My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website. My question concerns routing. Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo. But where can i assign a UDR for inbound traffic from internet to 10.1.1.10? Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?
A related question; If i have an Azure VM with IP 10.1.1.4, i can have it route via my PA firewall bidirectionally. Outbound traffic from 10.1.1.4 would be source natted behind the firewall's public interface. Inbound traffic would require a public IP on the firewall's public interface, or on an external load balancer in front of the firewall. A destination nat will deliver the inbound traffic to 10.1.1.4.
But what happens if 10.1.1.4 is assigned a public IP in Azure? The Palo has no knowledge of this public IP and only handles the ranges it has routing for. Say public ip 188.8.131.52 has been assigned to 10.1.1.4. Traffic to 184.108.40.206 will be translated by Azure to 10.1.1.4 and delivered directly to that VM. The VMs replies will come from 10.1.1.4 and route via the Palo. The Palo will see this as an asynchronous session and drop the traffic. Is this understanding correct?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!