I have an application running on the VM under the spoke 1 vnet Vm’s from the on-prem network is tryinig to access this application. On-prem Network and the Hub network has an ipsec site-site tunnel established and the HUB network and the spoke network is peered over vnet peering.

Traffic from the onprem network flows through the Ipsec tunnel reaches the hub network goes through the azure firewall and then reaches the spoke newtwork. In this scenario when the traffic from the onprem reaches the destination server on the spoke network the source IP gets changed to the Azure firewalls IP because Azure firewall does a SANT on every traffic entering it.

Our requirement is to preserve the Source IP even when the traffic flows through the azure firewall and then reach the destination server. we should be able to see the source server Ip in the logs of the destination server application in the spoke 1 network.

the expectation is to preserve the source Ip address