IPSEC to Azure establish but cannot use traceroute

[Fariq_Zaidi]

Hi All

We have PA 410 and has established an ipsec tunnel to Azure.
We testing from PA-410 to cloud that ping, SSH, and traceroute are working normally.
However, when testing from cloud to PA-410, ping and SSH work as expected, but traceroute does not function.

 A packet capture was performed and it was observed that the traffic UDP was dropped by the firewall. However, a security policy allowing the traffic has already been configured.

We dont use Zone protection profile and i saw the Azure cloud limitation for traceroute. 

any suggestion or advise?

thank you

[Raido_Rattameister]

Packet capture was taken on Palo and you see it being dropped?

Do you have IP configured on tunnel interface that is used for tunnel towards Azure?

Do you have interface mgmt profile attached to tunnel interface permitting ping?

[Fariq_Zaidi]

Packet capture was taken on Palo and you see it being dropped?

Yes, UDP packet 

Do you have IP configured on tunnel interface that is used for tunnel towards Azure? NO

Do you have interface mgmt profile attached to tunnel interface permitting ping? NO

[Raido_Rattameister]

You need to have IP on Palo tunnel interface if you want to see every hop on the way in your traceroute.

[Raido_Rattameister]

Drops are expected.

If you add destination into packet capture filter and then run command "show counter global filter delta yes packet-filter yes" then you see packets dropped with reason "Packets dropped: IP TTL reaches zero"