topic Re: Azure Network Watcher VM extension? in VM-Series in the Public Cloud

Azure Network Watcher VM extension?

eosminer — Tue, 28 Nov 2017 14:17:07 GMT

Hello... is it possible to install that Azure Network Watcher VM extension to enable traces and packet captures from the PA VM to the Azure gateway? It would be handy to help troubleshoot connectivity issues between the PA and the GW. Thank you.

Re: Azure Network Watcher VM extension?

kblackstone — Tue, 28 Nov 2017 14:39:46 GMT

Hi eosminer,

The VM Series supports packet captures natively within the operating system:

Here is a link to more detailed information about how to run packet captures from the console or ui:

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta-p/62390

-kb

Re: Azure Network Watcher VM extension?

eosminer — Tue, 28 Nov 2017 14:45:13 GMT

Azure Network Watcher looks beyond the PA, however requires the extension to be installed on the PA for it to work. It allows a capture past the PA through the Azure infrastructure. Not a great solution from Microsoft, but it's what I have.

Re: Azure Network Watcher VM extension?

RyanJohnstone1144 — Wed, 06 Oct 2021 15:53:28 GMT

Hello, did you get an answer to this? we want to do the same but our CSP is advising this is not possible.

let me know please if you managed it.

Thanks

Ryan

Re: Azure Network Watcher VM extension?

solarstone — Thu, 21 Oct 2021 14:29:20 GMT

I also need to do this. Network Watcher works fine between Azure VMs, but it's not possible to add the extension on a Palo Alto VM. I see my traffic arrive on the PA, but need to trace it onwards to the Azure VM, but can't. It seems that I have correct NSG setup, but cannot get to the VM. Packet capture in PA is clunky with wireshark, I just need a simple view of what's happening.