Azure Synapse managed Vnet default routing through an NVA firewall

Shawn Schiebrel 5

We have deployed a synapse instance with a managed vnet,

We also have deployed a palo alto azure fw appliance that we want to inspect all traffic with.

i understand I can use Private endpoints when communicating with synapse from other vnets and we have routed all traffic that is initialized from other sources, VM's, SQL etc. to that private endpoint through the palo alto.

I'm wondering if we can route traffic initialized from Synapse to that palo alto as well.

phemanth 13,900 Reputation points Microsoft Vendor

2025-02-14T07:22:43.32+00:00
@Shawn Schiebrel

Welcome to Microsoft Q&A platform and thanks for posting your query here.

You're on the right track with using Private Endpoints for inbound traffic to Synapse. However, routing outbound traffic from the Synapse managed VNet through your Palo Alto firewall requires a different approach since you can't directly manipulate the default route table of a managed VNet.

To achieve this, you need to configure custom routes in your route table to direct the traffic through the Network Virtual Appliance (NVA).

Here the steps:

Create a Route Table: In the Azure portal, create a route table if you don't already have one.

Add a Route: Add a custom route to the route table. Set the destination address prefix to 0.0.0.0/0 (or a specific address range if you prefer) and the next hop type to Virtual Appliance. Enter the IP address of your Palo Alto firewall as the next hop.

Associate the Route Table: Associate the route table with the subnet where your Synapse workspace is deployed.

Configure UDRs: Ensure that User-Defined Routes (UDRs) are configured correctly to route traffic from the Synapse managed VNet to the Palo Alto firewall.

By setting up these custom routes, you can ensure that all traffic from your Synapse instance is inspected by the Palo Alto firewall

please refer :https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

https://www.willvelida.com/posts/vnet-traffic-routing/

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
Shawn Schiebrel 5 Reputation points

2025-02-14T13:13:39.8966667+00:00
This is what I thought I was going to have to do, but didn't want to stand up a lab for all this to test. Question tho. This all needs to be private IP addressing (we don't want to use the public IP of synapse for anything), since I can't see and won't know the managed private subnet for synapse (or will I?),

Will the synapse managed vnet/subnet know, and be able to route to, the 1918 subnet that I assign the trusted interface of the palo alto

how will I make layer 3 rules on the palo allowing synapse to various other resources and vice versa? (what subnet will I use for synapse)
phemanth 13,900 Reputation points Microsoft Vendor

2025-02-14T18:43:50.78+00:00
@shawn schiebrel

Thanks for your Information

Great questions! Let's break this down:

Private IP Addressing: When using a Synapse managed VNet, the managed private subnet is not directly visible to you. However, you can still route traffic through your Palo Alto firewall using private IP addresses. The managed VNet will handle the private IP addressing internally.

Routing to the 1918 Subnet: Yes, the Synapse managed VNet can route to the 1918 subnet (private IP range) that you assign to the trusted interface of the Palo Alto firewall. You will need to set up User-Defined Routes (UDRs) to ensure that traffic from the Synapse managed VNet is directed to the Palo Alto firewall.

Layer 3 Rules on Palo Alto: To create Layer 3 rules on the Palo Alto firewall, you will need to know the IP ranges used by the Synapse managed VNet. While you won't see the exact managed private subnet, you can configure your firewall rules based on the IP ranges used by the Synapse workspace. Typically, these ranges are part of the private IP address space (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Here's a general approach:

Identify IP Ranges: Determine the IP ranges used by your Synapse workspace. This information can be found in the Azure portal under the networking settings of your Synapse workspace.

Configure UDRs: Set up User-Defined Routes in the route table associated with the Synapse managed VNet to route traffic to the Palo Alto firewall.

Create Firewall Rules: On the Palo Alto firewall, create Layer 3 rules to allow traffic from the identified IP ranges of the Synapse managed VNet to the necessary resources and vice versa.

For more detailed guidance, please refer to the following resources:

Synapse Connectivity Series Part #3 - Synapse Managed VNET and Managed Private Endpoints

Azure Synapse connectivity settings

Managed private endpoints - Azure Synapse Analytics
Shawn Schiebrel 5 Reputation points

2025-02-17T14:19:46.9466667+00:00

ok, I set up a lab for this, created my synapse workspace. The only network mentioned is under security and does not list the vnet or subnet that was created by the managed vnet.

under settings, only entra-id, properties (no mention of a network there either), and lock appear.

under security, networking is there but only setting for the public network access and inbound FW rules are there. No vnet or subnet information.

