I assume the firewall has corresponding routes for both subnets pointing to the first IP of the internal subnet the firewall is attached two. Also, check to ensure the interface has IP Forwarding enabled on the azure side. If you do need to change this setting. Reboot the firewall. I have seen it not apply until after reboot. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding From there, double check your NSGs. Since this intrazone traffic, it should be allowed, but you may not be logging it due to the inherent rule. Override logging on intrazone, it may give you some further information in the Monitor.
... View more
