Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
S2S VPN using Azure vWAN
Search
Phil Huang
October 24, 2022
Technology
0
96
S2S VPN using Azure vWAN
Use FortiGate 60E as on-premise VPN device
Phil Huang
October 24, 2022
Tweet
Share
More Decks by Phil Huang
See All by Phil Huang
20250924 零信任下的容器安全供應鏈:從隔離到信任
pichuang
0
14
20250705 Headlamp: 專注可擴展性的 Kubernetes 用戶界面
pichuang
0
360
20250307 雲端原生:引領數位轉型與永續的雙贏之道
pichuang
0
57
20250116 When Windows Meets Kubernetes…
pichuang
0
510
20241217-Azure Red Hat OpenShift 於 Azure TaiwanNorth 上之雲原生異地備援架構設計
pichuang
0
92
20241112 Real AVS Migration Experience Sharing
pichuang
0
74
Active/Passive HA FortiGate Pair with External and Internal Azure Load Balancer
pichuang
0
310
20240814-採用 Azure VMware Solution 啟動你的 Azure 雲端服務
pichuang
0
120
20240612 如果是勇者欣美爾的話, 他會怎麼做?
pichuang
0
52
Other Decks in Technology
See All in Technology
20201008_ファインディ_品質意識を育てる役目は人かAIか___2_.pdf
findy_eventslides
2
660
名刺メーカーDevグループ 紹介資料
sansan33
PRO
0
930
能登半島地震において デジタルができたこと・できなかったこと
ditccsugii
0
250
Simplifying Cloud Native app testing across environments with Dapr and Microcks
salaboy
0
180
2025-10-09_プロジェクトマネージャーAIチャンス
taukami
0
150
OCI Network Firewall 概要
oracle4engineer
PRO
2
7.9k
コンテキストエンジニアリング入門〜AI Coding Agent作りで学ぶ文脈設計〜
kworkdev
PRO
3
1.6k
Node.js 2025: What's new and what's next
ruyadorno
0
380
ソースを読むプロセスの例
sat
PRO
15
8.9k
AI Agent Dojo #2 watsonx Orchestrateフローの作成
oniak3ibm
PRO
0
120
Data Hubグループ 紹介資料
sansan33
PRO
0
2.2k
LLMアプリの地上戦開発計画と運用実践 / 2025.10.15 GPU UNITE 2025
smiyawaki0820
1
590
Featured
See All Featured
Building Better People: How to give real-time feedback that sticks.
wjessup
369
20k
Rebuilding a faster, lazier Slack
samanthasiow
84
9.2k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Optimizing for Happiness
mojombo
379
70k
The Cost Of JavaScript in 2023
addyosmani
55
9k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
48
9.7k
Docker and Python
trallard
46
3.6k
Designing for humans not robots
tammielis
254
26k
Leading Effective Engineering Teams in the AI Era
addyosmani
7
450
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
359
30k
How to Think Like a Performance Engineer
csswizardry
27
2k
Bootstrapping a Software Product
garrettdimon
PRO
307
110k
Transcript
S2S VPN using Azure vWAN Phil Huang <
[email protected]
> Sr. Cloud
Solution Architect 2022/10/24 Use FortiGate 60E as on-premise VPN device
What is the gap?
雲地混合網路決策樹 (1/2) 預設路由走不 走 Internet? 地端上雲/ 用雲/ 混合雲 線路備援 選擇?
