Hello friends—this is Day 7 of my Palo Alto on Azure cloud series. In this video I focus on one of the most important basics: how connectivity actually works inside an Azure VNET, and why you can ping between two different subnets (like my Web VM and DB VM) even if you didn’t configure any router from your side. I show you with a simple lab: Web (192.168.1.4) can directly ping DB (192.168.2.4) because Azure has its own internal L3 routing in the backend, and cloud providers never expose that internal network design. Next, I show you how to make IP addresses static in Azure, because by default VM private IPs are dynamic and after reboot you can get surprises. I go into the Azure Portal, open the NIC IP configurations, and change private IP assignment to Static for my Web VM, DB VM, and all three Palo Alto interfaces (management, untrust, trust). After that, I explain why VMs can reach the internet “directly” through Azure’s default path (example: ping 8.8.8.8 works), but in our target design we don’t want that shortcut. We want traffic to be routed via the Palo Alto firewall, so later we can control it with policies, NAT, and security rules. Finally, I configure the Palo Alto interfaces (L3), create trust/untrust zones, assign the correct /24 IPs, and commit—also showing a common mistake when you accidentally use the same subnet on both interfaces.