Virtual WAN with Site-to-Site VPN - no communication between VNET and on-premises

Question

I have implemented a Standard Virtual WAN with a Hub and attached a VNET.

Next, I implemented Site-to-Site VPN in the same Hub between Azure and OracleCloud.

The VPN tunnel and BGP status are UP, but I am not able to ping between Azure VNET and OracleCloud.

Is there any special routing or gateway required to make this communication happen?

I have attached a high-level architecture for your reference.

V_WAN.jpg

Answer 1

Hello @Arvind Bassan ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you've implemented a Standard Azure Virtual WAN with a Hub and attached a VNET and configured a Site-to-Site VPN in the same Hub between Azure and OracleCloud. The VPN tunnel and BGP status are UP, but you are unable to ping between Azure VNET and OracleCloud.

Branch-to-VNet is the primary path supported by Azure Virtual WAN. This path allows you to connect branches to Azure IAAS enterprise workloads that are deployed in Azure VNets. The traffic transits to VNets that are connected to the virtual WAN hubs via VNet Connections. Explicit gateway transit isn't required for Virtual WAN because Virtual WAN automatically enables gateway transit to branch site.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture#branch-to-vnet-a-and-branch-to-vnet-cross-region-g

Your scenario should be something similar to Any-to-Any routing as mentioned in the below article:

https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-any-to-any

So, as long as the Vnet connection and the branch are connected to the default route table and there is no address space overlap, it should work.

Could you please check if the route table is associated correctly?

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing

Additionally, you could check the below:

• Validate the Vnet connection configuration and make sure that it is associated to a route table.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/howto-connect-vnet-hub

• Validate the virtual hub effective routes to see if your hub is learning the route of your branch site.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/effective-routes-virtual-hub

• Validate the BGP dashboard to check the advertised and learned routes.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-bgp-dashboard

• If you have overlapping address spaces, then you need to configure NAT rules.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.