Has the Azure VPN Gateway P2SDiagnosticLog changed? Username and source ip are now being redacted

Question

Has the Azure VPN Gateway P2SDiagnosticLog changed? Username and source ip are now being redacted

Richard Last 0

We have been doing some connection analysis using the Azure VPN Gateway P2SDiagnosticLog.

Our more recent log files have started to have the username and source IP address redacted. Specifically the first 3 characters of username are replaced by *** and the first octet of the source IP address is replaced with 0.

Is this a configuration issue on our diagnostic logging/gateway or has something been changed and not been updated in the relevant documentation?

I have checked our current diagnostic settings and everything looks normal and has not been changed.

Looking at the documentation at https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics#P2SDiagnosticLog there is an un-redacted username in the screenshot.

Recent example messages from our log are below (suitably anonymised).

"[MSG] [default] [IKEv2_9fa61441-05f3-4c6e-ffff-ac3926bbc60c] Connect request received. IP=0.65.79.46:4500 ICookie=0x51F8F32247064CFE Auth=EAP"

"[MSG] [default] [IKEv2_9fa61441-05f3-4c6e-ffff-ac3926bbc60c] EAP authentication succeeded. Username=***r.name@domain.com EapType=26"

ChaitanyaNaykodi-MSFT 17,811 Reputation points Microsoft Employee

2023-11-14T03:44:12.38+00:00

@Richard Last

Thank you for reaching out.

I have reached out to the team internally regarding this issue and will make an update here as soon as I get a response.

Meanwhile if it helps you can follow this documentation for Point-to-site VPN session management. Thank you!
Barry Cordie 5 Reputation points Microsoft Employee

2023-11-14T14:25:51.08+00:00

Hi Richard,

I spoke with some colleagues in Support, I was told this is a recent change, but the documentation hasn't been updated. This appears to be related to a larger effort to prevent leaking of sensitive data. For example, this same feature recently went GA for the Application Gateway resource. I suspect this effort will continue to expand, hopefully the documentation gets updated before these changes go into effect next time.

Thanks!
ChaitanyaNaykodi-MSFT 17,811 Reputation points Microsoft Employee

2023-11-16T22:55:40.3533333+00:00

@Richard Last

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

ChaitanyaNaykodi-MSFT 17,811 Reputation points Microsoft Employee

2023-11-14T03:44:12.38+00:00

@Richard Last

Thank you for reaching out.

I have reached out to the team internally regarding this issue and will make an update here as soon as I get a response.

Meanwhile if it helps you can follow this documentation for Point-to-site VPN session management. Thank you!
Barry Cordie 5 Reputation points Microsoft Employee

2023-11-14T14:25:51.08+00:00

Hi Richard,

I spoke with some colleagues in Support, I was told this is a recent change, but the documentation hasn't been updated. This appears to be related to a larger effort to prevent leaking of sensitive data. For example, this same feature recently went GA for the Application Gateway resource. I suspect this effort will continue to expand, hopefully the documentation gets updated before these changes go into effect next time.

Thanks!
ChaitanyaNaykodi-MSFT 17,811 Reputation points Microsoft Employee

2023-11-16T22:55:40.3533333+00:00

@Richard Last

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

@Richard Last

Thank you for your patience here. I got a response back from the team.

As mentioned by Barry above, yes this is a recent change. This change in logging behavior was due to Microsoft privacy requirements that require proper handling of PII (Personally Identifiable Information). To fulfill these requirements the product group obfuscated PII in logs. The product team will be updating the screenshot accordingly.

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Has the Azure VPN Gateway P2SDiagnosticLog changed? Username and source ip are now being redacted

1 answer

Activity