Azure Synapse managed Vnet default routing through an NVA firewall

Question

Azure Synapse managed Vnet default routing through an NVA firewall

Shawn Schiebrel 5

We have deployed a synapse instance with a managed vnet,

We also have deployed a palo alto azure fw appliance that we want to inspect all traffic with.

i understand I can use Private endpoints when communicating with synapse from other vnets and we have routed all traffic that is initialized from other sources, VM's, SQL etc. to that private endpoint through the palo alto.

I'm wondering if we can route traffic initialized from Synapse to that palo alto as well.

phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-14T07:22:43.32+00:00
@Shawn Schiebrel

Welcome to Microsoft Q&A platform and thanks for posting your query here.

You're on the right track with using Private Endpoints for inbound traffic to Synapse. However, routing outbound traffic from the Synapse managed VNet through your Palo Alto firewall requires a different approach since you can't directly manipulate the default route table of a managed VNet.

To achieve this, you need to configure custom routes in your route table to direct the traffic through the Network Virtual Appliance (NVA).

Here the steps:

Create a Route Table: In the Azure portal, create a route table if you don't already have one.

Add a Route: Add a custom route to the route table. Set the destination address prefix to 0.0.0.0/0 (or a specific address range if you prefer) and the next hop type to Virtual Appliance. Enter the IP address of your Palo Alto firewall as the next hop.

Associate the Route Table: Associate the route table with the subnet where your Synapse workspace is deployed.

Configure UDRs: Ensure that User-Defined Routes (UDRs) are configured correctly to route traffic from the Synapse managed VNet to the Palo Alto firewall.

By setting up these custom routes, you can ensure that all traffic from your Synapse instance is inspected by the Palo Alto firewall

please refer :https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

https://www.willvelida.com/posts/vnet-traffic-routing/

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
Shawn Schiebrel 5 Reputation points

2025-02-14T13:13:39.8966667+00:00
This is what I thought I was going to have to do, but didn't want to stand up a lab for all this to test. Question tho. This all needs to be private IP addressing (we don't want to use the public IP of synapse for anything), since I can't see and won't know the managed private subnet for synapse (or will I?),

Will the synapse managed vnet/subnet know, and be able to route to, the 1918 subnet that I assign the trusted interface of the palo alto

how will I make layer 3 rules on the palo allowing synapse to various other resources and vice versa? (what subnet will I use for synapse)
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-14T18:43:50.78+00:00
@shawn schiebrel

Thanks for your Information

Great questions! Let's break this down:

Private IP Addressing: When using a Synapse managed VNet, the managed private subnet is not directly visible to you. However, you can still route traffic through your Palo Alto firewall using private IP addresses. The managed VNet will handle the private IP addressing internally.

Routing to the 1918 Subnet: Yes, the Synapse managed VNet can route to the 1918 subnet (private IP range) that you assign to the trusted interface of the Palo Alto firewall. You will need to set up User-Defined Routes (UDRs) to ensure that traffic from the Synapse managed VNet is directed to the Palo Alto firewall.

Layer 3 Rules on Palo Alto: To create Layer 3 rules on the Palo Alto firewall, you will need to know the IP ranges used by the Synapse managed VNet. While you won't see the exact managed private subnet, you can configure your firewall rules based on the IP ranges used by the Synapse workspace. Typically, these ranges are part of the private IP address space (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Here's a general approach:

Identify IP Ranges: Determine the IP ranges used by your Synapse workspace. This information can be found in the Azure portal under the networking settings of your Synapse workspace.

Configure UDRs: Set up User-Defined Routes in the route table associated with the Synapse managed VNet to route traffic to the Palo Alto firewall.

Create Firewall Rules: On the Palo Alto firewall, create Layer 3 rules to allow traffic from the identified IP ranges of the Synapse managed VNet to the necessary resources and vice versa.

For more detailed guidance, please refer to the following resources:

Synapse Connectivity Series Part #3 - Synapse Managed VNET and Managed Private Endpoints

Azure Synapse connectivity settings

Managed private endpoints - Azure Synapse Analytics
Shawn Schiebrel 5 Reputation points

2025-02-17T14:19:46.9466667+00:00

ok, I set up a lab for this, created my synapse workspace. The only network mentioned is under security and does not list the vnet or subnet that was created by the managed vnet.

under settings, only entra-id, properties (no mention of a network there either), and lock appear.

under security, networking is there but only setting for the public network access and inbound FW rules are there. No vnet or subnet information.

