More specific cases are be explained here. This configuration is a basic configuration that will NAT all outbound connections behind 1 or more public IPs on the Azure Load Balancer. Outbound connectivity in Azure has several properties that are specific to the platform. It translates and routes the packet to the client - s: a.b.c.d - d: 172.16.137.4

The active FGT accepts the return packet after inspection.The Azure External Load Balancer sends the returns packet to the active FortiGate - s: a.b.c.d - d: 172.16.136.5.The server responds to the request - s: a.b.c.d d: w.x.y.z.The Azure External Load Balancer picks one of the available public IP address attached and translates the source IP - s: w.x.y.z - d: a.b.c.d.FGT inspects the packet and when allowed sends the packet translated to it's external port private IP to the Azure External Load Balancer.Azure Internal Load Balancer probes and send the packet to the active FGT.Azure routes the traffic using UDR to the internal Load Balancer. Connection from client to the public IP of server.This flow is based on the configuration as deployed in this template. In the diagram the different steps to establish a session are layed out. More information about HA Ports can be found here Flow These is no possibility to migrate between basic and standard public IP sku's. ALso the public IPs connected to the Fortigate need to be of the Standard type. It is only available in the Standard Load Balancer and as such all load balancers connected to the FortiGate need to be of the Standard type. This feature allows fast failover between the different members of the FortiGate HA custer for all TCP, UDP and ICMP protocols. In this design an Azure Standard Load Balancer Internal is used with a specific feature called HA Ports. More information about User Defined Routing can be found here Either the private IP of the FortiGate or the frontend IP of the internal Load Balancer is provided. In order for the FortiGate to become the destination there is a specific destination called Virtual Appliance. With UDRs the routing in Azure can be adapted to send traffic destined for a specific network IP range to a specific destination such as Internet, VPN Gateway, Virtual Network (VNET). To direct traffic to the FortiGate NGFW routing needs to be adapted on Microsoft Azure using User Defined Routing (UDR). Outbound connections are considered the connections coming from the internal subnets within the VNET or peered VNETs via the FortiGate towards the internet.

Fortinet vpn client in azure vm