Site to Site (S2S) VPN from On-premises to Azure issue

keith li 51

Dear All,

I have a question regarding on Azure, i recently create a Site to Site (S2S) VPN from On-premises to Azure, and on-premise window server using RRAS connect to Azure VPN gateway, and my on-premises network could ping all VM at Azure, but when i try to ping from Azure VM to on-premise, i only can ping the RRAS server, the rest i couldn't ping, below are the trace route and ping result, when i do trace route i see the next hop showing 169.254.0.26, just wonder if i can create any routing from his IP ? any help would be appreicated

192.168.1.70 is the RRAS in on-premise

192.168.1.69 DC in on-premise

C:\Users\piaakit>tracert 192.168.1.70

Tracing route to 192.168.1.70 over a maximum of 30 hops

1 8 ms 8 ms 7 ms 169.254.0.26

2 8 ms 59 ms 8 ms 192.168.1.70

Trace complete.

C:\Users\piaakit>tracert 192.168.1.69

Tracing route to 192.168.1.69 over a maximum of 30 hops

1 7 ms 7 ms 7 ms 169.254.0.26

2 * * * Request timed out.

3 * * ^C

C:\Users\piaakit>

C:\Users\piaakit>ipconfig/all

Windows IP Configuration

Host Name . . . . . . . . . . . . : azure-exchange

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : mhkx545smckezp3xukddpmsyqg.hx.internal.cloudapp.net

Ethernet adapter Ethernet 3:

Connection-specific DNS Suffix . : mhkx545smckezp3xukddpmsyqg.hx.internal.cloudapp.net

Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #3

Physical Address. . . . . . . . . : 00-0D-3A-82-5C-78

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::8bfe:47e7:5cb0:c04e%2(Preferred)

IPv4 Address. . . . . . . . . . . : 192.168.111.90(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Friday, June 7, 2024 6:06:16 PM

Lease Expires . . . . . . . . . . : Tuesday, July 15, 2160 12:42:10 AM

Default Gateway . . . . . . . . . : 192.168.111.1

DHCP Server . . . . . . . . . . . : 168.63.xxx.xx

DHCPv6 IAID . . . . . . . . . . . : 285216058

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-F3-5A-73-60-45-BD-57-AB-66

DNS Servers . . . . . . . . . . . : 168.63.xxx.xx

NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\piaakit>

Best Regards,

Keith

Luis Arias 5,981 Reputation points

2024-06-07T16:19:24.1733333+00:00
Hi keith li,

Based on your configuration:

On-Premises Network ------------------- +--------------+ +--------------+ +--------------+ | | | | | | | On-Premises |------| RRAS |-------| On-Premises | | DC | | Server | | Devices | |(192.168.1.69)| |(192.168.1.70)| | (192.168.1.x)| | | | | | | +--------------+ +--------------+ +--------------+ | | VPN | | v Azure Network ------------- +---------------+ +------------+ | | | | | Azure VMs |---------| Azure VPN | |(192.168.111.x)| | Gateway | | | | | +---------------+ +------------+

You can ping all Onprem VMs to Azure VMs However you cannot ping on-premises devices from Azure VMs, there are many possible point of that communication block so you can check:

Check Routing Table on Azure: Ensure that the route table in Azure includes a route for the on-premises network with the VPN gateway as the next hop. Verify that the address range for your on-premises network is correctly defined in Azure's route table. How to: Select Azure VM > Network settings> Network interface > Effective routes

Network Security Groups (NSGs) and Firewalls: verify that the Network Security Groups (NSGs) attached to your Azure VMs' subnets or NICs allow inbound ICMP traffic from the on-premises network. How to: Select Azure VM > Network settings> Network interface > Effective security rules

RRAS Server Configuration:

Verify that the RRAS server is configured to route traffic to and from the on-premises network and the Azure network. Ensure that routing is enabled and properly configured on the RRAS server.

