Azure natting and routing of internet inbound via Palo?

Reply
Highlighted
L2 Linker

Azure natting and routing of internet inbound via Palo?

My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website.  My question concerns routing.  Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo.  But where can i assign a UDR for inbound traffic from internet to 10.1.1.10?  Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?


Accepted Solutions
Highlighted
L3 Networker

Re: Azure natting and routing of internet inbound via Palo?

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

View solution in original post


All Replies
Highlighted
L3 Networker

Re: Azure natting and routing of internet inbound via Palo?

Hello

One option is to bind the public IPs (bound to the web-servers right now) to the outside (untrusted) interface of the firewall.

There might be other ways, but the one depicted above worked at least in my environment.

View solution in original post

Highlighted
L2 Linker

Re: Azure natting and routing of internet inbound via Palo?

A related question; If i have an Azure VM with IP 10.1.1.4, i can have it route via my PA firewall bidirectionally.  Outbound traffic from 10.1.1.4 would be source natted behind the firewall's public interface.  Inbound traffic would require a public IP on the firewall's public interface, or on an external load balancer in front of the firewall. A destination nat will deliver the inbound traffic to 10.1.1.4.

 

But what happens if 10.1.1.4 is assigned a public IP in Azure? The Palo has no knowledge of this public IP and only handles the ranges it has routing for. Say public ip 13.75.5.5 has been assigned to 10.1.1.4.  Traffic to 13.75.5.5 will be translated by Azure to 10.1.1.4 and delivered directly to that VM. The VMs replies will come from 10.1.1.4 and route via the Palo. The Palo will see this as an asynchronous session and drop the traffic. Is this understanding correct?

Highlighted
L4 Transporter

Re: Azure natting and routing of internet inbound via Palo?

Your understanding is spot on.  That PIP should be moved to the FW or ExtLB and natted to ensure proper bi-directional flow.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!