FCP_ZCS_AD-7.4 Exam Dumps - FCP - Azure Cloud Security 7.4 Administrator

The route server subnet in Azure is a dedicated subnet that hosts the Azure Route Server, which functions as the hub for dynamic routing information exchange between Azure virtual networks and BGP-enabled network virtual appliances (NVAs) or on-premises routers. It enables seamless and centralized route propagation.

Two virtual NICs – The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.

One NSG for each interface – The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet’s best practices.

In an active-active FortiGate ELB/ILB deployment, the inbound NAT rules configured on the external load balancer are used to allow administrative access (e.g., HTTPS, SSH) to the individual FortiGate VMs. Since the public IP is associated with the load balancer, NAT rules are required to map specific ports to backend FortiGate instances for management access.

The first and most direct diagnostic step is to verify the BGP peering status on both the FortiGate VM and Azure Route Server. If BGP peering is not established or is in an idle or down state, route propagation will fail. This check confirms whether the two systems are communicating and exchanging routes as expected.

In an active-active FortiGate cluster deployment in Azure, you must assign the public IP address to an Azure load balancer. This is required because Azure does not support multiple VMs sharing a single public IP directly. The Azure Load Balancer handles inbound traffic and distributes it to the active FortiGate instances.