More-over, i created a UDR and tried to attach it to the synapse network but the only vnet/subnet in the dropdown was the vnet i created as a private endpoint space

i'm not sure where you got the information you list, but the synapse workspace does not have the information you state it should. perhaps a powershell workaround?
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-17T18:50:11.8866667+00:00
@Shawn Schiebrel

Here is a potential workaround using PowerShell to help you achieve your goal.

PowerShell Workaround:

Install the Az.Synapse Module: Ensure you have the Az.Synapse module installed. If not, you can install it using the following command:
Install-Module -Name Az.Synapse -AllowClobber -Force

Connect to Your Azure Account:
Connect-AzAccount

Retrieve Synapse Workspace Information: Use the following command to get details about your Synapse workspace:
$workspace = Get-AzSynapseWorkspace -ResourceGroupName "YourResourceGroupName" -Name "YourWorkspaceName"

Get Managed VNet Information: Although the managed VNet and subnet details are not directly visible in the portal, you can retrieve the necessary information using the following command:
$managedVNet = Get-AzSynapseManagedVirtualNetwork -ResourceGroupName "YourResourceGroupName" -WorkspaceName "YourWorkspaceName"

Create and Associate UDR: Create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the managed VNet subnet

# Create a route table $routeTable = New-AzRouteTable -ResourceGroupName "YourResourceGroupName" -Location "YourLocation" -Name "YourRouteTableName" # Add a route to the route table Add-AzRouteConfig -Name "RouteToFirewall" -AddressPrefix "0.0.0.0/0" -NextHopType "VirtualAppliance" -NextHopIpAddress "PaloAltoFirewallIP" -RouteTable $routeTable # Associate the route table with the managed VNet subnet Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $managedVNet -Name "ManagedSubnetName" -AddressPrefix "SubnetAddressPrefix" -RouteTable $routeTable
Shawn Schiebrel 5 Reputation points

2025-02-17T19:17:26.3766667+00:00

Get-AzSynapseManagedVirtualNetwork is no longer a valid command.. I can get the workspace info fine, but that command comes back bad. if I google the command, i get no results, it's not even in the cli list of synapse powershell commands.

https://learn.microsoft.com/en-us/cli/azure/synapse?view=azure-cli-latest

phemanth 15,755 Microsoft External Staff Moderator

@Shawn Schiebrel

please consider this alternative approach

Install Azure CLI: If you haven't already installed the Azure CLI, you can download and install it from here.

Log in to Azure:

az login

Retrieve Synapse Workspace Information:

az synapse workspace show --name YourWorkspaceName --resource-group YourResourceGroupName

List Private Endpoints:

az network private-endpoint list --resource-group YourResourceGroupName

Create and Associate UDR: You can create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the subnet where your Synapse workspace is deployed.

# Create a route table
az network route-table create --resource-group YourResourceGroupName --name YourRouteTableName --location YourLocation
# Add a route to the route table
az network route-table route create --resource-group YourResourceGroupName --route-table-name YourRouteTableName --name RouteToFirewall --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address PaloAltoFirewallIP
# Associate the route table with the subnet
az network vnet subnet update --resource-group YourResourceGroupName --vnet-name YourVNetName --name YourSubnetName --route-table YourRouteTableName

shawn schiebrel 0 Reputation points

2025-02-19T21:05:33.29+00:00
While I appreciate the suggestion, this does not work. The subnet name in the workspace is default and does not list the vnet name at all.

"location": "eastus2",

"managedResourceGroupName": "synapseworkspace-managedrg-2373ad99",

"managedVirtualNetwork": "default",

"managedVirtualNetworkSettings": {

"allowedAadTenantIdsForLinking": [], "linkedAccessCheckOnTargetResource": null, "preventDataExfiltration": true
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-21T19:44:39.64+00:00
@Shawn Schiebrel I understand your situation. The managed VNet for Azure Synapse can indeed be tricky to work with since it doesn't expose the VNet and subnet details directly.

Given the constraints, here are a few alternative approaches you might consider:

Using Private Endpoints for Outbound Traffic:

While the managed VNet doesn't expose its details, you can still use private endpoints to route traffic through your firewall. This involves setting up private endpoints for the resources Synapse needs to communicate with and ensuring those endpoints are routed through your Palo Alto firewall.

Azure Firewall or Network Virtual Appliance (NVA):

Consider using an Azure Firewall or another NVA in conjunction with your Palo Alto firewall. You can set up a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains the Azure Firewall or NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Custom DNS and Private Link:

Use Azure Private Link and custom DNS settings to ensure that traffic from Synapse to other Azure services is routed through your firewall. This involves configuring private DNS zones and linking them to your VNet.

