In this guest blog post, Srija Reddy Allam, Cloud DevOps Architect at Fortinet, discusses the evolving requirements organizations face when extending their environments to the cloud and how FortiGate Next-Generation Firewall VM in Microsoft Marketplace delivers comprehensive security and flexible, high-performance networking.
As organizations continue to build and modernize applications on Microsoft Azure, network architectures are becoming increasingly dynamic, distributed, and application-aware. Azure provides a powerful platform with capabilities such as global connectivity, highly scalable workloads, a resilient backbone, and integrated AI services.
Enterprises extending their environments into the cloud also want to align their cloud networking models with established on-premises architectures. This includes the need to support connectivity at scale, handle dynamic traffic patterns, and maintain consistent security across all communication paths. Ensuring these requirements are met in a unified and operationally efficient manner becomes a key priority for organizations adopting Azure at scale. Additionally, organizations must support both IPv4 and IPv6 traffic as part of modern cloud networking, ensuring seamless communication and consistent visibility across dual-stack environments.
To address these evolving requirements, organizations increasingly adopt architectures that extend the native capabilities of Azure with advanced networking and security platforms.
Extending Azure networking with FortiGate
By integrating Fortinet FortiGate Next Generation Firewall (NGFW) VM, enterprises can bring consistent connectivity, intelligent traffic management, and unified security into their cloud environments aligned with the needs of modern, distributed applications.
This approach enables organizations to:
- Extend enterprise networking into Azure
- Adapt to dynamic traffic patterns
- Maintain resilience and operational consistency
- Enforce security across all communication paths
Connectivity: SD-WAN and BGP
Extending enterprise connectivity into Azure requires both intelligent path selection and dynamic route exchange to support hybrid, multi-region, and cloud-native workloads.
By integrating FortiGate VM, organizations can bring SD-WAN capabilities directly to Azure environments while leveraging BGP to enable real-time routing decisions across interconnected networks.
SD-WAN enables application-aware traffic steering, allowing organizations to dynamically select optimal paths based on performance metrics such as latency, jitter, and packet loss. This becomes especially valuable when extending connectivity from branch locations or edge environments into Azure, where multiple paths such as VPN, ExpressRoute, and internet-based connections may be available.
Simultaneously, BGP provides the foundation for dynamic route exchange, ensuring network paths adapt automatically to changes in topology or availability. This allows Azure-based workloads to communicate seamlessly with on-premises environments, other cloud regions, and distributed application components without requiring manual route updates.
Within Azure architectures, these capabilities support:
- Seamless hybrid connectivity between on-premises and cloud environments
- Multi-region traffic steering, enabling workloads to utilize the most optimal path
- Integration with Azure services such as Virtual WAN, VPN Gateway, and ExpressRoute
- Adaptive failover, where traffic is automatically rerouted based on network conditions and service level agreements
In addition, SD-WAN and BGP together enable policy-driven traffic segmentation, allowing organizations to route different types of traffic such as user access, application traffic, and backend service communication through appropriate inspection and control points.
This integrated approach ensures connectivity is not only scalable, but also intelligent, adaptive, and aligned with application requirements, forming a strong foundation for modern Azure network architectures.
Resilience: High availability with Active/Active and Active/Passive
Ensuring continuous availability is a core requirement for enterprise workloads deployed on Azure, where applications must remain accessible despite infrastructure failures, traffic surges, or changing network conditions.
By integrating FortiGate VM into Azure architectures, organizations can implement high availability models that align with both performance requirements and application requirements.
Two primary approaches are commonly adopted, Active/Active and Active/Passive.
Active/Active deployments enable multiple FortiGate instances to process traffic simultaneously, typically positioned behind Azure Load Balancer. This model supports horizontal scaling, allowing traffic to be distributed across multiple nodes for increased throughput and performance.
Key characteristics include:
- Load distributed traffic processing across firewall instances
- High throughput handling for API-driven and high-volume applications
In scale-out Azure environments, FortiGate Session Life Support Protocol (FGSP) can be enabled to enhance Active/Active deployments. FGSP allows session synchronization across multiple FortiGate instances, ensuring traffic distributed by Azure Load Balancer can still maintain session awareness across nodes.
Active/Passive deployments focus on deterministic failover, where a primary FortiGate instance handles traffic while a secondary instance remains synchronized and ready to take over when needed.
This model ensures:
- Consistent session handling, critical for stateful applications
- Stable network identity, avoiding changes in traffic behavior during failover
- Predictable recovery mechanisms, simplifying operational management
Enterprises can deploy FortiGate clusters in either Active/Active or Active/Passive mode. Both deployment models provide high availability while ensuring consistent security enforcement aligned to application behavior
Protocol Evolution: Supporting IPv4 and IPv6
As organizations expand workloads on Azure, network architectures must support both IPv4 and IPv6 to ensure compatibility with existing enterprise systems while enabling future ready, cloud-native connectivity. While IPv4 continues to underpin a significant portion of application communication, IPv6 adoption is accelerating because of address space requirements, global reach, and modern client support. In dual-stack Azure environments, applications, users, and services may operate across both protocols simultaneously, requiring consistent routing, policy enforcement, and visibility regardless of how traffic is initiated.
By integrating FortiGate VM, organizations can enforce unified security policies across IPv4 and IPv6 traffic flows while maintaining operational consistency. FortiGate supports traditional IPv4 NAT for address translation and connectivity control, as well as NPTv6 (Network Prefix Translation for IPv6), enabling prefix-based translation without breaking end-to-end communication models inherent to IPv6. This allows organizations to manage overlapping address spaces, enable controlled communication between IPv4 and IPv6 environments, and simplify phased migration strategies without requiring application redesign. As a result, enterprises can ensure that connectivity, segmentation, and security enforcement remain consistent across both protocol stacks, enabling scalable, interoperable, and future ready network architectures within Azure.
As organizations continue to scale and modernize on Azure, network architectures must evolve to support dynamic connectivity, resilient operations, and consistent security across all communication paths. By integrating FortiGate VM, enterprises can extend the native capabilities of Azure with intelligent connectivity through SD-WAN and BGP, robust high availability models, and seamless dual-stack support for IPv4 and IPv6.
These architectural patterns enable organizations to align cloud environments with enterprise networking requirements while adapting to modern application demands, including distributed and AI-driven workloads. The result is a unified approach that delivers scalability, operational efficiency, and consistent security enforcement allowing organizations to fully leverage Azure as a foundation for current and future innovation.
Learn more about FortiGate Next-Generation Firewall VM in Microsoft Marketplace and take a free trial to test drive it for yourself.
