can't ssh through Site2Site VPN established connectivity

Jesse James 0

can't ssh through Site2Site VPN established connectivity to 10.10.12.0/24. No ping, routes should be set automatically by Azure although I can't see them on the VM in Azure. (Where can I see them? Where should I see them?)

What else can I check? VPN Gateway and connections are fine, up and running, all green. Seems like routing issue but I'm getting out of ideas.

KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2023-11-08T05:10:15.1166667+00:00
@Jesse James

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

May I ask,

If this is a new set up?

Or was this previously working?

In that case, was there any recent changes made to the S2S Tunnel

Can you confirm if the Connection status is showing as "Connected" in the VPN Gateway?

Is the issue faced only by this Linux VM or there are other windows/linux servers in the VNET that face a similar issue?

Are you trying to SSH to a server in OnPrem from Azure
or
SSH to a Linux VM in Azure from OnPrem?

Cheers,

Kapil
Jesse James 0 Reputation points

2023-11-08T11:30:01.4133333+00:00
Kapil,

Yes new setup

Never did work, all tests on the Azure side show no issues, and green and connected

Yes, it shows connected

There 2 VMs, both Ubuntu, one on-prem (well, there are many on the subnet), and one on AZ side

Tried SSH both ways, no good, can't ping, can't traceroute

In addition, effective routes on Azure VM shows properly the VGW as the next hop

This is a relatively simple setup, The VPN type is basic, router on-prem is an ER7206 VPN Router

Was re-build with Terraform several times, but always ended up green, running connected yet can't ping or ssh

Any ideas? Your help is appreciated.
KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2023-11-10T13:04:18.78+00:00
@Jesse James

This looks like a Firewall issue.

For Azure to OnPrem traffic:

Can you please simulate and see the traffic flow between Azure VM and an OnPrem IP using NSG diagnostics

NSG Diagnostic:

If you click on "View Details" - you will arrive at the individual Rule that allowed/blocked the request.

Similarly, make sure please check OnPrem Firewall is allowing the traffic in or not.

From OnPrem to Azure:

Initiate traffic and check your Firewall/OnPrem router.

See if the packet is allowed or blocked using a pcaket capture on the router.

Cheers,

Kapil
Jesse James 0 Reputation points

2023-11-10T14:08:53.9966667+00:00

Thanks Kapil, I will try that.

Also if you can clarify. I'm using VGW SKU Basic. Does this routing also have something to do with private IPs not being able to use IPsec? I couldn't find a detailed explanation as to what Basic SKU for VPN GW can and cannot do. It only says about the speed and capacity, number of tunnels, etc. not features.
KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2023-11-10T14:14:50.7933333+00:00

@Jesse James

Basic SKU is recommended for Dev-test or proof of concept and not for Production.

Refer : Gateway SKUs - Production vs. Dev-Test Workloads

Other than that, Basic SKU is perfectly capable to providing VPN Connection between Azure and OnPrem.

For Gateway SKU Comparison, refer here

Cheers,

Kapil

Share via

can't ssh through Site2Site VPN established connectivity