Azure vTAP captures only one direction of traffic when NAT Gateway is used

Question

Azure vTAP captures only one direction of traffic when NAT Gateway is used

Bigfour 0

We are running a POC using Azure Virtual Network TAP to mirror traffic from a VM NIC to an NDR sensor.

Observed behaviour:

When the VM uses a directly assigned Public IP, the sensor receives bidirectional TCP traffic.

When the same VM uses an Azure NAT Gateway for internet access, the sensor receives only one direction of the TCP session.

The application connection itself is successful.

Packet capture on the source VM confirms that both outbound and return traffic reach the VM.

The VM, NIC, vTAP configuration, destination sensor, test traffic, and security rules remain unchanged. The only change is the outbound connectivity method.

Architecture:

VM NIC with vTAP → Azure Firewall, if applicable → NAT Gateway → Internet

Please confirm:

Is Azure vTAP expected to mirror both outbound and return traffic when the source VM uses NAT Gateway?
Are there any known limitations involving vTAP, NAT Gateway, SNAT, accelerated networking, or the Azure fast path?
Would placing Azure Firewall between the VM subnet and NAT Gateway change the vTAP mirroring behaviour?
Is this a known issue or expected platform behaviour?
Are there any recommended configuration changes or supported workarounds?

Mythreya Asnala 0 Reputation points Microsoft External Staff Moderator

2026-07-20T17:04:32.5866667+00:00
Hi @Bigfour

Based on the documentation reviewed, I could not find any information that explicitly confirms whether Azure Virtual Network TAP (vTAP) should mirror both directions of TCP traffic when a VM's outbound connectivity is using an Azure NAT Gateway. Likewise, I did not find any documented vTAP limitations specific to NAT Gateway, SNAT, accelerated networking, or fast path behavior that would explain why traffic is only being mirrored in one direction.

What the documentation confirms about vTAP

Virtual Network TAP supports only VM network interfaces as mirroring sources.

Mirrored traffic can be sent only to a load balancer or a VM network interface.

There are several documented limitations, such as lack of support for IPv6, encrypted VNets, and certain other scenarios.

During preview, a VM may need to be deallocated and restarted after vTAP deployment to ensure the NIC is operating in fast path mode.

Since mirroring is working when the VM uses a direct public IP, it appears that the basic vTAP configuration is functioning as expected.

NAT Gateway considerations

The NAT Gateway documentation explains that outbound traffic is translated using Source NAT (SNAT), where the private source IP and port are mapped to a public IP and port. NAT Gateway can also reuse SNAT ports under certain conditions.

While this changes how connections appear from different points in the network path, the documentation does not indicate that NAT Gateway should affect vTAP's ability to mirror traffic in both directions.

Azure Firewall scenario

I also reviewed the available documentation to determine whether placing an Azure Firewall between the VM subnet and the NAT Gateway would affect vTAP mirroring. I did not find any information confirming that Azure Firewall would alter vTAP behavior in this scenario.

Additional troubleshooting recommendations

Although the documentation does not directly address the mirroring issue, the following checks may help narrow down the cause:

Establish new TCP sessions instead of reusing existing connections.

Restart the VM to ensure new connections are established through the NAT Gateway.

Verify that no User Defined Routes (UDRs) or NSG rules are affecting the traffic path.

Confirm that VXLAN traffic (UDP port 4789), which vTAP uses for mirrored packets, is reaching the destination correctly.

Review NAT Gateway flow logs (if enabled) to verify that the outbound and return traffic is being processed successfully during testing.

could you please provide the information for below questions:

Is the NAT Gateway deployment using Standard or Standard v2?

When you say only one direction is visible, are you seeing:

Outbound packets only, with no return traffic, or

Return traffic only, with no outbound packets?

Is the vTAP destination configuration identical in both scenarios (direct public IP versus NAT Gateway)?

Are there any UDRs, NSGs, or routing differences between the working and non-working setups?

Are you testing with new TCP sessions each time, or long-lived existing connections?

Can you confirm that UDP port 4789 is reachable to the monitoring appliance in both scenarios?

Was the VM restarted after configuring vTAP to satisfy the fast path requirement?

If NAT Gateway flow logs are enabled, do they show successful flows for the same traffic that appears incomplete in the mirrored capture?

At this stage, the available documentation does not indicate that one-way mirroring is expected behavior when using NAT Gateway. Additional configuration details and packet captures will likely be required to determine whether this is a configuration-specific issue or a platform-related concern.

Please refer to the below documentation links:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview

https://learn.microsoft.com/en-us/troubleshoot/azure/nat-gateway/troubleshoot-nat-connectivity

https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat
Mythreya Asnala 0 Reputation points Microsoft External Staff Moderator

2026-08-24T06:05:43.5733333+00:00

Hi Bigfour,

I wanted to follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.
Bigfour 0 Reputation points

2026-08-24T06:16:15.42+00:00

Hi @Mythreya Asnala @Sina Salam , I reached out internally to Microsoft Enterprise Support. Pre-liminary investigation was performed and now some actions are pending from Microsoft team.

1 answer

Your answer

Mythreya Asnala 0 Reputation points Microsoft External Staff Moderator

2026-08-24T06:05:43.5733333+00:00

Hi Bigfour,

I wanted to follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.
Bigfour 0 Reputation points

2026-08-24T06:16:15.42+00:00

Hi @Mythreya Asnala @Sina Salam , I reached out internally to Microsoft Enterprise Support. Pre-liminary investigation was performed and now some actions are pending from Microsoft team.

Answer 1

Hello Yong Heng Khor (NCS),

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your Azure vTAP captures only one direction of traffic when NAT Gateway is used.

Since the VM, NIC, vTAP configuration, monitoring appliance, workload, and security configuration remain unchanged, and only the outbound connectivity method changed, the evidence points toward an undocumented Azure Networking platform behavior or potential platform issue rather than a configuration problem. There is also no documented evidence that placing Azure Firewall between the VM subnet and NAT Gateway changes Virtual Network TAP mirroring behavior, and Microsoft does not identify Azure Firewall as a supported workaround for this scenario.

What you can do is to collect synchronized packet captures from both the source VM and the monitoring appliance, verify that bidirectional traffic reaches the VM while only one direction is mirrored, and since PCS is already on this, I will suggest you channel your case for Azure Networking Product Group investigation. Include the packet captures, UTC timestamps, Subscription ID, Region, VM NIC Resource ID, Virtual Network TAP Resource ID, and NAT Gateway Resource ID to enable backend validation of the Azure SDN datapath. This is currently the only reliable path to determine whether the behavior is an undocumented platform limitation or a product defect, as no documented configuration change resolves this scenario.

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Azure vTAP captures only one direction of traffic when NAT Gateway is used

What the documentation confirms about vTAP

NAT Gateway considerations

Azure Firewall scenario

Additional troubleshooting recommendations

could you please provide the information for below questions:

1 answer

Your answer