I have set up hub and 2 spokes using Azure Firewall to route traffic from spoke to spoke. I have set correct route to allow all to all this is the only firewall rule I have In both subnet I have set default route rule to Azure Firewall IP there are no NSGs assigned to subnet nor the network interface Hub is peered with spokes: Was testing the setup connecting to 1 vm in spoke vnet and ping to vm in the other spoke but I have got no response. I am able to ping in the same vnet so OS firewall is not the case. I was also tried to do connection troubleshoot tool but it ends with status unreachable. Supposed to work: should be able to ping spoke to spoke via azure firewall in hub

Managed to fix it myself by enabling "Traffic forwarded from remote virtual network" on peerings setting hub<--->spoke.

Not able to ping vm to vm in hub spoke with azure firewall

Piotr Szustakowski 0

I have set up hub and 2 spokes using Azure Firewall to route traffic from spoke to spoke. I have set correct route to allow all to all

User's image

this is the only firewall rule I have

In both subnet I have set default route rule to Azure Firewall IP

User's image

there are no NSGs assigned to subnet nor the network interface

Hub is peered with spokes:

User's image

Was testing the setup connecting to 1 vm in spoke vnet and ping to vm in the other spoke but I have got no response.

I am able to ping in the same vnet so OS firewall is not the case.

I was also tried to do connection troubleshoot tool but it ends with status unreachable.

User's image

Supposed to work: should be able to ping spoke to spoke via azure firewall in hub

KapilAnanth-MSFT 35,591 Reputation points Microsoft Employee

2023-02-06T02:56:33.4866667+00:00
@Piotr Szustakowski

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing issues with Spoke-to-Spoke Transit via Azure Firewall.

If you have Azure Firewall logs enabled, can you please check if the traffic from Spoke1 to Spoke2 was allowed?

I see you have mentioned you can ping resources in same VNet.
Can you please check if Spoke1 is reachable/pingable from a VM in Hub?

In the route table, I see you have specified 0.0.0.0/0
Can you please use the exact range of Spoke1 and Spoke2 VNets (for testing purpose)

Awaiting your update.

Cheers,

Kapil
Piotr Szustakowski 0 Reputation points

2023-02-06T10:00:49.0066667+00:00
Hello,

I can see in Azure firewall logs action Allow for this traffic

Yes I am able to ping from hub vnet
tested ping from vm shell as well

Changed firewall rule to
still not able to ping vms
KapilAnanth-MSFT 35,591 Reputation points Microsoft Employee

2023-02-06T10:08:34.6866667+00:00
@Piotr Szustakowski

Thanks for the update.

I was suggesting to change the address range in the Route Table.

Instead of using 0.0.0.0/0, is it possible if you can use 10.200.0.0/22 and 10.100.0.0/22?

If you ping from Spoke2 to Spoke1, is it getting logged in the Firewall logs?

You can also check the Effective Routes of Spoke1 and Spoke2 VMs from the Portal and make sure they are pointing to Azure Firewall please?
Refer: Virtual machine network routing problem

I am trying to make sure there was no asymmetric routing in place for return traffic (i.e, routing issue from Spoke2 to Spoke1)

Cheers,

Kapil
Piotr Szustakowski 0 Reputation points

2023-02-06T10:28:22.29+00:00

Update for 3rd pioint:

I have also changed route tables attached to subnet in both spokes for testing purpose accordinly

spoke1 vnet

spoke2_via_hub 10.200.0.0/22 Virtual appliance 10.0.3.4

spoke2 vnet

spoke1_via_hub 10.100.0.0/22 Virtual appliance 10.0.3.4

It has same effect, not able to reach spoke to spoke vms
Piotr Szustakowski 0 Reputation points

2023-02-06T11:03:09.86+00:00
If you ping from Spoke2 to Spoke1, is it getting logged in the Firewall logs yes,

You can also check the Effective Routes of Spoke1 and Spoke2 VMs from the Portal and make sure they are pointing to Azure Firewall please?

here are the results
spoke1
image hidden

spoke2
image hidden
KapilAnanth-MSFT 35,591 Reputation points Microsoft Employee

2023-02-08T07:14:12.7+00:00

@Piotr Szustakowski

To troubleshoot further, I think we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue. If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

In case you need a one-time free technical support could you please send an email to Azcommunity[At]Microsoft[Dot]Com with the below details.

Subject : Attn Kaananth | Not able to ping vm to vm in hub spoke with azure firewall

Thread URL: Link to this thread

Subscription ID : Subscription ID of the Firewall

Cheers,

Kapil


spoke2_via_hub	10.200.0.0/22	Virtual appliance	10.0.3.4


spoke1_via_hub	10.100.0.0/22	Virtual appliance	10.0.3.4

1 answer

Piotr Szustakowski 0 Reputation points

2023-02-21T21:03:13.6333333+00:00

Managed to fix it myself by enabling "Traffic forwarded from remote virtual network" on peerings setting hub<--->spoke.
Please sign in to rate this answer.
KapilAnanth-MSFT 35,591 Reputation points Microsoft Employee

2023-02-23T16:08:05.1833333+00:00

@Piotr Szustakowski

Glad the issue has been resolved now.

Cheers,

Kapil

Mundra Ji 0 Reputation points

2023-07-23T06:02:00.8833333+00:00

Hey Piotr, how you have solved this issue, I have same problem & tried all above suggestions. Kindly revert with the way you have opted.

Thank you

KapilAnanth-MSFT 35,591 Reputation points Microsoft Employee

2023-07-25T04:03:10.7133333+00:00

@Piotr Szustakowski @Piotr Szustakowski @Piotr Szustakowski Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#create-a-peering

Cheers,

Kapil
Sign in to comment