How to troubleshoot access from on prem across virtual network gateway?

Question

Hello,

I have a weird issue. I have built a S2S between an onprem firewall and Azure virtual network gateway. The vnet in Azure is 10.119.0.0/23 with GatewaySubnet (10.119.1.224/27) for the VPN and 10.119.0.0/24 for vm. I have enabled BGP. I see bgp routes onprem and in the bgp peers page for the vng. The Azure vm (10.119.0.4) can ping and access devices onprem. However onprem devices can ping / access the gateway (10.119.1.228) but not the vm.

Suggests and and ideas?

Answer 1

@COA Pete Gustafson

Thank you for reaching out.

Can you please try below mentioned steps and see if that helps in pinpointing the connectivity issue.

• Use Azure Network Watcher IP flow verify to check if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and a remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.
• Configure packet capture for VPN gateway to see if the traffic is going through the VPN gateway. This will help in understanding if the issue is on Azure side or the on-prem side.

Hope this helps! Please let us know if issue still persists. Thank you!