An Azure administration team is looking for a FortiGate high availability (HA) solution that is able to: - Filter east-west traffic - Filter north-south traffic - Scale up - Scale out Which HA…

Question

Options

• AActive-passive with external and internal load balancers
• BActive-passive with SDN connector
• CActive-active with external and internal load balancers
• DActive-active with Azure Gateway load balancer

• A
  8% (3)
• B
  3% (1)
• C
  86% (31)
• D
  3% (1)

Explanation

Active-active with external and internal load balancers (Option C) satisfies all four requirements: the active-active design means both FortiGate instances process traffic simultaneously, enabling both scale-up (larger VM SKUs) and scale-out (adding more instances behind the load balancers); the external load balancer handles north-south traffic (internet ingress/egress), while the internal load balancer steers east-west traffic (lateral workload-to-workload flows) through the firewalls.

Option A is wrong because active-passive keeps one unit idle - the passive node cannot process traffic, so you get failover but not scale-out. Option B (active-passive with SDN connector) relies on API-based IP failover; it likewise cannot scale out and is not suited for high-throughput east-west inspection. Option D is wrong because the Azure Gateway Load Balancer is purpose-built for inserting appliances into north-south (internet-edge) paths - it does not provide a native mechanism to intercept east-west traffic between internal subnets.

Memory tip: "AA + two LBs = all four letters covered" - Active-Active gives you Scale up + Scale out; External LB = North-south; Internal LB = East-west. If the design is missing either LB or uses active-passive, at least one requirement drops off.

No community discussion yet for this question.