https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254588#M2465 <P>I should also note, took me a long time to figure this out, if you are using an VM-Series Active/Passive HA pair on Azure, the PaloAlto management interface must have direct internet access, you can not send its traffic through the firewalls. This is because when a HA failover occurs, the newly active PaloAlto must contact the Azure API gateway (management.azure.com) to move the secondary IPs assigned to the failed PaloAlto's VM interface(s) to the newly-active PaloAlto's&nbsp; VM interfaces. Azure will not route traffic based on the IPs/ARP configured on the PaloAlto, only based on the IP configuration of Azure interfaces tied to the VM.</P> Fri, 22 May 2026 21:23:11 GMT Adrian_Jensen 2026-05-22T21:23:11Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254422#M2461 <P>Admins trying to install an app that needs to ping Internet app. Is there a work around for this?</P> Wed, 20 May 2026 22:51:39 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254422#M2461 J.Dorsch 2026-05-20T22:51:39Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254451#M2462 <P>Treat your untrusted interface the same way you would a physical firewall and set up an outbound source NAT rule (even though your external IP is a private one on the interface)</P> <P>&nbsp;</P> Thu, 21 May 2026 10:43:14 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254451#M2462 reaper 2026-05-21T10:43:14Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254471#M2463 <P>I am just getting started with a PaloAlto on Azure, but I have found the only way to do this is to throw out the external load balancer (if you have one) and put the public IP directly on your PaloAlto Untrust (actually, the private NAT of the public IP as&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/7608">@reaper</a>&nbsp;says). Azure blocks ICMP inbound/outbound by default. Also make sure your app vNet is routing internet traffic to the PaloAlto and not sending it out the Azure default route out Bastion.</P> Thu, 21 May 2026 20:52:55 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254471#M2463 Adrian_Jensen 2026-05-21T20:52:55Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254588#M2465 <P>I should also note, took me a long time to figure this out, if you are using an VM-Series Active/Passive HA pair on Azure, the PaloAlto management interface must have direct internet access, you can not send its traffic through the firewalls. This is because when a HA failover occurs, the newly active PaloAlto must contact the Azure API gateway (management.azure.com) to move the secondary IPs assigned to the failed PaloAlto's VM interface(s) to the newly-active PaloAlto's&nbsp; VM interfaces. Azure will not route traffic based on the IPs/ARP configured on the PaloAlto, only based on the IP configuration of Azure interfaces tied to the VM.</P> Fri, 22 May 2026 21:23:11 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254588#M2465 Adrian_Jensen 2026-05-22T21:23:11Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254605#M2466 <P>Turns out that due to the HA config I had the PAT address setup on the wrong IP.&nbsp; This seemed to solve the issue, Thanks!!</P> Sat, 23 May 2026 13:20:47 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/need-to-ping-internet-from-azure-trusted-zone/m-p/1254605#M2466 J.Dorsch 2026-05-23T13:20:47Z