need to ping internet from azure trusted zone

[J.Dorsch]

Admins trying to install an app that needs to ping Internet app. Is there a work around for this?

[reaper]

Treat your untrusted interface the same way you would a physical firewall and set up an outbound source NAT rule (even though your external IP is a private one on the interface)

[Adrian_Jensen]

I am just getting started with a PaloAlto on Azure, but I have found the only way to do this is to throw out the external load balancer (if you have one) and put the public IP directly on your PaloAlto Untrust (actually, the private NAT of the public IP as @reaper says). Azure blocks ICMP inbound/outbound by default. Also make sure your app vNet is routing internet traffic to the PaloAlto and not sending it out the Azure default route out Bastion.