topic Active Directory Log on and Azure in VM-Series in the Public Cloud

Active Directory Log on and Azure

ghostme — Thu, 25 Jun 2020 05:27:20 GMT

Hello all,

I have set up a PAN cluster in an Azure environment and also extended the Active Directory domain controllers in Azure (configure site links and AD AD replication with Virtual Machines in Azure), I have Azure ExpressRoute in middle and all traffic from on-prem is routed via the PAN cluster.

Now the issue I'm experiencing is that, on-prem workstation (even via VPN/VDI connectivity) are trying to the connect the Active Directory domain controllers in Azure,however, if the traffic routing from on-prem to Azure via the PAN is disable this issue doesn't occur...please what could be the problem

Re: Active Directory Log on and Azure

mmclimans — Thu, 16 Jul 2020 21:44:55 GMT

Based on the information provided, it is most likely an asymmetric route.

By default, Azure propagates the VNET routes to the ExpressRoute gateway. These routes do not use the VM-Series as the next hop.

If intent is to send traffic from ExpressRoute to the VM-Series, then the GatewaySubnet must have a User Defined Route that points to the firewall. Likewise, the AD server subnet's in Azure must also have a UDR that points to VM-Series. You can disable route propagation between the GatewaySubnet and AD subnet by disabling BGP route propagation within their Azure route tables.