Why do I have to keep resetting one of my Virtual Network Gateway site-to-site connections to allow traffic to pass

Brian Davis 51 Reputation points
2023-10-20T19:28:01.5666667+00:00

I have a site-to-site VPN connection that I started having difficulty with about 3 weeks ago after a power outage at the remote site. We were able to get the tunnel reestablished and it has been in a "Connected" state ever since. However, multiple times a day, I will need to use the Azure Portal to "Reset" that individual connection in order to allow traffic to pass. This is problematic because 1)I don't want to keep doing this manually and 2) we have processes that run at night when no one is monitoring to reset the connection. I'm wondering what's going on here to allow the tunnel to remain in a "Connected" state yet packets aren't able to traverse. Would doing a Gateway reset possibly be worth a try? Any feedback would be welcome.

Thanks!

Brian

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,205 questions
{count} votes

Accepted answer
  1. msrini-MSFT 9,261 Reputation points Microsoft Employee
    2023-10-21T10:08:52.1766667+00:00

    Hi Brian,

    I may not be able to provide you a solution without taking a look at the IKE logs during the time of issue. But I can suggest you possible issues which I have seen in the past :

    1. Issue with Quick mode re-key. When the SA lifetime ends for phase 2, Main mode is still up but there could be issue with re-key and due to which the tunnel status shows as connected but the traffic will not pass through. When you bounce the tunnel, you can get the MM re-negotiated which brings back the traffic.
    2. Is your On-Prem VPN device is listed in the validated/ supported VPN vendors? (https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#devicetable)

    It is recommended to use the validated devices with the version mentioned to avoid any unknown issues.

    Suggestion, can you try to maximize the phase 2 SA lifetime parameter ?

    Regards,

    Karthik Srinivas

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful