Site icon Digital Thought Disruption

Integrating Third-Party Firewalls (Palo Alto, Fortinet) into Azure Local SDN Topologies

Paul Bryant

TL;DR Summary

Azure Local SDN (formerly Azure Stack HCI SDN) provides powerful native microsegmentation and routing capabilities. But for organizations with existing investments in Palo Alto Networks or Fortinet firewalls—or specific compliance mandates—integrating these third-party Network Virtual Appliances (NVAs) remains a strategic choice.

In this article, we explore the how, why, and when of embedding third-party firewalls into Azure Local SDN topologies. From integration models and routing patterns to Bicep deployment examples and real-world scenarios, we break it all down.

What is Azure Local SDN?

Azure Local SDN is Microsoft’s on-prem Software Defined Networking solution tightly coupled with Azure Stack HCI, now rebranded under the Azure Local umbrella. It brings Azure-style networking capabilities—virtual networks, distributed firewalling, load balancing, and multi-tenant isolation—to edge and hybrid data centers.

Core Features:

Native firewalling is possible using Access Control Lists (ACLs) on SDN virtual subnets, but there are use cases where third-party NGFWs are necessary.

Why Use Third-Party Firewalls in Azure Local SDN?

While Azure Local provides built-in filtering and routing, NVAs like Palo Alto VM-Series and FortiGate-VM offer:

BenefitDetail
L7 InspectionApplication-aware rules, SSL decryption, malware filtering
Unified PolicyConsistent policy with existing cloud and on-prem appliances
ComplianceRequired for PCI-DSS, HIPAA, or DoD STIGs in certain industries
Logging & SIEM IntegrationAdvanced telemetry and SOC integration
Advanced VPN/SegmentationMulti-context routing, IPsec tunnels, ZTNA edge control

If your security team already uses centralized Panorama or FortiManager, extending these policies to your Azure Local environment is straightforward with NVAs.

Integration Models for NVAs in Azure Local

There are three common patterns to integrate Palo Alto or Fortinet firewalls into your SDN topology:

1. Bump-in-the-Wire (Inline Transparent)

2. Routed Hop (L3 Gateway)

3. Policy-Based Forwarding (Selective Routing)

Pro Tip: You can also combine models, such as using inline NVA for East-West and routed hop for North-South traffic.

Deployment Steps: Palo Alto / Fortinet in Azure Local SDN

Step 1: Download the NVA Image

Step 2: Create SDN-Connected VM Networks

PowerShell:

New-VMSwitch -Name "SDNSwitch" -NetAdapterName "vNIC" -EnableSoftwareRsc $false -AllowManagementOS $true

Add-VMSwitchExtensionPortFeature -FeatureName "Microsoft Azure VFP Switch Extension" -SwitchName "SDNSwitch"

Step 3: Provision the NVA VM on SDN

Example Bicep for FortiGate-VM:

resource fortiVM 'Microsoft.HCI/virtualMachines@2022-12-15-preview' = {
  name: 'FortinetNVA'
  location: resourceGroup().location
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_D4s_v3'
    }
    storageProfile: {
      osDisk: {
        createOption: 'FromImage'
        imageReference: {
          publisher: 'fortinet'
          offer: 'fortinet_fg-vm'
          sku: 'fortinet_fg-vm'
          version: 'latest'
        }
      }
    }
    networkProfile: {
      networkInterfaces: [
        {
          name: 'nic1'
          properties: {
            subnet: {
              id: '/subscriptions/.../virtualNetworks/sdn-vnet/subnets/internal'
            }
          }
        }
      ]
    }
  }
}

Step 4: Route Traffic via NVA

Best Practices for Azure Local + NVA Integration

Best PracticeDetails
RedundancyDeploy HA pairs with floating IPs or SDN load balancing
Central ManagementUse Panorama/FortiManager for consistent policy
SegmentationCombine Azure SDN ACLs with NVA policies for layered defense
LoggingExport logs to Azure Monitor or SIEM via Syslog/CEF
Performance MonitoringMonitor CPU, NIC throughput, and drop rates in WAC/PerfMon

Tip: Enable VFP logging on Azure Local SDN interfaces to debug traffic drops during NVA policy enforcement.

Comparison Table: Native Firewall vs. NVA Approach

FeatureAzure Local ACLPalo Alto / Fortinet NVA
L3/L4 FilteringYesYes
Application AwarenessNoYes
Threat ProtectionNoYes
PerformanceHigh (kernel-native)Depends on VM size
CostIncludedLicensing + compute
Central Policy MgmtManualPanorama / FortiManager
Compliance SupportLimitedStrong (PCI, HIPAA, DoD)

Real-World Use Cases

Fortinet with Azure Stack HCI for Defense and Contractor Sites

Source: Fortinet DoD Contractor Case Study

Palo Alto Networks for Healthcare SDN with Azure Stack Edge

Source: Palo Alto Healthcare Brief

Fortinet with Azure Hybrid and Kubernetes Edge Gateways

Source: Fortinet IoT Edge Security

Palo Alto VM-Series on Azure Stack HCI for Financial Sector

Source: Palo Alto Financial Brief

Final Thoughts

Integrating Palo Alto and Fortinet firewalls into Azure Local SDN gives architects the best of both worlds: Microsoft’s high-performance, cloud-style SDN plus the advanced security controls and compliance of best-in-class third-party appliances.

Whether you’re securing a perimeter, isolating tenants, or meeting audit mandates, NVAs can fill in critical gaps. That said, proper topology planning, redundancy, and routing control are essential for a clean integration.

*The thoughts and opinions in this article are mine and hold no reflect on my employer*

Exit mobile version