Example Configuration with Private Endpoints:

Create Private Endpoints for the resources Synapse needs to access.

Configure DNS to ensure traffic to these resources is routed through the private endpoints.

Set Up UDRs to route traffic from the private endpoints through your Palo Alto firewall.

Example Configuration with Hub-and-Spoke:

Create a Hub VNet with an Azure Firewall or NVA.

Peering: Peer the Synapse managed VNet with the Hub VNet.

Route Traffic: Use UDRs to route traffic from the Synapse managed VNet through the Hub VNet and then through your Palo Alto firewall
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-21T19:48:09.3266667+00:00
@Shawn Schiebrel I understand your situation, The managed VNet for Azure Synapse can indeed be tricky to work with since it doesn't expose the VNet and subnet details directly.

Given the constraints, here are a few alternative approaches

Using Private Endpoints for Outbound Traffic:

While the managed VNet doesn't expose its details, you can still use private endpoints to route traffic through your firewall. This involves setting up private endpoints for the resources Synapse needs to communicate with and ensuring those endpoints are routed through your Palo Alto firewall.

Azure Firewall or Network Virtual Appliance (NVA):

Consider using an Azure Firewall or another NVA in conjunction with your Palo Alto firewall. You can set up a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains the Azure Firewall or NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Custom DNS and Private Link:

Use Azure Private Link and custom DNS settings to ensure that traffic from Synapse to other Azure services is routed through your firewall. This involves configuring private DNS zones and linking them to your VNet.

Example Configuration with Private Endpoints:

Create Private Endpoints for the resources Synapse needs to access.

Configure DNS to ensure traffic to these resources is routed through the private endpoints.

Set Up UDRs to route traffic from the private endpoints through your Palo Alto firewall.

Example Configuration with Hub-and-Spoke:

Create a Hub VNet with an Azure Firewall or NVA.

Peering: Peer the Synapse managed VNet with the Hub VNet.

Route Traffic: Use UDRs to route traffic from the Synapse managed VNet through the Hub VNet and then through your Palo Alto firewall
shawn schiebrel 0 Reputation points

2025-02-24T12:57:43.4+00:00

Have you actually done this or are you just assuming this is how it's done. you cannot use UDR's with a synapse managed vnet in any way that i've found. You are unable to assign the UDR to the managed vnet subnet since it does not appear in the drop down list of available subnets. The palo alto IS an NVA.
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-25T17:58:20.6866667+00:00
@Shawn Schiebrel

I apologize The managed VNet for Azure Synapse can indeed be challenging to work with due to its limitations and lack of visibility

please consider this approach

Use a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains your Palo Alto NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Steps for Hub-and-Spoke Configuration:

Create a Hub VNet: Deploy your Palo Alto NVA in the hub VNet.

Peer the Synapse Managed VNet with the Hub VNet: Use VNet peering to connect the Synapse managed VNet with the hub VNet.

Configure Routing: Use UDRs in the hub VNet to route traffic through the Palo Alto NVA.

1 answer

Your answer

phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-14T07:22:43.32+00:00

@Shawn Schiebrel

Welcome to Microsoft Q&A platform and thanks for posting your query here.

You're on the right track with using Private Endpoints for inbound traffic to Synapse. However, routing outbound traffic from the Synapse managed VNet through your Palo Alto firewall requires a different approach since you can't directly manipulate the default route table of a managed VNet.

To achieve this, you need to configure custom routes in your route table to direct the traffic through the Network Virtual Appliance (NVA).

Here the steps:

Create a Route Table: In the Azure portal, create a route table if you don't already have one.

Add a Route: Add a custom route to the route table. Set the destination address prefix to 0.0.0.0/0 (or a specific address range if you prefer) and the next hop type to Virtual Appliance. Enter the IP address of your Palo Alto firewall as the next hop.

Associate the Route Table: Associate the route table with the subnet where your Synapse workspace is deployed.

Configure UDRs: Ensure that User-Defined Routes (UDRs) are configured correctly to route traffic from the Synapse managed VNet to the Palo Alto firewall.

