I'm sure that it's a very obvious problem, but I cannot see it. My configuration: Azure Virtual Network Gateway custom selectors: Local address range: 10.20.53.0/25 Remote address range: 10.20.53.128/25 S2S-connection with status: Connected => I assume that the all connection parameters are ok and the gateways should work as expected Gateway Subnet: 10.20.53.32/27 Test-VM NIC in same VNET, but additional subnet: 10.20.53.112/28 ping to 8.8.8.8 => Success route 0.0.0.0 MASK 0.0.0.0 gateway: 10.20.53.113 interface 10.20.53.116 http-connection to 10.20.53.100 (application gateway) => ok ping 10.20.53.150 (on-prem-server) => timeout http-connection to 10.20.53.150 (on-prem-server) => timeout tracert 10.20.53.150 => all "Request timed out" without showing any IP addresses Do I need to "tell" my VM to use the VPN gateway for 10.20.53.128/25 addresses? If so: how?

@Sven Erik Matzen Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are facing connectivity issues between OnPrem server and a Azure VM via S2S Connection I suggested you to, Can you check the VM's effective route and see if 10.20.53.128/25 route is pointing towards Azure VPN Gateway? Here Please make sure the NSGs and local firewalls allow and support ICMP ping. You can also test the same using TCP Pings (use RDP Ports) Later, you informed it was a Traffic Selector MisMatch (typo in address range). Fixing this, resolved the issue. Thanks, Kapil Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

Azure Virtual Network Gateway connected, but ping fails

Sven Erik Matzen 86

I'm sure that it's a very obvious problem, but I cannot see it.

My configuration:

Azure Virtual Network Gateway
- custom selectors:
  - Local address range: 10.20.53.0/25
  - Remote address range: 10.20.53.128/25
- S2S-connection with status: Connected => I assume that the all connection parameters are ok and the gateways should work as expected
- Gateway Subnet: 10.20.53.32/27
Test-VM
- NIC in same VNET, but additional subnet: 10.20.53.112/28
- ping to 8.8.8.8 => Success
- route 0.0.0.0 MASK 0.0.0.0 gateway: 10.20.53.113 interface 10.20.53.116
- http-connection to 10.20.53.100 (application gateway) => ok
- ping 10.20.53.150 (on-prem-server) => timeout
- http-connection to 10.20.53.150 (on-prem-server) => timeout
- tracert 10.20.53.150 => all "Request timed out" without showing any IP addresses

Do I need to "tell" my VM to use the VPN gateway for 10.20.53.128/25 addresses? If so: how?

KapilAnanth-MSFT 47,121 Reputation points Microsoft Employee

2023-02-23T13:11:31.9933333+00:00
@Sven Erik Matzen

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing connectivity issues between OnPrem server and a Azure VM via S2S Connection

Per your verbatim, I see that

The VM's IP is 10.20.53.116

The OnPrem server IP is 10.20.53.150

The VNet's address range is 10.20.53.0/25 - Let me know if this is incorrect

Now,

Did you manually add a route, "route 0.0.0.0 MASK 0.0.0.0 gateway: 10.20.53.113 interface 10.20.53.116" ?

Is the VM having multiple NICs or IPs? If so, are you testing this using primary NIC or not?

Can you check the VM's effective route and see if 10.20.53.128/25 route is pointing towards Azure VPN Gateway? Here

Please make sure the NSGs and local firewalls allow and support ICMP ping. You can also test the same using TCP Pings (use RDP Ports)

Cheers,

Kapil
Carlos Solís Salazar 17,971 Reputation points MVP

2023-02-23T13:27:55.91+00:00

Did you validate your on-premises firewall rules?
KapilAnanth-MSFT 47,121 Reputation points Microsoft Employee

2023-02-24T08:29:10.25+00:00

@Sven Erik Matzen

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Sven Erik Matzen 86 Reputation points

2023-02-24T09:26:32.3966667+00:00

@KapilAnanth-MSFT

Thank you for your response. I was able to have a session with the person in charge of the on-prem systems and while I showed him my configuration in Azure, we discovered that there was a typo in the IP-rage of the "local gateway" (the definition of the on-prem-side for the Azure gateway).

I was not aware of the fact that I can configure a connection with selectors that don't match the on-prem-side. Not sure, but I think that's for use cases where I also need NAT rules?

Well - learning by feeling the pain of lost hours, next time I will double check the "local gateway" configuration even if the VPN tunnel connects. I hope this post saves some other person some time while debugging a VPN connection.
KapilAnanth-MSFT 47,121 Reputation points Microsoft Employee

2023-02-24T09:55:42.4466667+00:00

@Sven Erik Matzen glad the issue is now resolved.

Thanks for keeping us updated.

I shall summarize our discussion and post it as an answer.

Kindly Accept the answer, as this can be beneficial to other community members and close this thread.

Cheers,

Kapil

1 answer

KapilAnanth-MSFT 47,121 Reputation points Microsoft Employee

2023-02-24T09:55:10.5666667+00:00
@Sven Erik Matzen

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing connectivity issues between OnPrem server and a Azure VM via S2S Connection

I suggested you to,

Can you check the VM's effective route and see if 10.20.53.128/25 route is pointing towards Azure VPN Gateway? Here

Please make sure the NSGs and local firewalls allow and support ICMP ping. You can also test the same using TCP Pings (use RDP Ports)

Later, you informed it was a Traffic Selector MisMatch (typo in address range).

Fixing this, resolved the issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Virtual Network Gateway connected, but ping fails

1 answer

Your answer