Firewall on Azure - no ARP entry on the Internet interface

• The Internet interface (e.g. eth1/1) is configured with static IP address on Azure PA firewall
• No valid ARP entry on the Internet interface
• Not able to reach the Azure vnet gateway (first IP address in the vnet)

• Palo Alto VM based Firewalls
• Supported PAN-OS
• Azure Platform

• Incorrect Subnet mask configured.
• In this example, the subnet mask is statically configured as /32. This subnet mask does not match that of Azure vnet subnet mask.

1. Manually configure the correct subnet mask and default gateway on the Internet interface.
2. Alternatively, use DHCP on the Internet interface, which will assign the IP address and subnet mask automatically on the Internet interface.
3. Once configured, confirm the ARP entry for the default gateway using the CLI command below:
   

   >show arp all

The default gateway of Azure vnet is usually the first available IP address of the vnet - Azure vnet FAQ