
It's Not DNS, It's Not the Firewall — It's vWAN: The Private Endpoint Asymmetric Routing Trap
An AWS VM behind a Transit Gateway can't reach an Azure Storage private endpoint over ExpressRoute. DNS is fine. The firewall has an any-any rule. The real culprit? Virtual WAN Routing Intent silently bypassing your firewall for Private Endpoint traffic — and causing asymmetric routing.

