Configure Egress NAT on Cloud NGFW for Azure

Table of Contents

Configure Forced Tunneling on Cloud NGFW for Azure

Protect Traffic with Cloud NGFW for Azure

Configure Egress NAT on Cloud NGFW for Azure

Configure egress source NAT on Cloud NGFW for Azure using built-in SNAT or Azure NAT Gateway for scalable outbound internet connectivity.

Where Can I Use This?	What Do I Need?
Cloud NGFW for Azure	Cloud NGFW subscription Palo Alto Networks Customer Support Portal account Azure Marketplace subscription

Cloud NGFW for Azure offers two ways to perform egress source NAT on outbound traffic to the public internet: Cloud NGFW built-in Source NAT and Azure NAT Gateway.

Cloud NGFW Built-In Source NAT

Cloud NGFW for Azure supports built-in Source NAT (SNAT) on outbound internet-bound sessions while retaining end-to-end IP visibility for internal enterprise networks. With built-in Source NAT, Cloud NGFW performs source IP translation on all outbound traffic passing through the firewall and routes the inspected packets directly to the internet. This architecture eliminates the need for an additional Azure NAT Gateway or a secondary egress hop, routing egress traffic through public IP resources attached directly to the Cloud NGFW resource. You don't incur Azure NAT Gateway costs with this option; however, you pay Palo Alto Networks for egress data transfer costs along with the peering costs.

By default, Cloud NGFW treats standard IANA RFC 1918 private address spaces as internal traffic. The Additional Prefixes to Private Traffic Range setting under Networking & NAT determines whether outbound sessions are subject to egress SNAT:

Internal/private traffic. Sessions matching the defined Private Traffic Ranges are inspected by Cloud NGFW and routed directly to the destination without applying Source NAT.
Internet traffic. Sessions with destination IP addresses outside the configured Private Traffic Range undergo Source NAT and egress directly to the public internet using the Cloud NGFW's attached public IPs.

Azure NAT Gateway

As organizations scale, substantial egress traffic can trigger Source NAT (SNAT) port exhaustion, causing dropped connections, diminished application responsiveness, and erratic network performance. Cloud NGFW for Azure integrates with Azure NAT Gateway to address these demands, providing two dynamic options for egress NAT: use the native egress NAT capabilities within Cloud NGFW for efficient inspection workflows, or use Azure NAT Gateway to achieve superior scalability and fully managed, high-capacity outbound connectivity.

Azure NAT Gateway is a fully managed service that provides secure, outbound-only internet connectivity for resources within an Azure virtual network. It automatically translates private IP addresses into static public IPs so internal virtual machines can reach external services without exposing themselves to incoming internet traffic. By dynamically managing SNAT at the subnet level, it eliminates port exhaustion issues and simplifies IP allow-listing for external partners.

Key features of Azure NAT Gateway include:

Massive scalability. Provides approximately 64,000 SNAT ports per public IP address. By supporting up to 16 public IPs, it can scale the available SNAT pool to more than 1 million ports.
Dynamic port allocation. SNAT ports are automatically and dynamically distributed across all virtual machines on the associated subnet, ensuring outbound traffic flows uninterrupted.
Operational simplicity. Azure manages the SNAT pool and elastic capacity natively, eliminating the need for manual NAT rule creation or port management.

Integrating Cloud NGFW with Azure NAT Gateway incurs additional Azure NAT Gateway charges in addition to your normal Cloud NGFW consumption. See Create a Standard V2NAT gateway.

This integration is supported only with the Azure VNet deployment model. Azure Virtual WAN does not directly support Azure NAT Gateway within a virtual hub configuration.

Configure Built-In Source NAT with Azure Managed Public IPs

Cloud NGFW for Azure provides built-in SNAT capability for outbound internet access. By default, Cloud NGFW performs SNAT using the public IP address assigned during resource creation.

Sign in to the Azure portal and select your Cloud NGFW resource.
Under Settings in the left pane, select Networking & NAT.
In the Source Network Address Translation (SNAT) section, select Edit.
In the Public IP Addresses or Source NAT Public IPs fields, select the desired Azure managed public IPs from the drop-down.
Save your configuration.

Configure Built-In Source NAT with Bring Your Own IPs (BYOIPs)

Configure built-in Source NAT on Cloud NGFW using Bring Your Own IP (BYOIP) address ranges provisioned in Azure. This option enables Cloud NGFW to perform source IP translation using your enterprise's custom public IP range rather than Azure-provided public addresses. Outbound internet sessions outside the Private Traffic Range are inspected, translated to your BYOIP address, and routed directly to the public internet, letting you maintain consistent reputation and allow-list compliance across hybrid environments.

Provision and verify your custom public IP prefix (BYOIP) in Azure using Custom IP Prefixes, ensuring the IP range is commissioned and active in your region.
Sign in to the Azure portal and select your Cloud NGFW resource.
Under Settings in the left pane, select Networking & NAT.
In the Source Network Address Translation (SNAT) section, select Edit.
Under Source NAT Public IPs, select your provisioned BYOIP public IP addresses.
Save your configuration to apply the changes.

Configure Azure NAT Gateway with Cloud NGFW

Configure an Azure NAT Gateway on the Cloud NGFW public subnet to handle outbound source address translation for internet-bound traffic. In this deployment model, Cloud NGFW inspects egress traffic and routes it to the Azure NAT Gateway, which translates the private IP addresses to its associated public IP before forwarding traffic to the internet. For information on configuring NAT with Azure, see the Azure NAT Gateway documentation.

Sign in to the Azure portal.
Search for Cloud NGFWs by Palo Alto Networks and create a Cloud NGFW in your hub virtual network.
In the search bar, type NAT gateway and select NAT gateways from the results.
Create a NAT gateway by selecting your subscription and resource group.
Select the region. This must match the region where your Cloud NGFW resource is deployed.
For the SKU, select Standard V2, then click Next.
Under Outbound IP, add a public IP address or a public IP prefix, then click Save and select Next to proceed to the Network section.
From the Virtual Network drop-down, choose your Cloud NGFW hub VNet.
In the subnet list, select the Cloud NGFW public subnet.
Review the configuration and click Create.