Azure Firewall- source IP for ingress traffic

Question

what will be the source IP for ingress traffic from internet on Azure FW. I mean initially request will come from the Internet public IP but once it comes inside the network after passing Azure FW, source IP will be Internet public IP or Firewall private IP ?

Answer 1

Hello @Pranav Prashant ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know what the source IP for ingress traffic from Internet will be when it comes into Azure Virtual network after passing an Azure Firewall.

The request to the Azure Firewall public IP is distributed to a back-end instance of the firewall, which will be a private IP of the Azure Firewall instance.

You can find the whole traffic flow in the below document:

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#azure-firewall-only

1. The client starts the connection to the public IP address of the Azure Firewall:
   • Source IP address: ClientPIP
   • Destination IP address: AzFwPIP
2. The request to the Azure Firewall public IP is distributed to a back-end instance of the firewall, which is a private IP. The Azure Firewall Destination NAT (DNAT) rule translates the destination IP address to the application IP address inside the virtual network. The Azure Firewall also Source NATs (SNATs) the packet if it does DNAT. For more information, see Azure Firewall known issues. The VM in the Vnet sees the following IP addresses in the incoming packet:
   • Source IP address: private IP of Azure Firewall instance.
   • Destination IP address: the VM's IP address
3. The VM answers the application request, reversing source and destination IP addresses.
   • Source IP address: the VM's IP address
   • Destination IP address: private IP of Azure Firewall instance.
4. Finally, Azure Firewall undoes the SNAT and DNAT operations, and delivers the response to the client:
   • Source IP address: AzFwPIP
   • Destination IP address: ClientPIP

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.