Azure VNET Peering with File Storage and VPN Gateway

Question

Azure VNET Peering with File Storage and VPN Gateway

Greg Thomas 121

Hi,

I have 2 VNETS - VNET-A and VNET-B.

VNET-A has our VMs in it and is peered to VNET-B which has a VPN Gateway tied to it for Azure VPN.

I can VPN fine into VNET-B but then accessing VMs via RDP is not allowed. I have configured by NSG to allow port 3389 from the IP of the VPN Gateway pool.

In addition, I have set up Azure File Storage which works fine for VNET-A, I have a private endpoint and have been granted access to that network. However for VPN, even though I have granted access to VNET-B, clients can never connect to the storage file shares?

Do I have to create another Private endpoint for those fileshares to the second VNET?

When my clients connect via VPN, I notice the IP assigned is from the VPN Address pool so they don't get a local subnet address, is this something I need to add into network configuration for the Fileshare?

Thank you.

0 comments

4 answers

Your answer

Answer 1

Greg Thomas 121

Hi Alan - both VNETS have a VPN gateway applied to them.

The VNET B has an external VPN applied to it while VNET A has a VPN back to their internal network (point to site VPN with Azure Auth) with gateway2AZ SKU.

On VNET A, they have a site-to-site VPN setup (from cloud to on-premise) that is a Gateway1 SKU.

Are we able to put both The P2S and the S2S VPNs on the one VPN Gateway or will that cause conflicts in connections? They had wanted to keep them separate.

Alan Kinane 17,361 Reputation points MVP Volunteer Moderator

2022-12-05T14:36:39.413+00:00

Ahh, that's your issue. You can only have a VPN gateway on one of the peered VNETs so yes, you should get rid of one of them. The VPN gateway can act as both a S2S and P2S gateway so there's no issues there at all. When you connect your VNETs with VNET peering or VPN connections you are effectively creating one big network anyway so everything should route through the single VPN gateway and then you can transit to different VNETs if required.

Answer 2

Greg Thomas 121

Hi Alan,

Thank you for your help with all this. Here is the configuration I have right now.

VNETB - is our internal VNET, VNETA - is our VNET setup just for Azure Client VPN.

When VPNed in, we want people to then be able to access our storage file shares and VMs (all secured to VNETB

Thanks Greg

Alan Kinane 17,361 Reputation points MVP Volunteer Moderator

2022-12-05T10:14:00.053+00:00

Thanks Greg, I'm struggling to understand what the blocker is and I'm having trouble recreating this scenario. Can you provide more details?

Are you using classic VNETs by any chance and can you confirm that you definitely do not have a VPN gateway in both VNETs?

Have you tried deleting the peers and creating again from scratch using this procedure - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit#to-add-a-peering-and-enable-transit

Any other network services deployed like NAT gateway, load balancers, route servers, firewalls etc?

Maybe see if you can enable the remote gateways via PowerShell. This will probably fail but at least you may get an error message that points to the reason why - https://learn.microsoft.com/en-us/powershell/module/az.network/set-azvirtualnetworkpeering?view=azps-9.1.0#example-4-use-remote-gateways-in-virtual-network-peering

Answer 3

Greg Thomas 1

Hi - thank you for this.

On my VNETB - Gateway Transit is enabled, but on my VNETA, I cannot change this to use "remote gateways"?

Also in Azure, VNET where would I program up these routes?

Alan Kinane 17,361 Reputation points MVP Volunteer Moderator

2022-12-01T17:07:22.047+00:00

When creating the peering you need to enable "Use the remote virtual network's gateway or Route Server" in the section for This virtual network on VNETA.

You can add custom routes to the config here: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes

or else just modify the XML file - https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations#forced-tunneling
Greg Thomas 1 Reputation point

2022-12-01T17:23:43.963+00:00

Thank you - as soon as I try to create the Peering on VNETA to point to VNETB - the option for "Use the remote virtual network's gateway or Route Server" becomes grayed out?

Is there something in the VNET configuration of VNETB which would be causing this? In VNETB we have a VPN Gateway setup for users to VPN in with?
Alan Kinane 17,361 Reputation points MVP Volunteer Moderator

2022-12-02T09:47:18.237+00:00

Hi Greg, at what point does it grey out? You have to configure all of the settings for both peers so once you select the remote VNET that you want to peer with then option should become available.

Try this. Start the "Add peering" wizard and first of all select the remote virtual network. Then this should let you choose to 'Use this virtual network's gateway or Route Server' again in the remote network section. Then in the section near the top for 'This Virtual Network' you should now be able to choose 'Use the remote virtual network's gateway or Route Server'.

If not, then there is an issue with the VNET configs. Do you have a virtual network gateway on both VNETs for example or just on VNETB?

If you still have issues, then you might screenshot the full VNET peering configuration and display it here.
'

Answer 4

This is most likely a routing issue.

The P2S configuration for your VPN client must contain the address space of both of your VNETs in order for routing to work. You also need to make sure that "Allow gateway transit" is enabled on your VNET-B peer and "Use remote gateways" is enabled on your VNET-A peer.

Have a look at this diagram which explains this well. Also, make sure to download your P2S VPN client configuration from the portal again after making any changes, this needs to be re-imported to your devices.

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered

Share via

Azure VNET Peering with File Storage and VPN Gateway

4 answers

Your answer