Forum Discussion

Richard_Marder's avatar
Richard_Marder
Copper Contributor
Jul 15, 2023

Azure Firewall DNAT not working

I have a typical Hub/Spoke Architecture with Azure Firewall in the Hub, VNEt peerings between Hub/Spoke, route table on Spoke with default route to Firewall in Hub, no NSGs currently applied.  I have...
Richard_Marder's avatar
Richard_Marder
Copper Contributor
Jul 15, 2023

Thanks Kidd_Ip thats the same article i followed 😞

    • Richard_Marder's avatar
      Richard_Marder
      Copper Contributor
      Sep 26, 2024

      stefanslauritsen Hi, Yes it was resolved in our case.  Our issue was with the routing tables applied to the spoke vNET.  We had the Default Route and a UDR which was set to the vNET in the Hub.  This vNET included the subnet on which the firewall was setup plus other subnets in use for Management Services (Remote Access, Backups,  Monitoring etc.)   This was causing circular routing and we had to remove this and configure the RT with UDRs for each subnet for the individual services and excluding the subnet on which the firewall was setup.  Hope it helps.  Good luck

      • stefanslauritsen's avatar
        stefanslauritsen
        Copper Contributor
        Sep 27, 2024

        Thank you Richard_Marder !
        Tested this morning with both SFTP-22 (original issue) & RDP-3389 (Test scenario), removing the route table pointing to Az Firewall Virtual Appliance for Firewall subnet fixed the issue instantly.
        Now I just need to figure out new routing design and which consequences it will have 🙂

        Fun fact - For original issue, we were seeing only some connections failing. Incoming traffic from Azure VM's (3rd-party tenants) was working, testing connection from home (Consumer ISP)/3rd-party datacenter failed.

Resources