If the default GW on VMs in a Virtual Network is x.x.x.1 and the DHCP of the internal port of the Firebox Cloud is a different IP (DHCP), how does outbound traffic from the VMs, or VPN return traffic, find its way to the firebox to the S2S VPN?
Scratch that.... Found it
But its not in http://www.watchguard.com/help/docs/fireware/12/en-US/Firebox-Cloud_Deployment-Guide.pdf
Its in the AWS section, but not in the Azure section. For anyone looking, its in Virtual Networks > Subnets > Default > Route Table. Set it to the Firebox one that was created at deployment.