Blog

Deploying a FortiGate NGFW VM from the Azure Marketplace with a two-arm WAN/LAN design. Covers Terraform for the subnets and NSGs, a UDR routing AKS egress through the firewall, a VIP for inbound HTTPS, asymmetric routing settings, and the SNAT policy on the LAN to WAN path.

Building a self-managed NGFW for PCI-DSS compliance as an alternative to Azure Premium Firewall at $1300 per month. Compares FW and NGFW capabilities across layer 7 application awareness, IDS/IPS, identity-based policy, malware scanning, and TLS inspection.

Practical VPN setups across cloud platforms: OpenVPN with AWS VPN Gateway, Azure VPN Gateway, and Debian 12, an OpenVPN client on a GitHub Actions macOS runner, WireGuard between cloud infrastructure and clients, and a FortiGate scenario.

Building IPsec S2S tunnels between an Azure workload (Linux VM or VNet) and an on-premise datacenter behind a Mikrotik router. Covers Strongswan on the Azure VM, IPTables for SNAT variants, Azure VPN Gateway with LAN and SNAT scenarios, plus the ports and protocol numbers (ESP 50, AH 51, UDP 500, UDP 4500) that must clear every hop.

Three encryption workflows: building a Java PKCS12 truststore with keytool for a Kubernetes app talking to remote IBM MQ (using distinct trustedCertEntry aliases that keytool needs but OpenSSL cannot set), encrypting an SD card, and encrypting individual files with GPG.