Network trace or Packet capture without VM

If NSG Flow Logs are not capturing the packets, you can try capturing packets using Network Watcher's packet capture feature. This feature allows you to capture packets flowing through a specific network interface on a VM, which should allow you to capture packets flowing between the ER GW and App Service Private Endpoint.

Here are the steps to capture packets using Network Watcher:

Enable Network Watcher on your Azure subscription if it is not already enabled.

Create a packet capture session in Network Watcher for the network interface of the VM that is handling the traffic between the ER GW and App Service Private Endpoint.

Start the packet capture session and wait for the issue to occur.

Stop the packet capture session and download the captured packets.

Analyze the captured packets using a packet capture analysis tool, such as Wireshark, to determine the cause of the timeouts.

Note that capturing packets can generate a large amount of data, so it's important to be selective in what you capture and to filter the captured packets to only include the traffic you are interested in. Also, be aware that capturing packets may have an impact on network performance, so it's important to limit the duration and frequency of the capture sessions to minimize the impact on your environment.