Blog

Deploying a FortiGate NGFW VM from the Azure Marketplace with a two-arm WAN/LAN design. Covers Terraform for the subnets and NSGs, a UDR routing AKS egress through the firewall, a VIP for inbound HTTPS, asymmetric routing settings, and the SNAT policy on the LAN to WAN path.

Building a self-managed NGFW for PCI-DSS compliance as an alternative to Azure Premium Firewall at $1300 per month. Compares FW and NGFW capabilities across layer 7 application awareness, IDS/IPS, identity-based policy, malware scanning, and TLS inspection.