Edit

Windows activation fails in forced tunneling scenario

Applies to: ✔️ Windows VMs

Summary

This article describes how to resolve the KMS activation problem that you might experience when you enable forced tunneling in site-to-site VPN connection or ExpressRoute scenarios.

Important

If you're experiencing Azure virtual machine (VM) Windows activation issues, see Troubleshooting tools for Windows activation issues on Azure virtual machines.

Symptom

You enable forced tunneling on Azure virtual network subnets to direct all Internet-bound traffic back to your on-premises network. In this scenario, the Azure virtual machines (VMs) that run Windows fail to activate Windows.

Cause

The Azure Windows VMs need to connect to the Azure KMS server for Windows activation. The activation requires that the activation request come from an Azure public IP address. In the forced tunneling scenario, the activation fails because the activation request comes from your on-premises network instead of from an Azure public IP address.

Solution

To resolve this problem, use the Azure custom route to route activation traffic to the Azure KMS server.

The first DNS name of the KMS server for the Azure Global cloud is azkms.core.windows.net with two IP addresses: 20.118.99.224 and 40.83.235.53. The second DNS name of the KMS server for the Azure Global cloud is kms.core.windows.net, which now resolves to 20.118.99.224. If you use other Azure platforms such as Azure Germany, you must use the IP address of the corresponding KMS server. For more information, see the following table:

Platform KMS DNS KMS IP
Azure Global azkms.core.windows.net
kms.core.windows.net		 20.118.99.224, 40.83.235.53
Azure Germany kms.core.cloudapi.de 51.4.143.248
Azure US Government kms.core.usgovcloudapi.net
azkms.core.usgovcloudapi.net		 23.97.0.13
52.126.105.2
Azure China 21Vianet azkms.core.chinacloudapi.cn
kms.core.chinacloudapi.cn		 159.27.28.100, 163.228.64.161
42.159.7.249

Note

Add both IP addresses for the Azure Global cloud, all three IP addresses for Azure China, and the two IP addresses for Azure US Government to the custom route.

Note

The IP address 23.102.135.246 was previously used by kms.core.windows.net for the Azure Global cloud. As of March 1, 2023, kms.core.windows.net resolves to 20.118.99.224, and 23.102.135.246 is no longer used. If you previously added 23.102.135.246 to a custom route, you can remove it. For more information, see Windows activation stopped working in Azure.

To add the custom route, follow these steps:

For Resource Manager VMs

Note

Activation uses public IP addresses and Standard SKU Load Balancer configuration affects activation. To learn about the requirements, review Outbound connections in Azure.

  1. Open Azure PowerShell, and then sign in to your Azure subscription.

  2. Run the following commands:

    # First, get the virtual network that hosts the VMs that have activation problems. In this case, we get virtual network ArmVNet-DM in Resource Group ArmVNet-DM:
$vnet = Get-AzVirtualNetwork -ResourceGroupName "ArmVNet-DM" -Name "ArmVNet-DM"

# Next, create a route table:
$RouteTable = New-AzRouteTable -Name "ArmVNet-DM-KmsDirectRoute" -ResourceGroupName "ArmVNet-DM" -Location "centralus"

# Next, configure the route table:
Add-AzRouteConfig -Name "DirectRouteToAZKMS01" -AddressPrefix 20.118.99.224/32 -NextHopType Internet -RouteTable $RouteTable
Add-AzRouteConfig -Name "DirectRouteToAZKMS02" -AddressPrefix 40.83.235.53/32 -NextHopType Internet -RouteTable $RouteTable

Set-AzRouteTable -RouteTable $RouteTable

# Next, attach the route table to the subnet that hosts the VMs:
Set-AzVirtualNetworkSubnetConfig -Name "Subnet01" -VirtualNetwork $vnet -AddressPrefix "10.0.0.0/24" -RouteTable $RouteTable

Set-AzVirtualNetwork -VirtualNetwork $vnet

  3. Go to the VM that has activation problems. Use PsPing to test if it can reach the KMS server:

    psping kms.core.windows.net:1688
psping azkms.core.windows.net:1688

  4. Try to activate Windows, and see if the problem is resolved.

Next steps

  • Last updated on