In anactive-passive HA deploymentof FortiGate VMs in Azure using the Marketplace template, configuration synchronization is handled viaunicast FortiGate Clustering Protocol (FGCP). FGCP allows the primary unit to replicate its configuration and session information to the secondary unit, ensuring seamless failover.

Two virtual NICs - The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.
One NSG for each interface - The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet's best practices.

In aFortiGate active-active HA deployment in Azure, synchronization between instances is achieved using:
FortiGate Clustering Protocol (FGCP)- This is the primary protocol used to synchronize configuration and session information between HA peers.

Heartbeat interfaces- These interfaces are specifically configured to exchange HA state and sync data between the FortiGate VMs, ensuring cluster consistency.

Azure Firewallis acloud-native, fully managednetwork security servicedesigned to control and log network traffic using Azure policies. In contrast, theFortiGate VMis anetwork virtual appliance (NVA)that delivers comprehensive security features, including firewalling, IPS, antivirus, VPN, and application control, suitable forboth on-premises and cloud deployments.

Thetrace output shows only one hopto reach10.0.2.4, indicating that the destination isin the same Azure virtual network (VNet)as the Windows VM. Since the VM's IP is10.0.1.4and the destination is10.0.2.4, they are indifferent subnets, but Azure allowsdirect routing between subnets within the same VNetwithout additional hops.