need to ping internet from azure trusted zone

[J.Dorsch]

Admins trying to install an app that needs to ping Internet app. Is there a work around for this?

[reaper · Accepted solution]

Treat your untrusted interface the same way you would a physical firewall and set up an outbound source NAT rule (even though your external IP is a private one on the interface)

[Adrian_Jensen]

I am just getting started with a PaloAlto on Azure, but I have found the only way to do this is to throw out the external load balancer (if you have one) and put the public IP directly on your PaloAlto Untrust (actually, the private NAT of the public IP as @reaper says). Azure blocks ICMP inbound/outbound by default. Also make sure your app vNet is routing internet traffic to the PaloAlto and not sending it out the Azure default route out Bastion.

[Adrian_Jensen]

I should also note, took me a long time to figure this out, if you are using an VM-Series Active/Passive HA pair on Azure, the PaloAlto management interface must have direct internet access, you can not send its traffic through the firewalls. This is because when a HA failover occurs, the newly active PaloAlto must contact the Azure API gateway (management.azure.com) to move the secondary IPs assigned to the failed PaloAlto's VM interface(s) to the newly-active PaloAlto's  VM interfaces. Azure will not route traffic based on the IPs/ARP configured on the PaloAlto, only based on the IP configuration of Azure interfaces tied to the VM.

[J.Dorsch]

Turns out that due to the HA config I had the PAT address setup on the wrong IP.  This seemed to solve the issue, Thanks!!