port 443
   		set username "admin"
   		set password "-=redacted=-"
   	next
   end
   

4. Configure two SDN connectors:

   config system sdn-connector
   	edit "FMG_proxy"
   		set type azure
   		set proxy "FMG_proxy"
   		set use-metadata-iam disable
   		set tenant-id "<tenant ID>"
   		set client-id "<client ID>"
   		set client-secret "-=redacted=-"
   		set subscription-id "<subscription ID>"
   		set resource-group "<resource group >"
   	next
   end
   config firewall address
   	edit "FMG_proxy"
   		set type dynamic
   		set sdn "FMG_proxy"
   		set filter "Vnet=VNET0"
   		set sdn-addr-type all
   	next
   end
   config system sdn-connector
   	edit "AZURE"
   		set type azure
   		set use-metadata-iam disable
   		set tenant-id "<tenant ID>"
   		set client-id "<client ID>"
   		set client-secret "-=redacted=-"
   		set subscription-id "<subscription ID>"
   		set resource-group "<resource group >"
   	next
   end
   config firewall address
   	edit "AZURE"
   		set type dynamic
   		set sdn "AZURE"
   		set filter "Vnet=VNET0"
   		set sdn-addr-type all
   	next
   end

5. Go to Security Fabric > External Connectors and confirm that the connectors were created.
6. Compare the resolved IP address list between the FMG_proxy and AZURE connectors and verify that the list is complete.