How to see traffic to an Azure NAT Gateway

Question

How to see traffic to an Azure NAT Gateway

Dwight Thompson 30

I recently deployed an Azure NAT Gateway with NVA (Palo Firewall). Since that outbund traffic does not go through the NVA for Internet access now, how to do I see the outbound traffic?

0 comments

3 answers

Your answer

Answer 1

Use Azure monitoring on the NAT gateway and its virtual network instead of the NVA to see outbound traffic.

For a Standard NAT Gateway:

Enable Virtual network (VNet) flow logs on the subnet’s virtual network via Azure Network Watcher.
Send the logs to a Log Analytics workspace.
Use Log Analytics queries to inspect outbound flows (source private IP/port, destination IP/port, direction, bytes/packets, connection state).
- Note: VNet flow logs show the VM private IPs, not which NAT gateway public IP was used.

For a StandardV2 NAT Gateway (recommended for deeper visibility):

On the NAT gateway resource, configure Diagnostic settings and enable the NatGatewayFlowLogsV1 resource log category.
Send these logs to a Log Analytics workspace, storage account, or Event Hub.
Use the NAT gateway flow logs to see IP-level traffic flowing through the NAT gateway (who is talking to what on the internet, and how much).

Additional monitoring:

Use NAT gateway metrics (Bytes, Packets, Dropped Packets, SNAT Connection Count) in Azure Monitor to see volume and health of outbound traffic.
Use Bytes/Packets metrics filtered by Direction=Out to understand outbound load and verify that traffic is indeed going through the NAT gateway.

Because internet-bound traffic is no longer traversing the NVA, all visibility must come from:

VNet flow logs (per-subnet/VM view), and/or
StandardV2 NAT gateway flow logs (per-NAT gateway view), plus
NAT gateway metrics for volume and drops.

References:

Answer 2

Hello @Dwight Thompson,

Thank you for reaching out to Microsoft Q&A.

Since Azure NAT Gateway SNATs your outbound traffic directly to the internet (bypassing your Palo firewall), you won’t see that traffic in the NVA’s logs. Instead, you can use Azure’s built-in monitoring and flow‐logging features:

(If you’re on StandardV2 NAT Gateway) Turn on NAT Gateway flow logs

• Open your NAT Gateway resource → Diagnostic settings → Add diagnostic setting

• Check NatGatewayFlowLogs and send to Log Analytics

• In Log Analytics you’ll get a NatGatewayFlowLogsV1 table with fields like SourceIp, DestIp, NatGatewayIp, BytesSent/BytesReceived, etc.

Use Azure Monitor metrics and Network Insights

• Browse Metrics or the built-in Network Insights on your NAT Gateway resource

• You can chart metrics like Bytes, Packets, Dropped Packets and SNAT Connection Count over time or set alerts

Please follow the document below for any SKU to enable logging, which will help you monitor and verify the traffic.

Have you configured the UDR? if not please try to follow the below steps and document to create UDR.

Reference: for enable the logs
https://learn.microsoft.com/en-us/azure/nat-gateway/monitor-nat-gateway-flow-logs#enable-diagnostic-settings-to-collect-nat-gateway-flow-logs
https://learn.microsoft.com/en-us/azure/nat-gateway/troubleshoot-nat#how-to-analyze-outbound-connectivity
https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-design#monitor-outbound-network-traffic-with-vnet-flow-logs

If the answer is helpful, please click "Accept Answer". If you have extra questions about this answer, please click "Comment".

Answer 3

Hello Dwight Thompson

It appears that your outbound traffic is now routed directly through the Azure NAT Gateway instead of the Palo NVA. To view these flows, you'll need to enable logging on either the NAT Gateway or the subnet.

Here are the main ways to get visibility:

Enable VNet flow logs on the subnet

In Azure Network Watcher go to “NSG flow logs” (even if you don’t have an NSG, you can still turn on flow logs for the subnet).Send the logs to a Log Analytics workspace.
In Log Analytics you’ll see records of private-IP -> destination-IP flows, with bytes and packet counts.
Note: Standard NAT only shows your VM’s private IPs (it won’t tell you which public IP the NAT gateway SNATed to).

(If you’re on StandardV2 SKU) Turn on NAT Gateway flow logs.

Go to your NAT gateway resource > Diagnostic settings > Add diagnostic setting
Select the “NatGatewayFlowLogs” category and send to Log Analytics (or storage/Event Hub)
You’ll get a table called NatGatewayFlowLogsV1 with fields like SourceIp, DestinationIp, NatGatewayIp, BytesSent, BytesReceived, etc.
Query with Kusto in your workspace to see exactly which VM hit what public IP and how much data passed.

Use Azure Monitor metrics/Insights for a quick dashboard

In the NAT gateway resource, click “Metrics” or open Network Insights in Azure Monitor.
Review metrics such as Bytes, Packets, DroppedPackets, SNAT Connection Count (Attempted/Failed), Total SNAT Connection Count
You can chart volume trends or set alerts on abnormal drops or SNAT port exhaustion.

Putting it all together, a typical setup to see outbound traffic is:

Enable VNet flow logs on your subnet (for VM-level flows)
Enable NAT Gateway flow logs (for public IP mapping and SNAT-level details)
Ingest both into a Log Analytics workspace
Build Kusto queries or dashboards combining both — e.g. group by SourceIp, NatGatewayIp, DestinationIp

NOTE: To see outbound traffic, enable NAT Gateway flow logs (NatGatewayFlowLogsV1) and analyze them in Azure Monitor / Log Analytics.

MS Docs:

Design virtual networks with Azure NAT Gateway – Monitor outbound network traffic with VNet flow logs

How to Monitor Azure NAT Gateway – built-in metrics & Network Insights

Hope that points you in the right direction!

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" and click "Accept Answer" which may be beneficial to other community members reading this thread.