By setting up these custom routes, you can ensure that all traffic from your Synapse instance is inspected by the Palo Alto firewall

please refer :https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

https://www.willvelida.com/posts/vnet-traffic-routing/

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
Shawn Schiebrel 5 Reputation points

2025-02-14T13:13:39.8966667+00:00

This is what I thought I was going to have to do, but didn't want to stand up a lab for all this to test. Question tho. This all needs to be private IP addressing (we don't want to use the public IP of synapse for anything), since I can't see and won't know the managed private subnet for synapse (or will I?),

Will the synapse managed vnet/subnet know, and be able to route to, the 1918 subnet that I assign the trusted interface of the palo alto

how will I make layer 3 rules on the palo allowing synapse to various other resources and vice versa? (what subnet will I use for synapse)
Shawn Schiebrel 5 Reputation points

2025-02-17T14:19:46.9466667+00:00

ok, I set up a lab for this, created my synapse workspace. The only network mentioned is under security and does not list the vnet or subnet that was created by the managed vnet.

under settings, only entra-id, properties (no mention of a network there either), and lock appear.

under security, networking is there but only setting for the public network access and inbound FW rules are there. No vnet or subnet information.

More-over, i created a UDR and tried to attach it to the synapse network but the only vnet/subnet in the dropdown was the vnet i created as a private endpoint space

i'm not sure where you got the information you list, but the synapse workspace does not have the information you state it should. perhaps a powershell workaround?
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-17T18:50:11.8866667+00:00

@Shawn Schiebrel

Here is a potential workaround using PowerShell to help you achieve your goal.

PowerShell Workaround:

Install the Az.Synapse Module: Ensure you have the Az.Synapse module installed. If not, you can install it using the following command:
Install-Module -Name Az.Synapse -AllowClobber -Force

Connect to Your Azure Account:
Connect-AzAccount

Retrieve Synapse Workspace Information: Use the following command to get details about your Synapse workspace:
$workspace = Get-AzSynapseWorkspace -ResourceGroupName "YourResourceGroupName" -Name "YourWorkspaceName"

Get Managed VNet Information: Although the managed VNet and subnet details are not directly visible in the portal, you can retrieve the necessary information using the following command:
$managedVNet = Get-AzSynapseManagedVirtualNetwork -ResourceGroupName "YourResourceGroupName" -WorkspaceName "YourWorkspaceName"

Create and Associate UDR: Create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the managed VNet subnet

# Create a route table $routeTable = New-AzRouteTable -ResourceGroupName "YourResourceGroupName" -Location "YourLocation" -Name "YourRouteTableName" # Add a route to the route table Add-AzRouteConfig -Name "RouteToFirewall" -AddressPrefix "0.0.0.0/0" -NextHopType "VirtualAppliance" -NextHopIpAddress "PaloAltoFirewallIP" -RouteTable $routeTable # Associate the route table with the managed VNet subnet Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $managedVNet -Name "ManagedSubnetName" -AddressPrefix "SubnetAddressPrefix" -RouteTable $routeTable
Shawn Schiebrel 5 Reputation points

2025-02-17T19:17:26.3766667+00:00

Get-AzSynapseManagedVirtualNetwork is no longer a valid command.. I can get the workspace info fine, but that command comes back bad. if I google the command, i get no results, it's not even in the cli list of synapse powershell commands.

https://learn.microsoft.com/en-us/cli/azure/synapse?view=azure-cli-latest
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-19T19:30:32.22+00:00

@Shawn Schiebrel

please consider this alternative approach

Install Azure CLI: If you haven't already installed the Azure CLI, you can download and install it from here.

Log in to Azure:

az login

Retrieve Synapse Workspace Information:

az synapse workspace show --name YourWorkspaceName --resource-group YourResourceGroupName

List Private Endpoints:

az network private-endpoint list --resource-group YourResourceGroupName

Create and Associate UDR: You can create a route table and add a custom route to direct traffic through your Palo Alto firewall. Then, associate this route table with the subnet where your Synapse workspace is deployed.

# Create a route table az network route-table create --resource-group YourResourceGroupName --name YourRouteTableName --location YourLocation # Add a route to the route table az network route-table route create --resource-group YourResourceGroupName --route-table-name YourRouteTableName --name RouteToFirewall --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address PaloAltoFirewallIP # Associate the route table with the subnet az network vnet subnet update --resource-group YourResourceGroupName --vnet-name YourVNetName --name YourSubnetName --route-table YourRouteTableName
shawn schiebrel 0 Reputation points

2025-02-19T21:05:33.29+00:00

While I appreciate the suggestion, this does not work. The subnet name in the workspace is default and does not list the vnet name at all.

