topic Re: IPSEC to Azure establish but cannot use traceroute in General Topics

IPSEC to Azure establish but cannot use traceroute

Fariq_Zaidi — Fri, 10 Apr 2026 09:48:47 GMT

Hi All

We have PA 410 and has established an ipsec tunnel to Azure.
We testing from PA-410 to cloud that ping, SSH, and traceroute are working normally.
However, when testing from cloud to PA-410, ping and SSH work as expected, but traceroute does not function.

A packet capture was performed and it was observed that the traffic UDP was dropped by the firewall. However, a security policy allowing the traffic has already been configured.

We dont use Zone protection profile and i saw the Azure cloud limitation for traceroute.

any suggestion or advise?

thank you

Re: IPSEC to Azure establish but cannot use traceroute

Raido_Rattameister — Tue, 14 Apr 2026 01:34:57 GMT

Packet capture was taken on Palo and you see it being dropped?

Do you have IP configured on tunnel interface that is used for tunnel towards Azure?

Do you have interface mgmt profile attached to tunnel interface permitting ping?

Re: IPSEC to Azure establish but cannot use traceroute

Fariq_Zaidi — Tue, 14 Apr 2026 01:57:01 GMT

Packet capture was taken on Palo and you see it being dropped?

Yes, UDP packet

Do you have IP configured on tunnel interface that is used for tunnel towards Azure? NO

Do you have interface mgmt profile attached to tunnel interface permitting ping? NO

Re: IPSEC to Azure establish but cannot use traceroute

Raido_Rattameister — Tue, 14 Apr 2026 02:35:46 GMT

You need to have IP on Palo tunnel interface if you want to see every hop on the way in your traceroute.

Re: IPSEC to Azure establish but cannot use traceroute

Raido_Rattameister — Tue, 14 Apr 2026 03:00:43 GMT

Drops are expected.

If you add destination into packet capture filter and then run command "show counter global filter delta yes packet-filter yes" then you see packets dropped with reason "Packets dropped: IP TTL reaches zero"