Azure natting and routing of internet inbound via Palo?

[JimMcGrady]

My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website.  My question concerns routing.  Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo.  But where can i assign a UDR for inbound traffic from internet to 10.1.1.10?  Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?

[JoergSchuetter · Accepted solution]

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

[JimMcGrady]

A related question; If i have an Azure VM with IP 10.1.1.4, i can have it route via my PA firewall bidirectionally.  Outbound traffic from 10.1.1.4 would be source natted behind the firewall's public interface.  Inbound traffic would require a public IP on the firewall's public interface, or on an external load balancer in front of the firewall. A destination nat will deliver the inbound traffic to 10.1.1.4.

But what happens if 10.1.1.4 is assigned a public IP in Azure? The Palo has no knowledge of this public IP and only handles the ranges it has routing for. Say public ip 13.75.5.5 has been assigned to 10.1.1.4.  Traffic to 13.75.5.5 will be translated by Azure to 10.1.1.4 and delivered directly to that VM. The VMs replies will come from 10.1.1.4 and route via the Palo. The Palo will see this as an asynchronous session and drop the traffic. Is this understanding correct?

[jmeurer]

Your understanding is spot on.  That PIP should be moved to the FW or ExtLB and natted to ensure proper bi-directional flow.