"location": "eastus2",

"managedResourceGroupName": "synapseworkspace-managedrg-2373ad99",

"managedVirtualNetwork": "default",

"managedVirtualNetworkSettings": {

"allowedAadTenantIdsForLinking": [], "linkedAccessCheckOnTargetResource": null, "preventDataExfiltration": true
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-21T19:44:39.64+00:00

@Shawn Schiebrel I understand your situation. The managed VNet for Azure Synapse can indeed be tricky to work with since it doesn't expose the VNet and subnet details directly.

Given the constraints, here are a few alternative approaches you might consider:

Using Private Endpoints for Outbound Traffic:

While the managed VNet doesn't expose its details, you can still use private endpoints to route traffic through your firewall. This involves setting up private endpoints for the resources Synapse needs to communicate with and ensuring those endpoints are routed through your Palo Alto firewall.

Azure Firewall or Network Virtual Appliance (NVA):

Consider using an Azure Firewall or another NVA in conjunction with your Palo Alto firewall. You can set up a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains the Azure Firewall or NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Custom DNS and Private Link:

Use Azure Private Link and custom DNS settings to ensure that traffic from Synapse to other Azure services is routed through your firewall. This involves configuring private DNS zones and linking them to your VNet.

Example Configuration with Private Endpoints:

Create Private Endpoints for the resources Synapse needs to access.

Configure DNS to ensure traffic to these resources is routed through the private endpoints.

Set Up UDRs to route traffic from the private endpoints through your Palo Alto firewall.

Example Configuration with Hub-and-Spoke:

Create a Hub VNet with an Azure Firewall or NVA.

Peering: Peer the Synapse managed VNet with the Hub VNet.

Route Traffic: Use UDRs to route traffic from the Synapse managed VNet through the Hub VNet and then through your Palo Alto firewall
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-21T19:48:09.3266667+00:00

@Shawn Schiebrel I understand your situation, The managed VNet for Azure Synapse can indeed be tricky to work with since it doesn't expose the VNet and subnet details directly.

Given the constraints, here are a few alternative approaches

Using Private Endpoints for Outbound Traffic:

While the managed VNet doesn't expose its details, you can still use private endpoints to route traffic through your firewall. This involves setting up private endpoints for the resources Synapse needs to communicate with and ensuring those endpoints are routed through your Palo Alto firewall.

Azure Firewall or Network Virtual Appliance (NVA):

Consider using an Azure Firewall or another NVA in conjunction with your Palo Alto firewall. You can set up a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains the Azure Firewall or NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Custom DNS and Private Link:

Use Azure Private Link and custom DNS settings to ensure that traffic from Synapse to other Azure services is routed through your firewall. This involves configuring private DNS zones and linking them to your VNet.

Example Configuration with Private Endpoints:

Create Private Endpoints for the resources Synapse needs to access.

Configure DNS to ensure traffic to these resources is routed through the private endpoints.

Set Up UDRs to route traffic from the private endpoints through your Palo Alto firewall.

Example Configuration with Hub-and-Spoke:

Create a Hub VNet with an Azure Firewall or NVA.

Peering: Peer the Synapse managed VNet with the Hub VNet.

Route Traffic: Use UDRs to route traffic from the Synapse managed VNet through the Hub VNet and then through your Palo Alto firewall
shawn schiebrel 0 Reputation points

2025-02-24T12:57:43.4+00:00

Have you actually done this or are you just assuming this is how it's done. you cannot use UDR's with a synapse managed vnet in any way that i've found. You are unable to assign the UDR to the managed vnet subnet since it does not appear in the drop down list of available subnets. The palo alto IS an NVA.
phemanth 15,755 Reputation points Microsoft External Staff Moderator

2025-02-25T17:58:20.6866667+00:00

@Shawn Schiebrel

I apologize The managed VNet for Azure Synapse can indeed be challenging to work with due to its limitations and lack of visibility

please consider this approach

Use a hub-and-spoke network topology where the Synapse managed VNet is a spoke, and the hub contains your Palo Alto NVA. This setup allows you to route traffic through the firewall without needing direct access to the managed VNet's subnet details.

Steps for Hub-and-Spoke Configuration:

Create a Hub VNet: Deploy your Palo Alto NVA in the hub VNet.

Peer the Synapse Managed VNet with the Hub VNet: Use VNet peering to connect the Synapse managed VNet with the hub VNet.

Configure Routing: Use UDRs in the hub VNet to route traffic through the Palo Alto NVA.

Answer 1

Shawn Schiebrel 5

testtest

Share via

Azure Synapse managed Vnet default routing through an NVA firewall

1 answer

Your answer