topic Azure natting and routing of internet inbound via Palo? in VM-Series in the Public Cloud

Azure natting and routing of internet inbound via Palo?

JimMcGrady — Thu, 09 Jan 2020 05:17:09 GMT

My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website. My question concerns routing. Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo. But where can i assign a UDR for inbound traffic from internet to 10.1.1.10? Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?

Re: Azure natting and routing of internet inbound via Palo?

JoergSchuetter — Thu, 09 Jan 2020 08:24:45 GMT

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

Re: Azure natting and routing of internet inbound via Palo?

JimMcGrady — Fri, 03 Jul 2020 03:18:54 GMT

A related question; If i have an Azure VM with IP 10.1.1.4, i can have it route via my PA firewall bidirectionally. Outbound traffic from 10.1.1.4 would be source natted behind the firewall's public interface. Inbound traffic would require a public IP on the firewall's public interface, or on an external load balancer in front of the firewall. A destination nat will deliver the inbound traffic to 10.1.1.4.

But what happens if 10.1.1.4 is assigned a public IP in Azure? The Palo has no knowledge of this public IP and only handles the ranges it has routing for. Say public ip 13.75.5.5 has been assigned to 10.1.1.4. Traffic to 13.75.5.5 will be translated by Azure to 10.1.1.4 and delivered directly to that VM. The VMs replies will come from 10.1.1.4 and route via the Palo. The Palo will see this as an asynchronous session and drop the traffic. Is this understanding correct?

Re: Azure natting and routing of internet inbound via Palo?

jmeurer — Fri, 03 Jul 2020 03:41:16 GMT

Your understanding is spot on. That PIP should be moved to the FW or ExtLB and natted to ensure proper bi-directional flow.