How does the Azure Virtual Network discovers that there is Palo Alto Gateway Interface

rswarnkar — Thu, 18 Dec 2025 05:49:25 GMT

Hello, I am trying to wrap my head around the PA deployment in azure using PA Series. I am basically following this video on setting up 2 zones, 2 Virtual routers, and route rules.

In my setup the two spoke vnets have UDR with 0.0.0.0/0 route to the trust interface of the PANFW. I created two VRs and associated with the Interfaces. I have also associated public IP on the untrust to give the Default Outbound Access. But still my spoek to spoke (east-west) traffic is not working.

So then I had look at my VNet peer setting, I tried to check boxes that say use Hub vnets Remote gateway but Azure FAILS saysing there is no gatway in my Hub.

Now I need to know how do I make azure discover that there is firewall NVA in the hub vnet to allow East-West traffic between spoke VMs. This is not clear to me. Thanks.

Here is a ref architecture I am planning to deploy:

topic How does the Azure Virtual Network discovers that there is Palo Alto Gateway Interface in VM-Series in the Public Cloud

How does the Azure Virtual Network discovers that there is Palo Alto Gateway Interface