Martin, i don’t suppose you’ve done a similar deployment where traffic is full tunnelled from the spoke site to the Vmx in azure, routed through the azure firewall and breaks out of one of the allocated PIPs on the azure firewall?  ... View more