This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 82%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
We have deployed a synapse instance with a managed vnet,
We also have deployed a palo alto azure fw appliance that we want to inspect all traffic with.
i understand I can use Private endpoints when communicating with synapse from other vnets and we have routed all traffic that is initialized from other sources, VM's, SQL etc. to that private endpoint through the palo alto.
I'm wondering if we can route traffic initialized from Synapse to that palo alto as well.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 61%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Welcome to Microsoft Q&A platform and thanks for posting your query here.
You're on the right track with using Private Endpoints for inbound traffic to Synapse. However, routing outbound traffic from the Synapse managed VNet through your Palo Alto firewall requires a different approach since you can't directly manipulate the default route table of a managed VNet.
To achieve this, you need to configure custom routes in your route table to direct the traffic through the Network Virtual Appliance (NVA).
Here the steps:
0.0.0.0/0 (or a specific address range if you prefer) and the next hop type to Virtual Appliance. Enter the IP address of your Palo Alto firewall as the next hop.By setting up these custom routes, you can ensure that all traffic from your Synapse instance is inspected by the Palo Alto firewall
please refer :https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva
https://www.willvelida.com/posts/vnet-traffic-routing/
I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
This is what I thought I was going to have to do, but didn't want to stand up a lab for all this to test. Question tho. This all needs to be private IP addressing (we don't want to use the public IP of synapse for anything), since I can't see and won't know the managed private subnet for synapse (or will I?),
Thanks for your Information
Great questions! Let's break this down:
Private IP Addressing: When using a Synapse managed VNet, the managed private subnet is not directly visible to you. However, you can still route traffic through your Palo Alto firewall using private IP addresses. The managed VNet will handle the private IP addressing internally.
Routing to the 1918 Subnet: Yes, the Synapse managed VNet can route to the 1918 subnet (private IP range) that you assign to the trusted interface of the Palo Alto firewall. You will need to set up User-Defined Routes (UDRs) to ensure that traffic from the Synapse managed VNet is directed to the Palo Alto firewall.
Layer 3 Rules on Palo Alto: To create Layer 3 rules on the Palo Alto firewall, you will need to know the IP ranges used by the Synapse managed VNet. While you won't see the exact managed private subnet, you can configure your firewall rules based on the IP ranges used by the Synapse workspace. Typically, these ranges are part of the private IP address space (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Here's a general approach:
For more detailed guidance, please refer to the following resources: