I have 2 VNETs - one classic and one ARM. Both VNETs are connected to different onprem VPN devices in our network. Whenever I'm onprem, I try to connect to a resource in these VNETs using its public IP and the connection fails.
I figured out the issue is occurring when the Local Site address space is configured for our primary IP block, a /16 public IP address space. That's right! Everybody in my org gets a public class B (but we are firewalled).
When I remove the XXX.XXX.0.0/16 from the local site address space, public IP connections are established immediately.
My thought is since our onprem firewall's public IP is in the space, Azure doesn't know how to route properly when it sees me trying to access a resource through it via an Azure Public IP.
Is there a solution out there, which will allow me to list the /16 block in local site config and connect from onprem to public Azure IPs? Or am I doomed to breakup the /16 to not include my web firewall's public IP address space?