I am trying the scenario described in East-West Traffic Flow (Non-IANA RFC 1918 & Non-IANA RFC 6598 Private Address Space), but I can't seem to get it to work. I see in my logs that the Network rule is allowing the traffic to the public IP address of my destination VM, but my destination VM is not responding. It's not an NSG issue from what I can tell.
Just to make sure I'm understanding correctly, we can associate a public IP address with the NIC of a VM and then we should be able to connect to that VM using the public IP as the destination from a VM on a different subnet (with the following assumptions: source VM subnet has route table with route to Azure Firewall, NSG allows access from source subnet, and network rule is configured on firewall to allow traffic from source to destination)?