Can I use Azure GWLB solution with NVA for the Internet Outbound Traffic?

Rangaraj Gunasekaran 0

Hello Team,

In Azure VNET, I have w365 Virtual Desktops running, and I want to use GWLB + NVA (Palo Alto Firewall behind GWLB) for the Internet Outbound traffic monitoring solution.

I know that Azure reference architectures talks about the usage of GWLB for Internet Inbound Application Architecture using ALB Service Chaining.

Can I use GWLB solution for the Internet Outbound traffic from Virtual Desktop Environment? So that I can use all the firewalls in active/active mode.

Thanks,

Raj

Sai Prasanna Sinde 3,765 Reputation points Microsoft Vendor

2025-02-06T01:54:42.7166667+00:00
Hi @Rangaraj Gunasekaran

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Yes, you can absolutely use a GWLB with NVAs for outbound internet traffic from your W365 Virtual Desktops in Azure. GWLB is perfectly suited for outbound traffic inspection and control as well.

For your reference: https://azure.microsoft.com/en-us/blog/gateway-load-balancer-now-generally-available-in-all-regions/

Traffic originating from your W365 Virtual Desktops destined for the internet is routed to the GWLB. This routing is typically achieved via UDRs on the subnets where your W365 VMs reside. The UDR would have a route for 0.0.0.0/0 pointing to the GWLB's frontend IP address.

The GWLB distributes the outbound traffic across your pool of NVAs. This distribution is based on the GWLB configuration. This allows you to use your firewalls in an active/active configuration, maximizing throughput and redundancy.

For your reference: https://learn.microsoft.com/en-us/azure/load-balancer/gateway-overview#:~:text=Gateway%20Load%20Balancer%20supports%20both%20inbound%20and%20outbound%20traffic%20inspection.%20For%20inserting%20NVAs%20in%20the%20path%20of%20outbound%20traffic%20with%20Standard%20Load%20Balancer%2C%20Gateway%20Load%20Balancer%20must%20be%20chained%20to%20the%20frontend%20IP%20configurations%20selected%20in%20the%20configured%20outbound%20rules.

The NVA inspect the traffic, apply security policies, and perform any other required functions. For your reference: https://learn.microsoft.com/en-us/azure/architecture/networking/guide/nva-ha

After inspection, the NVA forward the traffic to the internet. This typically happens via a default route on the NVA pointing to the internet or an Azure NAT Gateway/Public IP.

Return traffic from the internet follows the reverse path, being inspected by the same NVA that handled the outbound request. GWLB ensures session stickiness to maintain flow affinity.

Your Palo Alto firewalls need to be configured to accept and process traffic from the GWLB. They also need to have a route to the internet, and they must not perform NAT unless specifically required. The GWLB preserves the original source IP, which is essential for proper return traffic handling. The firewalls should focus on security functions, not NAT.

You'll need to create a GWLB and configure a backend pool containing your NVAs. The health probes for the backend pool are essential to ensure that the GWLB only sends traffic to healthy firewalls. A TCP health probe on a port that the firewall actively listens on is recommended.

The GWLB automatically scales to handle increased traffic. Make sure that your NVAs are also configured to scale appropriately to meet demand.

For your reference: https://learn.microsoft.com/en-us/azure/load-balancer/gateway-overview#:~:text=You%20can%20insert,Custom%20appliances

Deploy your NVAs in an Availability Set or across Availability Zones for high availability. Cross verify again all your routing tables (UDRs, NVA routing) to make sure that the traffic flows as expected.

I hope this has been helpful!

Your feedback is important so please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

If you still have questions, please let us know what is needed in the comments below so the question can be answered.

Thanks,

Sai.
Sai Prasanna Sinde 3,765 Reputation points Microsoft Vendor

2025-02-06T23:03:26.42+00:00

Hi @Rangaraj Gunasekaran

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

If you are still facing any further issues, please let us know in the comments below so that we can address them.
Sai Prasanna Sinde 3,765 Reputation points Microsoft Vendor

2025-02-07T17:41:08.98+00:00

Hi @Rangaraj Gunasekaran

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

If you are still facing any further issues, please let us know in the comments below so that we can address them.

Share via

Can I use Azure GWLB solution with NVA for the Internet Outbound Traffic?

Your answer