>
    Strata Copilot
    Configure Forced Tunneling on Cloud NGFW for Azure
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for Azure Administration
    3. Configure Cloud NGFW for Azure Resources
    4. Configure Forced Tunneling on Cloud NGFW for Azure
    Download PDF
    Cloud NGFW for Azure

    Configure Forced Tunneling on Cloud NGFW for Azure

    Table of Contents

    Configure Forced Tunneling on Cloud NGFW for Azure

    Redirect internet-bound traffic from Cloud NGFW for Azure to an on-premises firewall or NVA for additional inspection instead of routing directly to the internet.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for Azure
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Portal account
    • Azure Marketplace subscription
    • Site-to-Site VPN, ExpressRoute, or NVA configured in Azure
    Cloud NGFW for Azure automatically performs source NAT (SNAT) by default for all outbound internet-bound traffic using its associated public IPs, while treating standard IANA RFC 1918 private address spaces as internal traffic. You can configure forced tunneling to redirect all internet-bound traffic to a designated next hop instead of sending it directly to the internet.
    Forced tunneling lets you inspect and redirect internet-bound traffic to an on-premises firewall, a nearby Network Virtual Appliance (NVA), or an edge security solution for an additional layer of inspection before breaking out to the public internet. This configuration enforces supplementary security policies at your on-premises firewall, ensures compliance, and allows egress traffic to use on-premises public IP addresses for SNAT—preventing direct exposure of Cloud NGFW public IP addresses to the internet.

    Default Internet Egress Path

    By default, Cloud NGFW performs SNAT on outbound traffic destined for public IP addresses outside the configured Private Traffic Range (IANA RFC 1918).
    Default egress traffic flow: Spoke VNet Workload → Cloud NGFW Private IP → Cloud NGFW SNAT (Public IP) → Internet
    1. Traffic initiation. A host machine in a spoke Virtual Network (VNet) initiates outbound internet traffic.
    2. Firewall ingress. A User-Defined Route (UDR) on the workload subnet directs 0.0.0.0/0 traffic to the Cloud NGFW private IP address as the next hop.
    3. Inspection and egress. Cloud NGFW inspects the session, translates the source IP using its attached public IP address (SNAT), and forwards the traffic through the public subnet directly to the internet.
    4. Return path. Response traffic returns to the Cloud NGFW public IP address, undergoes reverse translation, and routes back to the originating spoke host.

    Forced Tunneling Deployment Options

    Depending on your network topology and IP address visibility requirements, configure forced tunneling using one of the following deployment models:

    Forced Tunneling Through the Public Subnet (Cloud NGFW SNAT)

    Use this architecture when you want Cloud NGFW to inspect traffic and perform SNAT using its public IP pool before redirecting the traffic over a Site-to-Site VPN or ExpressRoute to an on-premises firewall or upstream security appliance.
    Traffic flow: Spoke Workload → Cloud NGFW (SNAT) → Cloud NGFW Public Subnet Route Table → Azure VNet Gateway → Site-to-Site VPN/ExpressRoute → On-Premises Firewall → Internet
    Configure the public subnet deployment:
    1. Configure the spoke VNet route table.
      In the Azure portal, select the Route Table attached to your spoke application subnets. Add a custom route for destination 0.0.0.0/0 with the next hop type set to Virtual Appliance, pointing to the Cloud NGFW private IP address.
    2. Create and associate a public subnet route table.
      Create a new Route Table and associate it with the public subnet delegated to Cloud NGFW. Add a route for destination 0.0.0.0/0 with the next hop type set to Virtual Network Gateway.
    Traffic flow detail:
    1. A host machine in the spoke VNet initiates outbound internet traffic.
    2. The spoke VNet route table routes traffic to the Cloud NGFW private IP address for inspection.
    3. After inspection, Cloud NGFW applies SNAT using an IP address assigned to its public subnet.
    4. The route table on the Cloud NGFW public subnet overrides standard direct breakout and forces 0.0.0.0/0 traffic to the Azure VNet Gateway.
    5. The VNet Gateway forwards the traffic across the Site-to-Site VPN/ExpressRoute connection to the on-premises firewall.
    6. The on-premises firewall evaluates enterprise security policies and forwards the session to the internet. Return traffic follows the reverse path.

