topic Re: Azure internal load balancer and VM firewalls not working in VM-Series in the Public Cloud

Azure internal load balancer and VM firewalls not working

Joel_W — Wed, 09 Feb 2022 15:37:42 GMT

We are attempting to internal load balance a pair of VM firewalls in Azure.

The firewalls work when traffic is sent directly to the firewalls. But when the Azure internal load balancer is added into the mix no traffic hits the firewall.

I have searched all over the Palo web sites, the live community and Internet, but have not found instructions on how to configure this. I see references to NATs, sandwiches, lots of public load balance scenarios, but nothing I have been able to use.

We have a third part contractor configuring Azure, as this is new to us. They are also stumped. I have a support case open with Palo but have not been able to get an engineer assigned to it.

Thanks for any help.

Re: Azure internal load balancer and VM firewalls not working

steve.delve — Thu, 10 Feb 2022 10:30:25 GMT

I've deployed this, which deployment guide did you follow? It was a pain initially but then made sense.

Have you got each interface separated with Virtual routers and static routes for the load balancers in each route table routing traffic for the load balancers back to the subnet gateway?

If you look at the metrics of the load balancer then you will see if the availability of the Interfaces the load balancers are talking to is working.

Azure Transit VNet Design Model Deployment Guide (paloaltonetworks.com) is an extensive guide pick what you need, sounds like its the virtual routers and the Load balancer availability checking tripping you up.

Re: Azure internal load balancer and VM firewalls not working

Anthony81 — Wed, 12 Oct 2022 05:41:34 GMT

Hi Steve

I am also having same issue

You mentioned "have you separated each interface"

Which interfaces are you referring to ?

Re: Azure internal load balancer and VM firewalls not working

Stevenjw0728 — Fri, 03 Mar 2023 16:51:26 GMT

Palo Alto devices need to have 2 VRs one for trust mapped to the trust interface and one for untrust mapped to untrust interface. The reason for this is the health probes configuration.