Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
can't ssh through Site2Site VPN established connectivity
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 92%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJJ%3C/text%3E%3C/svg%3E)
Jesse James
0
Reputation points
can't ssh through Site2Site VPN established connectivity to 10.10.12.0/24. No ping, routes should be set automatically by Azure although I can't see them on the VM in Azure. (Where can I see them? Where should I see them?)
What else can I check? VPN Gateway and connections are fine, up and running, all green. Seems like routing issue but I'm getting out of ideas.
Azure VPN Gateway
{count} votes
-
KapilAnanth 49,846 Reputation points Moderator2023-11-08T05:10:15.1166667+00:00 Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
May I ask,
- If this is a new set up?
- Or was this previously working?
- In that case, was there any recent changes made to the S2S Tunnel
- Can you confirm if the Connection status is showing as "Connected" in the VPN Gateway?
- Is the issue faced only by this Linux VM or there are other windows/linux servers in the VNET that face a similar issue?
- Are you trying to SSH to a server in OnPrem from Azure
or
SSH to a Linux VM in Azure from OnPrem?
Cheers,
Kapil
-
Jesse James 0 Reputation points
2023-11-08T11:30:01.4133333+00:00 Kapil,
- Yes new setup
- Never did work, all tests on the Azure side show no issues, and green and connected
- Yes, it shows connected
- There 2 VMs, both Ubuntu, one on-prem (well, there are many on the subnet), and one on AZ side
- Tried SSH both ways, no good, can't ping, can't traceroute
In addition, effective routes on Azure VM shows properly the VGW as the next hop
This is a relatively simple setup, The VPN type is basic, router on-prem is an ER7206 VPN Router
Was re-build with Terraform several times, but always ended up green, running connected yet can't ping or ssh
Any ideas? Your help is appreciated.
-
KapilAnanth 49,846 Reputation points Moderator
2023-11-10T13:04:18.78+00:00 This looks like a Firewall issue.
For Azure to OnPrem traffic:
- Can you please simulate and see the traffic flow between Azure VM and an OnPrem IP using NSG diagnostics
- NSG Diagnostic:
-
- If you click on "View Details" - you will arrive at the individual Rule that allowed/blocked the request.
- Similarly, make sure please check OnPrem Firewall is allowing the traffic in or not.
From OnPrem to Azure:
- Initiate traffic and check your Firewall/OnPrem router.
- See if the packet is allowed or blocked using a pcaket capture on the router.
Cheers,
Kapil
-
Jesse James 0 Reputation points
2023-11-10T14:08:53.9966667+00:00 Thanks Kapil, I will try that.
Also if you can clarify. I'm using VGW SKU Basic. Does this routing also have something to do with private IPs not being able to use IPsec? I couldn't find a detailed explanation as to what Basic SKU for VPN GW can and cannot do. It only says about the speed and capacity, number of tunnels, etc. not features.
-
KapilAnanth 49,846 Reputation points Moderator
2023-11-10T14:14:50.7933333+00:00 Basic SKU is recommended for Dev-test or proof of concept and not for Production.
Refer : Gateway SKUs - Production vs. Dev-Test Workloads
Other than that, Basic SKU is perfectly capable to providing VPN Connection between Azure and OnPrem.
For Gateway SKU Comparison, refer here
Cheers,
Kapil
Sign in to comment
Sign in to answer