    Forced Tunneling Through the Private Subnet (No Cloud NGFW SNAT)

    Use this architecture when upstream firewalls or on-premises security appliances require visibility into the original private source IP address of the originating workload. Cloud NGFW inspects the traffic but bypasses SNAT before forwarding.
    Traffic flow: Spoke Workload → Cloud NGFW (No SNAT) → Cloud NGFW Private Subnet Route Table → Azure VNet Gateway → Site-to-Site VPN/ExpressRoute → On-Premises Firewall → Internet
    To prevent Cloud NGFW from performing SNAT and forcing egress through the public subnet, you must explicitly add 0.0.0.0/1 and 128.0.0.0/1 to the Additional Prefixes setting in the Networking & NAT configuration. This instructs Cloud NGFW to treat all IPv4 address space as private traffic.
    Configure the private subnet deployment:
    1. Configure the spoke VNet route table.
      In the Route Table attached to your spoke workload subnets, add a route for destination 0.0.0.0/0 with the next hop type Virtual Appliance set to the Cloud NGFW private IP address.
    2. Configure the private subnet route table.
      Create and associate a Route Table for the private subnet delegated to Cloud NGFW. Add a route for destination 0.0.0.0/0 with the next hop set to Virtual Network Gateway.
    3. Configure Cloud NGFW additional prefixes.
      In the Azure portal, select your Cloud NGFW by Palo Alto Networks resource. Select SettingsNetworking & NAT and add 0.0.0.0/1 and 128.0.0.0/1 to Additional Prefixes to Private Traffic Range.
    Traffic flow detail:
    1. A host machine in the spoke VNet initiates outbound internet traffic.
    2. The spoke VNet route table directs traffic to the Cloud NGFW private IP address.
    3. Cloud NGFW inspects the session. Because 0.0.0.0/1 and 128.0.0.0/1 are configured under Additional Prefixes, Cloud NGFW classifies the packet as private traffic and skips SNAT.
    4. Cloud NGFW forwards the original, un-NATed traffic via its private interface toward the Azure VNet Gateway based on the private subnet route table.
    5. The VNet Gateway transmits the packet across the Site-to-Site VPN tunnel to the on-premises firewall with the original workload source IP intact.
    6. The on-premises firewall applies additional policy enforcement, applies SNAT, and routes traffic to the public internet.

    Forced Tunneling Through Azure Virtual WAN

    When Cloud NGFW is deployed inside an Azure Virtual WAN (VWAN) hub, Virtual WAN Routing Intent directs both private and internet traffic to Cloud NGFW. Forced tunneling allows Cloud NGFW to perform primary inspection before handing traffic off to a spoke NVA or an on-premises firewall connected to the hub.
    Option A: Forced Tunneling via Spoke NVA Firewall
    Traffic flow: Application VNet → VWAN Hub (Routing Intent) → Cloud NGFW → Spoke VNet NVA Firewall → Internet
    1. Configure Virtual WAN Routing Intent.
      In the VWAN Hub, configure Routing Intent and Routing Policies. Set Private Traffic to route to Cloud NGFW. Add 0.0.0.0/0 under Additional Prefixes to force internet traffic through Cloud NGFW, and set Internet Traffic to None.
    2. Configure Virtual Network Connections.
      Under Virtual Network Connections, add a static route for 0.0.0.0/0 with the next hop pointing to the Spoke NVA Firewall private IP. Ensure Propagate Default Route is disabled.
    3. Configure Cloud NGFW private prefixes.
      In your Cloud NGFW resource, select SettingsNetworking & NAT and set Additional Prefixes to Private Traffic Range to 0.0.0.0/1,128.0.0.0/1.
    Option B: Forced Tunneling via On-Premises Firewall (Site-to-Site VPN)
    Traffic flow: Application VNet → VWAN Hub (Routing Intent) → Cloud NGFW → VWAN VPN Gateway → Site-to-Site VPN → On-Premises Firewall → Internet
    1. Configure Virtual WAN Routing Intent.
      In the VWAN Hub, set Private Traffic policy to route to Cloud NGFW. Add 0.0.0.0/0 under Additional Prefixes to capture internet traffic, and set Internet Traffic to None.
    2. Configure the Site-to-Site VPN Gateway.
      Establish a Site-to-Site VPN connection from the VWAN Hub VPN Gateway to the on-premises firewall. Ensure the on-premises firewall advertises a default route (0.0.0.0/0) over BGP.
    3. Configure Cloud NGFW private prefixes.
      In your Cloud NGFW resource, select SettingsNetworking & NAT and set Additional Prefixes to Private Traffic Range to 0.0.0.0/1,128.0.0.0/1.
    Traffic flow detail (Option B):
    1. An application VNet host initiates internet-bound traffic.
    2. VWAN Routing Intent forwards the traffic to Cloud NGFW for inspection.
    3. After inspection, Cloud NGFW routes the session toward the VWAN Hub VPN Gateway, matching the default route advertised by the on-premises gateway over BGP.
    4. The VPN Gateway transmits the packet across the Site-to-Site VPN tunnel to the on-premises firewall.
    5. The on-premises firewall performs final policy inspection, applies source IP translation, and egresses the packet to the public internet.

    © 2026 Palo Alto Networks, Inc. All rights reserved.