Certain TCP traffic not showing at the Azure Palo firewalls.

[Vanessaxu]

Certain TCP traffic not showing at the Azure Palo firewalls.

There are tcp traffic from on-prem to Azure test subnet vm.

The connection path is as below: on-prem user laptop -> onprem palo fw -> express route ->Azure Palo fw -> test vm.

There is no NSG on any of the interfaces at Azure side.

The RDP traffic from the on-prem user laptop can reach the test vm no problem (tcp 3389).

The smb (i.e. TCP 139) traffic from the on-prem user laptop can only shown at the on-prem fw log, showing it was allowed and went out the same path to the express route, but timeout status.

The smb traffic is not showing at the Azure palo fw. ( why the smb traffic disappeared after existing the on-prem fw?)

The only difference is the on-prem laptop (prd domain) and the azure vm (test domain) belong to different AD domain controllers, with the same domain name.

No drop packets on either palo fw.

[kiwi]

Hi @Vanessaxu ,

Is the traffic actually reaching the Azure fw or is it going lost in transit ? Can you check with a PCAP ?

Have you checked the global counters ? There might be drops there that don't show up in traffic log.

How to check global counters for a specific source and destination IP address 

Kind regards,

-Kim.

[Vanessaxu]

not sure if reach Azure palo firewall since it's the Azure file sync service.  Not to a VM. 

[Vanessaxu]

did a pcap, can't see the traffic incoming either.

[Vanessaxu]

forced traffic to the test vm via VPN, the traffic shows on the Azure Palo firewall log. Seems the the express route blocks certain traffic.