Internet Traffic Flow for Web App Server in Microsoft Azure and placement of NVA & App Gateway

[Admin O365]

Hello All,

I`m trying to implement Traffic Manager, application gateway and Fortigate Firewall.

However, not sure what Is the right flow after Traffic Manager i.e.

Example: Accessing a Web Server via Internet

Internet ---->Traffic Manager ----> Azure App Gateway ----> Fortigate Firewall ----> Target Web VM

Or, replace Azure App Gateway with Fortigate Firewall i.e.

Internet ---->Traffic Manager ----> Fortigate Firewall ----> Azure App Gateway----> Target Web VM

Kindly help to understand the network flow.

[#2]

Will you be implementing this application in multiple regions? The traffic manager routes traffic at the DNS level and has 6 routing methods. The end client will connect directly into the Azure region after hitting the traffic manager and all further traffic will bypass the traffic manager for that session. Depending on your load balancing needs and if you have the application in one region I would recommend the Application Gateway and enabling the Web Application Firewall. This would limit the number of resources and complexity of your networking. This would combine the Traffic Manager, Fortigate Firewall, and the Azure App Gateway. 

The routing would look like this. 

Internet-->Application Gateway(Web Application Firewall)-->Target Web VM. 

This of course is dependent on what other VM's and services you are configuring to site behind the Fortigate. If its just this one VM in a singe region, I would strongly suggest going with the Application gateway instead. 

https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview

 @Admin O365