VM-Series on Azure - Packets received 0

[jeromecarrier]

Hello

I would like to have your support. I deployed the following architecture in Azure. We have only 1 VM-Series at the moment. Based on the PA document for Azure, I created a Private subnet in vNet Hub zone (similar as the transit zone in the PA documentation). I created DSI and Project vNet with peering with Hub vNeet. We deployed an Azure internal LB for traffic between DSI&Project and Private vNet.  The  Frontend IP is 10.110.0.21 and the backend is the VM-series interface eth1/2 (10.110.0.4). I created route table for DSI and Project vNet with a default route to the IP address of LB (10.110.0.21).It's working without issue. From On-prem, I'm able to contact the servers in these zones. 

I added a new subnet (10.115.0.0/24) named "PrivateDMZ" in vNet Hub Zone and I created a new vNet "DMZ_PRIVATE" with peering with Hub Zone. I reproduced the same conf than before. I added entries in the Azure LB with Frondtend IP address 10.115.0.21 with backends the IP address of eth1/4 (10.115.0.4) I configured a route table for DMZ_PRIVATE vNet with a default route to 10.115.0.21. On VM-Series, I created virtual router dedicated for Private zone and another one for PrivateDMZ. I added the probe on each vr. All statics routes have been added (I checked many times). On the Azure Load Balancer, the health seems to be good without issue. But, from on-prem, when I try to contact server in DMZ, the connection is fail even if the traffic is allowed. In the log, the packet received is 0. 

Do you know what is the issue and why it's not working ?

BR

Prive LB conf

[seb_rupik]

Hi there,

Which virtual router is Eth1/4 a member of? From your description it sounds like you have three virtual routers, default(?), Private and PrivateDMZ. Have you configured routing between them? Have you configured security policies to allow the required traffic between the VRs?

cheers,

Seb.