The setup and route config you describe all sounds right to me.
But the debug showing the ping packet coming in on the outside interface makes it seem like something is swapped somewhere.
For myself, my next step would be to double check:
- The effective route table display on the inside hosts NIC
- That Azure routing table for Inside is associated with the Inside subnet, and that the Azure routing table for outside is attached to the Outside subnet.
- The interface names, zones, IPs in FTDv
- Make sure I can ping the FTDv inside IP from an Inside host and that capture shows it entering and exiting on the inside interface.
- Make sure I can ping the FTDv outside IP from an Outside host and that capture shows it entering and exiting on the outside interface.
Azure routing will determine which FTDv interface the packet will enter on. If the ping from the inside host is truly coming in on that outside interface then I would suspect a route entry pointing to the wrong nexthop IP. Or maybe the wrong routing table attached to the wrong subnet.
In the ping debug below - it appears to be 2 sequential ICMP requests from the inside host (rather than a packet coming in and out of the outside interface).
Here's what a debug icmp trace looks like in my environment ( 12.10.4.4 is inside host, 12.10.0.51 is FTDv outside IP)
ICMP echo request from inside:12.10.4.4 to outside:8.8.8.8 ID=15388 seq=114 len=56
ICMP echo request translating inside:12.10.4.4 to outside:12.10.0.51
ICMP echo reply from outside:8.8.8.8 to inside:12.10.0.51 ID=15388 seq=114 len=56
ICMP echo reply untranslating outside:12.10.0.51 to inside:12.10.4.4
you could also try capture (ping only) - maybe on a single ping packet
cap in int inside match icmp any any
cap out int outside match icmp any any
And make sure the packets are entering and exiting on the right interfaces.
