For the virtual machines (VMs) in the 10.0.1.0/26 subnet to send their internet-bound traffic through the FortiGate VM, their default routing behavior must be changed. In Microsoft Azure, this is achieved by creating a User-Defined Route (UDR) table. This table must contain a route for destination 0.0.0.0/0 with the next-hop type set to "Virtual appliance" and the next-hop address set to the FortiGate's internal private IP (10.0.1.4). This UDR table is then associated with the internal subnet, effectively changing the default gateway for all VMs within it to be the FortiGate. The "IP forwarding" setting shown is a necessary prerequisite on the FortiGate NIC, but the UDR is what enables the traffic flow.

A: The internal-facing NIC of a firewall does not require a public IP address. The external-facing NIC (not shown) would handle public-facing traffic and typically has a public IP. B: This statement describes the goal, but it is not true by default. Without the routing change described in option C, the VMs will use Azure's default internet gateway. D: The parameters shown are correct for a Network Virtual Appliance (NVA). "IP forwarding" must be enabled for the FortiGate to route traffic it receives that is not destined for itself.

1. Microsoft Azure Documentation, Virtual network traffic routing: "You can create custom routes,

or user-defined routes (UDRs) in Azure to override Azure's default routing... You can specify a

next hop of Virtual appliance to route traffic to a network virtual appliance (NVA)."

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

2. Microsoft Azure Documentation, Route network traffic with a route table using the Azure portal:

"For the virtual appliance to be able to forward traffic, the IP forwarding feature must be enabled

for the network interface attached to the VM." This confirms the setting in the exhibit is correct,

making option D incorrect.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal#cre

ate-a-route-table

3. Fortinet Document Library, FortiGate-VM on Azure deployment guide 7.4.0, Section:

"Configuring a user-defined route to route all traffic through the FortiGate": "To route traffic from

the protected subnet through the FortiGate-VM, you must create a routing table with a UDR... Set

Next hop type to Virtual appliance and Next hop address to the FortiGate-VM's private IP

address."

URL: https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/5

23940/configuring-a-user-defined-route-to-route-all-traffic-through-the-fortigate