Make sure that IP forwarding is enabled on the RRAS server so it can forward packets between the Azure network and other on-premises devices.

Check for Asymmetric Routing:

Asymmetric routing can occur when the return path from the on-premises network to Azure is different from the forward path. Ensure that both forward and return paths are correctly set up and symmetrical.

RRAS Server Firewall:

Check the Windows Firewall on the RRAS server and ensure it allows traffic to the entire on-premises network and not just the RRAS server itself.

Check if there are any firewalls (either on-premises or within Azure) that might be blocking the ICMP traffic from Azure to your on-premises network.

Additional reference:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-disconnected-intermittently

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect

If the information helped address your question, please Accept the answer.

Luis
keith li 51 Reputation points

2024-06-09T19:28:33.11+00:00

thanks for your reply in details, and i have checked and below is the reply,

1.) Routing Table on Azure

the next hop is 192.168.112.5

Virtual network gateway Active 192.168.1.0/24 Virtual network gateway 192.168.112.5

2.) Network Security Groups (NSGs) and Firewalls:

checked all the vm at azure has ICMP allowed as inbound security from source any,

3.) RRAS Server Configuration:

feature lan routing has enabled on the RRAS server, everything on on-premise could reach VM Azure but not from azure to on-premise

4.) RRAS Server Firewall:

i have only restricted ICMP from l2tp vpn ip range, and all vm at azure could ping the RRAS server but not the rest of the on-premises devices

keith
KapilAnanth-MSFT 40,996 Reputation points Microsoft Employee

2024-06-11T12:00:04.2133333+00:00
@keith li ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are configuring Azure VPN Gateway and RRAS as OnPrem device.

Looking at your configuration and routing, VPN Gateway side looks good.

From RRAS Side,

Can you confirm if packets destined to OnPrem servers are actually being received in the RRAS Server? (packets to other OnPrem servers)

You can check this with a packet capture

The IP "169.254.0.26" is part of APIPA Range

And I don't think this is coming from Azure, because Azure only supports Azure-reserved APIPA address range, which is from 169.254.21.0 to 169.254.22.255.

See : VPN Gateway APIPA

I believe the APIPA is configured on your RRAS Server.

And the hop shown in tracert indicates that the packet actually reached the OnPrem RRAS Server APIPA.

Can you confirm if you are using APIPA?

If so, is there any requirement to use it?

You can follow these 2 documents for further troubleshooting,

Troubleshoot a hybrid VPN connection

Let's Configure Azure Site-to-Site VPN with RRAS in Azure Resource Manager

Cheers,

Kapil
keith li 51 Reputation points

2024-06-13T09:18:33.4033333+00:00
Hi Kapil,

thank you for your reply, i will check the following and come back to you

From RRAS Side,

Can you confirm if packets destined to OnPrem servers are actually being received in the RRAS Server? (packets to other OnPrem servers)

You can check this with a packet capture

i'm not familiar with using packet capture tool, i can kindly use wireshake to capcture the RRAS server interface in order to find out ?

The IP "169.254.0.26" is part of APIPA Range

i will need to check what is APIPA range on RRAS

keith
keith li 51 Reputation points

2024-06-13T09:25:21.45+00:00
Hi Kapil,

Thank you for your reply

From RRAS Side,

Can you confirm if packets destined to OnPrem servers are actually being received in the RRAS Server? (packets to other OnPrem servers)

You can check this with a packet capture

i'm not familiar with using packet capture, is it i can use wireshake to capture the RRAS server interface will do ?

The IP "169.254.0.26" is part of APIPA Range

i will need to check if RRAS server has APIPA configured

keith
KapilAnanth-MSFT 40,996 Reputation points Microsoft Employee

2024-06-14T10:00:30.5+00:00

@keith li ,

Yes. Wireshark packet capture should give you more insights.

You should see TCP/ISP packets and ESP packets coming in.

Cheers,

Kapil

Share via

Site to Site (S2S) VPN from On-premises to Azure issue