How to configure AZFWFlowTrace logs on Azure Firewall (Basic SKU) to debug Asymmetric routing

Hi @Charith W,

Thank you for reaching out on Microsoft Q&A forum.

Azure Private Endpoints do not support user-defined routes or forced tunneling through Azure Firewall or NVAs. Traffic to Private Endpoints uses platform-managed routing and bypasses network virtual appliances by design.

Associating a UDR to a Private Endpoint subnet results in connection timeouts, which explains why connectivity to the SQL Private Endpoint breaks when a route table is applied. Because this traffic never traverses Azure Firewall, it will not appear in AZFWFlowTrace logs.

Enabling PrivateEndpointNetworkPolicies on a subnet allows UDRs only for the limited purpose of overriding the auto-injected /32 routes that Azure creates for traffic destined to Private Endpoints. This does not apply to return traffic from the Private Endpoint, which always follows the platform-defined path and cannot be redirected using UDRs.

In this scenario, routing P2S VPN traffic through Azure Firewall while the return traffic from the Private Endpoint bypasses the firewall results in asymmetric routing. Since Private Endpoint return traffic cannot be forced through a firewall, Microsoft recommends using SNAT on the firewall when inspection is required.

With SNAT, the Private Endpoint responds to the firewall IP, restoring symmetric traffic flow. Without SNAT, return traffic from Private Endpoints will always bypass the firewall, and attempting to override this behavior using UDRs is unsupported.

AZFWFlowTrace logs remain empty because Private Endpoint traffic does not traverse Azure Firewall by design, so there is no data plane flow for the firewall to log.

References:

• Private Endpoint traffic flow and routing behavior https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-traffic-flow
• Azure Firewall SNAT behavior https://learn.microsoft.com/azure/firewall/snat-private-range

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".

Hello Charith W,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to know how you can configure AZFWFlowTrace logs on Azure Firewall (Basic SKU) to debug Asymmetric routing.

Below are the fact and what you can do, kindly follow the steps accordingly:

1. AZFWFlowTrace does not populate because Azure Firewall Basic does not support Flow Trace logs. this capability exists only in Standard and Premium SKUs. No PowerShell switch or diagnostic tweak can enable it on Basic. For validation on Basic, rely on AZFWNetworkRule, AZFWApplicationRule, and DNS logs instead. Reference: https://learn.microsoft.com/azure/azure-monitor/reference/supported-logs/microsoft-network-azurefirewalls-logs
2. The SQL connection times out due to asymmetric routing introduced when a UDR is applied to the Private Endpoint subnet. Private Endpoints use system /32 routes and do not honor UDRs by default, causing return traffic to bypass the firewall. A stateful firewall drops such flows because it never sees both directions. - https://learn.microsoft.com/azure/private-link/private-endpoint-network-policies
3. Do not place UDRs on the Private Endpoint subnet. Instead, force symmetry by ensuring the firewall performs SNAT so the SQL Private Endpoint replies to the firewall’s IP. This guarantees the return path traverses the firewall and preserves session state. - https://learn.microsoft.com/azure/firewall/firewall-snat
4. Apply a UDR only on the P2S gateway or hub subnet to send traffic to the firewall, then allow TCP 1433 with a Network Rule; SNAT occurs by default on firewall egress. Validate routing using Effective Routes to confirm the path is P2S > Firewall > SQL PE > Firewall > P2S. - https://learn.microsoft.com/azure/virtual-network/effective-routes
5. Confirm connectivity and inspection using supported logs on Basic with a simple KQL query: AZFWNetworkRule | where DestinationPort == "1433" | order by TimeGenerated desc You should see allowed decisions with the firewall as the translated source, confirming symmetric flow and stable connectivity.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Hi,

Thanks for your response, noted on SNAT, would this need to be done via the page in the screenshot ive attached ?

Additionally, i tried step 4 but even with a UDR applied to the GatewaySubnet that routes to the firewall (when the destination requested is the private endpoint subnet of the sql server) i now dont see logs in the AZFWNetworkRule table which im assuming means the traffic is not going through the firewall ?

Hi @Thanmayi Godithi ,

Hope you're well, it has been quite some time since we last synced on this topic but do you have any updates for me regarding what the cause of this issue is ?