This post is about the configuration of IPsec VPN between Azure and Fortinet Fortigate firewall, as part 2 of the post “How to Configure Azure Hub and Spoke Topology”
How to Configure Azure Hub and Spoke Topology Part 1
Overall Topology
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-overwall-topology-1024x617.png)
Environment
*On-prem Environment has a pair of Fortinet Fortigate firewalls with a public IP of 4.4.4.4
*Virtual Network Gateway (with local gateway and connection in between) are configured with IPsec VPN to provide on-prem network access
*Internet access in Azure is routed over IPsec VPN — Forced Tunnel
Azure Hub Configuration
Virtual Network Gateway Configuration
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-virtual-network-gateway-configuration.png)
Virtual Network Gateway Connection
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-virtual-network-gateway-connection-1024x338.png)
Local Network Gateway Configuration
![local-network-gateway-configuration-ip-subnet](https://ictfella.com/wp-content/uploads/2022/09/local-network-gateway-configuration-ip-subnet.png)
Local Network Gateway Connection
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-local-network-gateway-connection-1024x289.png)
Connection Azure Hub to On-Prem
Feel free to use your preferred IPsec encryption and Integrity settings
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-ipsec-vpn-phase1-phase2.png)
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-ipsec-vpn-ike-protocol.png)
Pre-shared key
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-connection-shared-key.png)
Public IP on Azure Hub
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-public-ip-address.png)
You can download the overall configuration from the “Connection-Azure-Hub-to-onprem”
![](https://ictfella.com/wp-content/uploads/2022/09/azure-hub-to-on-prem-connection-download-configuration-1024x346.png)
FortiGate Firewall Configurations
Phase 1 Configuration
Please make sure your “Key Lifetime” under the “Phase 1 Proposal” is the same as Azure.
![](https://ictfella.com/wp-content/uploads/2022/09/azure-fortigate-ipsec-vpn-phase1-configuration.png)
![](https://ictfella.com/wp-content/uploads/2022/09/azure-fortigate-ipsec-vpn-phase1-proposal.png)
Phase 2 Configuration
![](https://ictfella.com/wp-content/uploads/2022/09/azure-fortigate-ipsec-vpn-phase2-selectors.png)
Static Route for Azure Subnets
![](https://ictfella.com/wp-content/uploads/2022/09/azure-fortigate-ipsec-vpn-static-route.png)
Security Policies
![](https://ictfella.com/wp-content/uploads/2022/09/azure-fortigate-ipsec-vpn-firewall-policy.png)
Useful links
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell