oracle delegation subnet has issue connecting from on-prem

Sandeep kumar 0 Reputation points
2026-09-24T10:39:21.4833333+00:00

I have a oracle delegation subnet (/24) in azure under the VNET /16. The VNET is peered with VWAN hub & I am using SaaS Palo alto firewall as well. All it takes express route to go to on-Prem. I can see the route for VNET /16 in effective route on VWAN hub but unfortunately, I am not able to connect to the oracle delegated nic under the /24 network from on-prem. I am not able to see the traffic on palo alto as well.

With the VWAN hub I am using routing intent & there is no route table attached to spoke subnet. I was going through some document & see there should be specific route with routing intent on VWAN hub. I am looking for solution here with the detail document if possible. Its production and cannot go with direct change.

Azure ExpressRoute
Azure ExpressRoute

An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-24T10:40:00.84+00:00

    For Oracle delegated subnets behind Virtual WAN routing intent, the delegated subnet prefix must be added explicitly as a private traffic prefix. Seeing only the VNet /16 in the Virtual WAN effective routes is not sufficient for Oracle Database@Azure delegated subnets.

    Use this validation path before making production changes:

    1. In the Virtual WAN hub routing intent configuration, check Private Traffic Prefixes.
      • Add the exact delegated subnet CIDR for the Oracle subnet, such as x.x.x.x/24.
      • For bare-metal delegated subnets such as Oracle Database@Azure, the configuration requires the exact or more specific CIDR range to be added.
    2. If the Oracle delegated subnet is /24, do not rely on the parent VNet /16 route.
      • The required route must be equal to or more specific than the delegated subnet.
      • A broader prefix such as /16 can result in undefined behavior or asymmetric routing, and traffic might not reach the firewall.
    3. In a Virtual WAN deployment:
      • With Routing Intent: add the delegated subnet prefix to Routing Intent’s list of prefixes.
      • Without Routing Intent: add a route for the delegated subnet to the Virtual WAN route table and point next hop to the firewall/NVA.
    4. Since traffic is not visible on the Palo Alto firewall, verify the effective routes on the next-hop resource.
      • For Virtual WAN routing intent, the effective routes on the firewall/NVA show which routes Virtual WAN selected and which destinations the next hop can actually forward.
      • This helps confirm whether the Oracle delegated /24 is missing from the programmed routes.
    5. If non-RFC1918 prefixes are involved anywhere in connected networks, confirm they are also listed in Private Traffic Prefixes on every hub using routing intent. Those prefixes do not propagate automatically to other hubs.
    6. For production-safe validation:
      • First confirm the current Routing Intent configuration includes the Oracle delegated subnet prefix.
      • Then review effective routes on the Virtual WAN next-hop resource.
      • Then check Palo Alto logs after the prefix is present, to confirm traffic is now being steered for inspection.

    Key point: for Oracle delegated subnets in Virtual WAN, the delegated subnet itself must be treated specially. The /16 VNet route alone does not satisfy the routing requirement for inspection from on-premises through routing intent.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.