Some time ago, I wrote an article about my first deployment in the public cloud, specifically in Azure. In general, many Azure networking rules and design patterns work very differently from what we know from traditional on-premises environments.
In on-prem networking, asymmetric routing is usually not desirable. In the public cloud, it depends. For outbound traffic, asymmetric routing can be acceptable, as I described in the previous article. For inbound traffic, however, the story is different.
For services exposed to the Internet, the traffic path looks like this: Internet → Azure Load Balancer → Palo Alto VM → application.
To make this work, destination nat is of course needed on the Palo Alto VM. But is that enough? With this traffic flow, when the packet reaches the application or server in Azure, the source IP is the original client IP address, which is a public IP. When the application sends a reply, it responds to that original source address. As a result, the return traffic does not go back to the Palo Alto VM. Instead, it is sent to the Azure subnet gateway, which creates asymmetric routing.
For outbound traffic, as described earlier, this asymmetry is acceptable. For inbound traffic, it is not. As a result, connectivity to externally published services does not work.
To eliminate asymmetric routing, the same NAT rule on the Palo Alto VM should include both destination NAT and dource NAT. That was something I had never done before.
The source NAT should point to the IP address of the internal (trust) interface. Then the application replies to the Palo Alto VM instead of the subnet gateway. This restores symmetric routing, and the service becomes reachable.
I can summarize the whole thing in one sentence: strange. In one traffic flow, asymmetry is normal. In another, it breaks connectivity. This is also a good example of why experience from on-prem environments can be misleading. When deploying networking components in Azure, you sometimes need to unlearn habits that normally make perfect sense in a traditional world..