https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/azure-vnet-peering/m-p/402555#M1181 <P>We are going with hub and spoke model, PA being the hub. When we peer a spoke VNET with the hub does the subnets in peered spoke also go through intrazone rules.</P><P>&nbsp;</P><P>Spoke-vnet - (subnet1, subnet2).&nbsp;</P><P>Would subnet1 &lt;&gt; subnet2 communication pass through intrazone rules or does the whole spoke-net is seen as one large routed subnet.</P> Tue, 27 Apr 2021 23:38:16 GMT raji_toor 2021-04-27T23:38:16Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/azure-vnet-peering/m-p/402555#M1181 <P>We are going with hub and spoke model, PA being the hub. When we peer a spoke VNET with the hub does the subnets in peered spoke also go through intrazone rules.</P><P>&nbsp;</P><P>Spoke-vnet - (subnet1, subnet2).&nbsp;</P><P>Would subnet1 &lt;&gt; subnet2 communication pass through intrazone rules or does the whole spoke-net is seen as one large routed subnet.</P> Tue, 27 Apr 2021 23:38:16 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/azure-vnet-peering/m-p/402555#M1181 raji_toor 2021-04-27T23:38:16Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/azure-vnet-peering/m-p/404542#M1183 <P>By default azure subnets in spoke vnets are able to communicate directly with no need to reach hub. But you can add outbound deny policy at NSGs to block 'virtual network' traffic. Basically you will need to add 2 statement at outbound nsg for the subnet, first one deny any-any, then allow virtual network to next hub.&nbsp;&nbsp;</P> Mon, 03 May 2021 16:13:27 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/azure-vnet-peering/m-p/404542#M1183 Hasan1 2021-05-03T16:13:27Z