topic Re: Outbound internet access not working on Azure VMSS scale set in Cloud Firewall

Outbound internet access not working on Azure VMSS scale set

J_Saun — Sat, 23 May 2020 11:56:11 GMT

We have an Azure VMSS scale set deployed with an internal and external load balancer. We are having issues getting internal hosts to access the internet. I created a HIDE NAT as follows:

Original src=10.40.1.5, Original dest=ANY, Original service=ANY

Translated src=VMSS firewall object (HIDE)

I also have a policy rule permitting both the original src and the scale set access to ANY dest on ANY port

When I try to go to the Internet form host 10.40.1.5 I see the traffic come into the vmss on eth1 and leave on eth0 (translated) but I get no return traffic from the Internet.

Is there something additional (besides the HIDE NAT) that we need to configure on the VMSS? Or is the issue outside the VMSS (in Azure).

Re: Outbound internet access not working on Azure VMSS scale set

HeikoAnkenbrand — Sun, 24 May 2020 07:15:24 GMT

1) Set a default route to the azure network controller (IP x.x.x.1) on the external interface.

2) Set the correct IP network security settings in azure.

Re: Outbound internet access not working on Azure VMSS scale set

Daniel_Goldenst — Sun, 19 Dec 2021 08:32:16 GMT

You can also refer to the Admin Guide for Azure VMSS where all possible traffic patterns described:

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_VMSS_for_Azure/Content/Topics-Azure-VMSS/Traffic-Flows.htm?TocPath=Traffic%20Flows%7C_____0#Traffic_Flows

Specifically Outbound traffic configurations

Re: Outbound internet access not working on Azure VMSS scale set

Prabulingam_N1 — Sun, 29 Nov 2020 13:31:17 GMT

Hi J_Saun,

In Translated Source - Create Dynamic Object with name as "LocalGatewayInternal" and give HIDE NAT. (Remove the Object of VMSS Hide NAT)

Translated src=LocalGatewayInternal (HIDE)

Make sure you have fetched the Topology in VMSS and Routes towards Internal servers.

Regards, Prabu