topic need to ping internet from azure trusted zone in VM-Series in the Public Cloud

need to ping internet from azure trusted zone

J.Dorsch — Wed, 20 May 2026 22:51:39 GMT

Admins trying to install an app that needs to ping Internet app. Is there a work around for this?

Re: need to ping internet from azure trusted zone

reaper — Thu, 21 May 2026 10:43:14 GMT

Treat your untrusted interface the same way you would a physical firewall and set up an outbound source NAT rule (even though your external IP is a private one on the interface)

Re: need to ping internet from azure trusted zone

Adrian_Jensen — Thu, 21 May 2026 20:52:55 GMT

I am just getting started with a PaloAlto on Azure, but I have found the only way to do this is to throw out the external load balancer (if you have one) and put the public IP directly on your PaloAlto Untrust (actually, the private NAT of the public IP as @reaper says). Azure blocks ICMP inbound/outbound by default. Also make sure your app vNet is routing internet traffic to the PaloAlto and not sending it out the Azure default route out Bastion.