More-over, i created a UDR and tried to attach it to the synapse network but the only vnet/subnet in the dropdown was the vnet i created as a private endpoint space

i'm not sure where you got the information you list, but the synapse workspace does not have the information you state it should. perhaps a powershell workaround?

phemanth 13,900 Microsoft Vendor

@Shawn Schiebrel

Here is a potential workaround using PowerShell to help you achieve your goal.

PowerShell Workaround:

Install the Az.Synapse Module: Ensure you have the Az.Synapse module installed. If not, you can install it using the following command:
```
   Install-Module -Name Az.Synapse -AllowClobber -Force
```
Connect to Your Azure Account:
```
   Connect-AzAccount
```

Retrieve Synapse Workspace Information: Use the following command to get details about your Synapse workspace:

   $workspace = Get-AzSynapseWorkspace -ResourceGroupName "YourResourceGroupName" -Name "YourWorkspaceName"

Get Managed VNet Information: Although the managed VNet and subnet details are not directly visible in the portal, you can retrieve the necessary information using the following command:
```
   $managedVNet = Get-AzSynapseManagedVirtualNetwork -ResourceGroupName "YourResourceGroupName" -WorkspaceName "YourWorkspaceName"
```
Create and Associate UDR: Create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the managed VNet subnet

# Create a route table
$routeTable = New-AzRouteTable -ResourceGroupName "YourResourceGroupName" -Location "YourLocation" -Name "YourRouteTableName"

# Add a route to the route table
Add-AzRouteConfig -Name "RouteToFirewall" -AddressPrefix "0.0.0.0/0" -NextHopType "VirtualAppliance" -NextHopIpAddress "PaloAltoFirewallIP" -RouteTable $routeTable

# Associate the route table with the managed VNet subnet
Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $managedVNet -Name "ManagedSubnetName" -AddressPrefix "SubnetAddressPrefix" -RouteTable $routeTable

Shawn Schiebrel 5 Reputation points

2025-02-17T19:17:26.3766667+00:00

Get-AzSynapseManagedVirtualNetwork is no longer a valid command.. I can get the workspace info fine, but that command comes back bad. if I google the command, i get no results, it's not even in the cli list of synapse powershell commands.

https://learn.microsoft.com/en-us/cli/azure/synapse?view=azure-cli-latest

phemanth 13,900 Microsoft Vendor

@Shawn Schiebrel

please consider this alternative approach

Install Azure CLI: If you haven't already installed the Azure CLI, you can download and install it from here.

Log in to Azure:

az login

Retrieve Synapse Workspace Information:

az synapse workspace show --name YourWorkspaceName --resource-group YourResourceGroupName

List Private Endpoints:

az network private-endpoint list --resource-group YourResourceGroupName

Create and Associate UDR: You can create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the subnet where your Synapse workspace is deployed.

# Create a route table
az network route-table create --resource-group YourResourceGroupName --name YourRouteTableName --location YourLocation
# Add a route to the route table
az network route-table route create --resource-group YourResourceGroupName --route-table-name YourRouteTableName --name RouteToFirewall --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address PaloAltoFirewallIP
# Associate the route table with the subnet
az network vnet subnet update --resource-group YourResourceGroupName --vnet-name YourVNetName --name YourSubnetName --route-table YourRouteTableName

shawn schiebrel 0 Reputation points

2025-02-19T21:05:33.29+00:00
While I appreciate the suggestion, this does not work. The subnet name in the workspace is default and does not list the vnet name at all.

"location": "eastus2",

"managedResourceGroupName": "synapseworkspace-managedrg-2373ad99",

"managedVirtualNetwork": "default",

"managedVirtualNetworkSettings": {

"allowedAadTenantIdsForLinking": [], "linkedAccessCheckOnTargetResource": null, "preventDataExfiltration": true

1 answer

Shawn Schiebrel 5 Reputation points

2025-02-14T13:24:32.0833333+00:00

testtest
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Synapse managed Vnet default routing through an NVA firewall

1 answer

Your answer