Yes exactly, that is my thinking, I see no reason from an Azure perspective why they can't be in the same vnet.   With the Azure UDR (dynamically updated by the Azure Function based upon the availability of the primary instance) we would specify the IP address of the active vMX.   It was the first diagram in the guide that was causing me to question this, and think there might be something intrinsic about the vMXs that means that the 2 of them (in an HA pair) couldn't share the same VNet.     ... View more

When it has a single interface it can't act as a traditional firewall allowing traffic to flow between two ports BUT it is still a firewall in the sense that it is protected from threats, and you can directly connect it to the Internet (although that really isn't the case with Azure since Azure is NATing from the public IP it assigns to the private IP that it gives the VMX). ... View more