My Azure VMs lost internet Connectivity. No changes have been made on the network or off. Help?

Question

We are a small shop with lots of access. We are jack of all trades, master of none. I am the System Admin, Network Engineer, Security Analyst, etc. etc. Again: Master of none.

I need help diagnosing an issue we are having. Our Azure VMs lost internet connectivity. They have a private IP address that is routed through a Tunnel to our internal network. The VMs can ping everything inside the network to include our DNS servers and our CiscoASA (firewall.) The VMs do not have an external IP address.

The DNS exists in our internal network. Our interneal machines are all connecting to the internet. I tried changing the Azure VMs DNS settings to 8.8.8.8 but it did not change anything. I turned off the Windows firewall but it did not affect anything. We did not modify any firewall rules or routes recently.

Help!

Answer 1

Hello @Alvaro Amaya

 

Thanks for reaching out to Microsoft Q and A platform.

 

Here are the few suggestions you could check in troubleshooting this issue.

 

·       By the description assuming there is a Tunnel created from Azure to on premise Servers, and Internet traffic exit from the on-premises.

·       First check could be to understand what the “Internet” traffic flow from the VM is, and what are the hops involved.

·       Please use tools like Next Hop and Connection Monitor from “Network Watcher” which would give more insight on which hop the issue is:

·       Document: Tutorial: Diagnose a VM network routing problem - Azure portal - Azure Network Watcher | Microsoft Learn

·       On the Virtual Machine, please do perform “nslookup” on the source VM, if the URL is resolvable, then issue is not with the DNS. If so then changing the DNS server will not fix the issue.

For example:

CONCLUSION:

·       If in above tests and find you see that the internet traffic is not locked within Azure and if its been sent to the on-premise, then concentration of troubleshooting must be with the devices in On-premise.

·       For further detailed analysis to track the Packets, you could take the “network packet capture” at all the hops, while establishing TCP traffic towards internet IP.

 

Regards,

Priya Kumar

 

Answer 2

The issue was found to be within the NAT rules in our firewall. Our network vendor was seeing Private IP addresses trying to connect to the internet and blocked them. Once we had proper NAT rules setup, the internet traffic was restored.