Hi, Did you have in place as suggested by Pugmeister - 1. A route table in VNET 2 pointing to the LAN IP of the vMX in VNET 1? Azure takes care of getting traffic between the VNET's but the route table gets traffic to anything outside Azure 2. Did you add the VNET 2 subnet as a local subnet on the vMX   in addition to your Layer 8 issue 🙂 ?   Thanks/DP ... View more

@robfromsc :  In Azure network i think your vMX has its own IP address and you'll need to route packets from the Palo alto towards the IP of the vMX. I would recommend to use static or BGP peering with Palo Alto for exchange routes.     ... View more

Your vMX will have it's own IP in an Azure network and you'll need to route packets from the Pa towards the IP of the vMX towards all spoke networks.   You can achieve this using a few static supernet routes or using BGP if it is possible to peer with the Pa to exchange routes that way. ... View more