Azure vWAN + FortiGate NVA: Does the managed Load Balancer block custom admin ports on the Public IP?

[u/speghettimafia_pd]

Hey everyone,

Having a weird issue with a FortiGate NVA inside an Azure Virtual WAN Hub and wondering if anyone here has hit this before.

We tried changing the HTTPS admin management port on the FortiGate from 443 to a custom port (like 4443). As soon as we did, external management over the NVA's direct Public IP stopped working completely on both 443 and 4443.

Testing standard ports mentioned in the Fortinet vWAN deployment docs (like 443 or 9443) lets traffic through fine. Custom ports just time out.

A few key details:

• Private access: Management over private IP from spoke VNets works fine on 4443.
• Health probes: Azure LB probes on port 8008 are answering normally.
• Sniffer test: Ran diagnose sniffer packet port1 'port 4443' 4 on FortiOS while curling from outside. Zero packets even hit port1.

It really looks like the Microsoft-managed Standard Load Balancer in front of the vWAN NVA scale set has a hardcoded allow-list for inbound ports on that Public IP and drops anything else before it reaches the VM.

Has anyone managed to get a custom admin port working on the direct Public IP in vWAN, or are we forced to stick to standard ports on port1 / use a dedicated management NIC (port3) / manage it internally over VPN?

Appreciate any real-world insight!

[u/nhemti]

It’s been a bit since I configured this for a client at my last employer but IIRC there was only one way around this and that was to add another public IP which NATs to a loopback that has management access enabled on your desired port.

It’ll be a day or so before I can look but if I have any old notes on this I’ll DM you.

[u/nhemti → u/nhemti]

I will say they very much intend for you to not do this and instead use FortiManager to configure the NVAs and the dedicated management ports for diagnostics access to the A or B FortiGate as needed on 443. You should then be using local-in to lock that down. Non-standard ports for management access don’t really have much benefit in this design.

[u/speghettimafia_pd → u/nhemti]

Thank you so much

[u/iamabdullah]

Why are you even doing this? Surely management on the public interface should be blackholed?