Azure natting and routing of internet inbound via Palo?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Azure natting and routing of internet inbound via Palo?

L4 Transporter

My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website.  My question concerns routing.  Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo.  But where can i assign a UDR for inbound traffic from internet to 10.1.1.10?  Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?

1 accepted solution

Accepted Solutions

L4 Transporter

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

View solution in original post

3 REPLIES 3

L4 Transporter

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

A related question; If i have an Azure VM with IP 10.1.1.4, i can have it route via my PA firewall bidirectionally.  Outbound traffic from 10.1.1.4 would be source natted behind the firewall's public interface.  Inbound traffic would require a public IP on the firewall's public interface, or on an external load balancer in front of the firewall. A destination nat will deliver the inbound traffic to 10.1.1.4.

 

But what happens if 10.1.1.4 is assigned a public IP in Azure? The Palo has no knowledge of this public IP and only handles the ranges it has routing for. Say public ip 13.75.5.5 has been assigned to 10.1.1.4.  Traffic to 13.75.5.5 will be translated by Azure to 10.1.1.4 and delivered directly to that VM. The VMs replies will come from 10.1.1.4 and route via the Palo. The Palo will see this as an asynchronous session and drop the traffic. Is this understanding correct?

Your understanding is spot on.  That PIP should be moved to the FW or ExtLB and natted to ensure proper bi-directional flow.

  • 1 accepted solution
  • 9018 Views
  • 3 replies
  • 2 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!