VM1 and VM2 cannot ping each other on the SAME subnet (but i can ping them from OUTSIDE network)

Tomas 20

Both VMs are in 10.20.100.0/24 and cannot ping neither each other nor the default gateway. But i can ping them from the external subnet.

I checked VM NIC and in the Effective Security Rules i see : "Associated NSGs: name_of_nsg (Subnet)".

In the NSG's Inbound Security Rules i don't see 10.20.100.0/24 listed.

Should it be listed?

JimmySalian-2011 42,216 Reputation points

2023-12-06T15:02:42.9633333+00:00

Hi,

When you say it can respond from external subnet so what is different in the rules? Probably you are missing allow inbound rule specifically .Check the INtra-subnet traffic rules in this article it is better to understand the logic it uses - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-12-07T04:41:56.1833333+00:00
@Tomas

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please run the IP flow verify for both the VMs?

Set protocol as TCP

Direction Inbound

Local Address the VM for which you are testing

Local Port 3389

Remote Address the other VM

Remote Port 1234

And share the results.

For ICMP ping, you should consider NSG diagnostics

See How to : https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules?tabs=portal#check-security-rules-applied-to-a-virtual-machine-traffic

Cheers,

Kapil
Tomas 20 Reputation points

2023-12-07T12:43:12.9466667+00:00

Thank you for your inputs.

Found the solution: The NSG (which is associated to a Subnet) needed to be updated with both INSIDE and OUTSIDE rules to allow the local (10.20.100.0/24) network, because down below the was a Deny All rule
Tomas 20 Reputation points

2023-12-07T12:43:31.7466667+00:00

Thank you for your inputs.

Found the solution: The NSG (which is associated to a Subnet) needed to be updated with both INSIDE and OUTSIDE rules to allow the local (10.20.100.0/24) network, because down below the was a Deny All rule
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-12-11T04:30:18.77+00:00

@Tomas

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.

Thanks,

Kapil
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-12-12T04:33:06.5866667+00:00

@Tomas

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

2 answers

msrini-MSFT 9,286 Reputation points Microsoft Employee

2023-12-07T05:11:53.7166667+00:00

Hi,

Within the same subnet, by default all traffic are allowed. Can you make sure that you have ICMP allowed on the Windows Firewall of those 2 VMs in question ?

Can you try to RDP/SSH from one VM to the other in the same subnet ? If this works, then connectivity is there and maybe your Windows firewall/IP table is blocking the traffic.

Regards,

Karthik Srinivas
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-12-11T04:31:39.7266667+00:00
@Tomas

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I suggested to run the IP flow verify for both the VMs:

Set protocol as TCP

Direction Inbound

Local Address the VM for which you are testing

Local Port 3389

Remote Address the other VM

Remote Port 1234

And share the results.

For ICMP ping, you should consider NSG diagnostics

See How to : https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules?tabs=portal#check-security-rules-applied-to-a-virtual-machine-traffic

You later confirmed that you were able to resolve the issue.

Cheers,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

VM1 and VM2 cannot ping each other on the SAME subnet (but i can ping them from OUTSIDE network)

2 answers

Your answer