Fortinet FCP_ZCS_AD-7.4 Exam Dumps

They support the use of availability zones -- Standard public IP addresses are zone-redundant and support availability zone deployments for high availability.

They can be dynamic or static -- Azure standard public IPs can be configured as static or dynamic, offering flexibility based on deployment needs.

Using FortiGate at both ends of a site-to-site IPsec VPN tunnel provides the advantage of applying consistent security policies, configurations, and management tools across both the on-premises and Azure environments. This simplifies policy enforcement, improves operational efficiency, and ensures uniform threat protection.

Enabling the IP forwarding setting on FortiGate (or any NVA) in Azure allows the VM to route traffic that is not destined for itself, effectively enabling it to act as a router or firewall. This is essential for scenarios where FortiGate inspects or filters traffic between subnets or from on-premises to Azure.

The FortiGate VM and the Windows Server VM are in different subnets but within the same Production virtual network, which means they can communicate by default unless restricted. Azure allows ICMP between subnets, but Windows VMs have ICMP blocked by default in their firewall settings. Therefore, the likely reason for the ping failure is that the Windows Server's firewall is blocking ICMP (ping) traffic.

The debug output shows that the UbuntuServer address object successfully resolved an IP, while the webServer did not. The most likely cause is a mismatch in the dynamic address filter or missing tags on the target VM.

Verify the filter used for the dynamic firewall address -- The filter category=windows may not match any VM metadata, resulting in no matched addresses.

Verify the tags on the target VM -- Ensure that the VM has the correct tags (e.g., category=windows) that match the dynamic address filter to enable resolution.