主備線路 路由方式? Express Route S2S VPN Express Route S2S VPN
雲地混合網路決策樹 (2/2) 主備線路 路由方式 雲地 DNS 選擇? Finish Azure Private
DNS Resolver DNS Forwarder VM DNS Master / Slave Azure VPN Gateway Azure vWAN Azure Route Server
Topology Overview
Ref: FortiGate 60E ASN: 65533 BGP IP: 168.254.99.100 wan1 Public
IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 Azure vWAN Name: wan-eastus Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 vnet-spoke-eastus 10.11.0.0/16
Initial Step 0
0 Initial Setup FortiGate 60E ASN: 65533 BGP IP: 168.254.99.100
wan1 Public IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 vnet-spoke-eastus 10.11.0.0/16
Create Azure vWAN Step 1
1 Create Azure vWAN FortiGate 60E ASN: 65533 BGP IP:
168.254.99.100 wan1 Public IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 Azure vWAN Name: wan-eastus vnet-spoke-eastus 10.11.0.0/16
Create vWAN - Azure vWAN vHub: 實際上提供連線能力的服務
Create Azure vWAN vHub Step 2
2 Create Azure vHub FortiGate 60E ASN: 65533 BGP IP:
168.254.99.100 wan1 Public IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 Azure vWAN Name: wan-eastus Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 vnet-spoke-eastus 10.11.0.0/16
Complete Create vHub Azure vWAN Name: wan-eastus Name: vhub-eastus Private
address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 • vHub 內全部 IP 為自動配置,無須手動設定
Create vHub with S2S VPN
Get the VPN Gateway configuration (1/2) 自動配置 IP
Get the VPN Gateway configuration (2/2) Azure vWAN Name: wan-eastus
Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13
Create Azure vHub S2S VPN Site (1/2) • 需準備地端 VPN
資訊才能 填寫 • 支援常見 VPN 設備如以下 但不限於 • FortiGate 5.6+ • Cisco ASR 15.2+ • Cisco ASA 8.4+ • JunOS 12.x • ... Ref: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#devicetable 地端設備廠商,可任意取名
Create Azure vHub S2S VPN Site (2/2) 連線名稱,可任意取名 連線速路,單位為 Mbps
Ref: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal#site 實體線路提供商,可任意取名 地端 VPN 連線對外 IP 建立 S2S VPN 後,地端使用的 BGP IP 建立 S2S VPN 後,地端使用的 BGP ASN • 需準備地端 VPN 資訊才能填寫 • 一站可建立多個 Link
Edit VPN Connection (1/2)
Edit VPN Connection (2/2) 建立 S2S VPN 連線所需的 PSK 密鑰
如果是在 ExpressRoute 中,建立 S2S VPN 才使用 如果 VPN Device 有特殊加密選項則可以 勾選 Custom 進行細節設定 若採用 static route 則不需要使用此選項
Create VPN Tunnel Step 3
3 Create S2S VPN Connections Ref: FortiGate 60E ASN: 65533
BGP IP: 168.254.99.100 wan1 Public IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 Azure vWAN Name: wan-eastus Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 vnet-spoke-eastus 10.11.0.0/16
Create IPsec Tunnel (1/2) VPN GW Instance 0 Public IP:
y.y.y.y y.y.y.y Ref: https://docs.fortinet.com/document/fortigate/6.4.8/administration-guide/255100/ipsec-vpn-to-azure-with-virtual-network-gateway
Create IPsec Tunnel (2/2) Ref: https://docs.fortinet.com/document/fortigate/6.4.8/administration-guide/255100/ipsec-vpn-to-azure-with-virtual-network-gateway y.y.y.y
Create IPsec Tunnel (3/3) Ref: https://docs.fortinet.com/document/fortigate/6.4.8/administration-guide/255100/ipsec-vpn-to-azure-with-virtual-network-gateway
Check Connectivity Status from Azure View
Check Connectivity Status from VPN Device View y.y.y.y z.z.z.z
驗證 BGP IP 路由可達
確認路由表
Ref: FortiGate 60E ASN: 65533 BGP IP: 168.254.99.100 wan1 Public
IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.1/24 Azure vWAN Name: wan-eastus Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.68 vnet-spoke-eastus 10.11.0.0/16 4 vNet Peering
VNet Peering
Ref: FortiGate 60E ASN: 65533 BGP IP: 168.254.99.100 wan1 Public
IP: x.x.x.x internal1 192.168.100.254/24 Surface 192.168.100.6/24 Azure vWAN Name: wan-eastus Name: vhub-eastus Private address space: 10.10.0.0/24 ASN: 65515 VPN GW Instance 0 Public IP: y.y.y.y Private IP: 10.10.0.4 BGP IP: 10.10.0.12 VPN GW Instance 1 Public IP: z.z.z.z Private IP: 10.10.0.5 BGP IP: 10.10.0.13 BGP Peers 1 IP: 10.10.0.68 BGP Peers 2 IP: 10.10.0.69 vnet-spoke-eastus 10.11.0.0/16
Invent with purpose.