topic Re: Help Needed: NAT & Security Policy Configuration for Azure LB → Palo Alto → DMZ Webserver (Public IP) in VM-Series in the Public Cloud

Help Needed: NAT & Security Policy Configuration for Azure LB → Palo Alto → DMZ Webserver (Public IP)

shaik.althaf — Tue, 26 Aug 2025 14:01:25 GMT

Hello Team,

Goal:
I want to access the DMZ Webserver (Public IP) via the Azure Load Balancer Public IP.

Current Setup:

Azure Public Load Balancer is created with Frontend IP, Backend Pool, and Health Probe.
Palo Alto Firewall VM is added to the backend pool.
DMZ VM (Webserver) is running with a Public IP.

Issue:

Load Balancer backend pool is correctly forwarding traffic to the Palo Alto firewall.
However, due to incorrect NAT policies (inbound/outbound) on the firewall, the traffic is not reaching the DMZ VM.
I’m unable to access the DMZ Webserver through the LB Public IP.

Request:
Could you please review my Doc attached and help me configure the NAT rules + Security Policies so that inbound/outbound traffic flows correctly?

Expected Traffic Flow:
➡️ Internet User → Load Balancer Public IP → Palo Alto Untrust NIC → DMZ Webserver Public IP
⬅️ DMZ → Palo Alto → Untrust → Load Balancer → Internet User

Thanks in advance for your guidance!

Re: Help Needed: NAT & Security Policy Configuration for Azure LB → Palo Alto → DMZ Webserver (Public IP)

P.Thakur638081 — Thu, 20 Nov 2025 07:23:13 GMT

Need to create NAT rules with source and destination NAT and add a security rule for the destination IP. It should work.

NAT destination should be your DMZ VM IP/FQDN.

Re: Help Needed: NAT & Security Policy Configuration for Azure LB → Palo Alto → DMZ Webserver (Public IP)

MP18 — Mon, 24 Nov 2025 22:19:00 GMT

@shaik.althaf How are you trying to access the Server public IP? from the Internet itself or from the LB?

Can you ping the Server Public IP from the Firewall, LB or from the Internet?

Let me know from LB if you can ping the Server public IP or not and then check the logs in the firewall?

If Routing is there then you need Security Rule in the firewall to pass the traffic from firewall to the server public ip.

You do not need NAT if traffic flow is from LB Public IP to the Server Public IP.

Regards

Re: Help Needed: NAT & Security Policy Configuration for Azure LB → Palo Alto → DMZ Webserver (Public IP)

shaik.althaf — Tue, 25 Nov 2025 10:31:02 GMT

@MP18

Update on the Issue

I’m now able to ping the Load Balancer Public IP, and I can also see the traffic hitting the Palo Alto firewall. This confirms that the flow is working as expected:

Internet User → LB Public IP → Palo Alto (Untrust) → DMZ Webserver

The traffic is reaching the DMZ VM, but the application still cannot be accessed from the internet.

Root Cause Identified

The Palo Alto VM and the DMZ VM are deployed in two different VNets, and due to this separation, the Virtual Router path + SNAT behavior is preventing the return traffic from properly routing back through the firewall.

Current Firewall Setup

Interfaces

ethernet1/1 – untrust (DHCP, default route created)
ethernet1/2 – trust (DHCP, no default route)

Zones

untrust
trust

Configuration Implemented

1. Address Object

dmz-server = Private IP of the DMZ VM (e.g., 10.20.1.10/32)

2. Static Route (critical for VNet-to-VNet routing)
Network > Virtual Router > default > Static Routes

Destination: DMZ/VNet prefix (e.g., 10.20.0.0/16)
Interface: ethernet1/2
Next Hop: None

This ensures the firewall knows how to reach the DMZ spoke.

3. NAT Rule (DNAT + SNAT on same rule)

Original Packet:
- Source Zone: untrust
- Destination Zone: untrust
- Destination Address: Firewall untrust private IP (e.g., 10.10.1.4)
- Service: HTTP
Destination Translation:
- Address: dmz-server
- Port: 80
Source Translation:
- Type: Dynamic IP & Port
- Interface: ethernet1/2

4. Security Policy
Allow traffic from untrust → trust for HTTP.

5. Commit Completed

Current Status

Inbound traffic reaches the DMZ server, but the web application is still not accessible externally. Based on the routing and SNAT behavior between separate VNets, this appears to be the blocker at the moment.

Any recommendations or best practices for scenarios where the firewall and DMZ spokes are deployed in different VNets would be appreciated.