An engineering look at route selection, stateful firewalls, and practical troubleshooting in Microsoft Azure.

For cloud network and security engineers designing centralized inspection in Azure.

A firewall rule can be correct, logging can be on, and the appliance can be healthy, yet traffic may still reach its destination without ever passing through the inspection point. In Azure, routing and policy enforcement are separate layers: user-defined routes (UDRs), BGP-learned routes, virtual network peering, and managed connectivity services decide where packets go, and none of them consult your firewall policy. A firewall cannot inspect traffic it never receives.

The example below is a lab-style scenario with fictional addresses, built from publicly documented Azure behavior. The later sections cover return paths, Virtual WAN, and who is allowed to change routes.

1.…