In Day 6 of my Palo Alto VM-Series deployment on Azure, I focus on one core thing: how traffic flow works in Azure cloud before we even start forcing traffic through the firewall. We already understood the subnet structure and reserved IP behavior, so in this video I move to the deployment part—creating a DB server (Ubuntu) and a web server (Windows) inside their dedicated subnets using the Azure Portal. The goal is simple: build the lab topology first, then in the next step we’ll change routing so DB-to-web and internet traffic must traverse the Palo Alto. I also boot up the Palo Alto firewall and log in through HTTPS to confirm the device is up and accessible. Then I explain the three firewall-related subnets and how they map to Palo Alto interfaces—management subnet (10.1.2.0/24) plus two dataplane subnets (like 10.1.3.0/24 and 10.1.4.0/24). The key takeaway is: by default, Azure allows backend VNet communication, so DB and web can talk directly (ping works) even without UDRs. In the next video, I’ll show you how to use custom routes (UDRs) so both east-west and north-south traffic is forced through the Palo Alto firewall.