Azure Virtual Network Gateway does not record any P2SDiagnosticLog events

Luca Castelli 20

I'm using a "virtual network gateway" for Point-to-Site VPN connections using client certificate authentication. I enabled all the diagnostic logs for the virtual network gateway like the following JSON, but on the Analytics logs it seams only the IKEDiagnosticLog are recorded and the aren't any logs on P2SDiagnosticLog category.
How can I record the P2SDiagnosticLog events ?

{ "id": "/subscriptions/xxxxxxxx-xxx-xxx-xxx-xxxxxxxxxxx/resourceGroups/rg-shared-westeu/providers/Microsoft.Network/virtualNetworkGateways/vgw-shared-westeu/providers/microsoft.insights/diagnosticSettings/VirtualNetworkGatewayDiagnostic", "name": "VirtualNetworkGatewayDiagnostic", "properties": { "logs": [ { "category": "GatewayDiagnosticLog", "categoryGroup": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "TunnelDiagnosticLog", "categoryGroup": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "RouteDiagnosticLog", "categoryGroup": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "IKEDiagnosticLog", "categoryGroup": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "P2SDiagnosticLog", "categoryGroup": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } } ], "metrics": [ { "timeGrain": null, "enabled": true, "retentionPolicy": { "days": 0, "enabled": false }, "category": "AllMetrics" } ], "workspaceId": "/subscriptions/xxxxxxxx-xxx-xxx-xxx-xxxxxxxxxxx/resourceGroups/rg-shared-westeu/providers/Microsoft.OperationalInsights/workspaces/log-shared-westeu", "logAnalyticsDestinationType": null } }

Luca Castelli 20

{
    "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-shared-westeu/providers/Microsoft.Network/virtualNetworkGateways/vgw-shared-westeu/providers/microsoft.insights/diagnosticSettings/VirtualNetworkGatewayDiagnostic",
    "name": "VirtualNetworkGatewayDiagnostic",
    "properties": {
        "logs": [
            {
                "category": "GatewayDiagnosticLog",
                "categoryGroup": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            },
            {
                "category": "TunnelDiagnosticLog",
                "categoryGroup": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            },
            {
                "category": "RouteDiagnosticLog",
                "categoryGroup": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            },
            {
                "category": "IKEDiagnosticLog",
                "categoryGroup": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            },
            {
                "category": "P2SDiagnosticLog",
                "categoryGroup": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            }
        ],
        "metrics": [
            {
                "timeGrain": null,
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                },
                "category": "AllMetrics"
            }
        ],
        "workspaceId": "
        "logAnalyticsDestinationType": null
    }
}

KapilAnanth-MSFT 43,896 Reputation points Microsoft Employee

2024-02-12T12:27:05.2166667+00:00
@Luca Castelli

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are not able to see the P2SDiagnosticLog.

May I ask if there is any requirement that you should enable the Logs from Template file only?

If not, please use the Azure Portal to enable the Logging

See : Set up Logging

Make sure

P2SDiagnosticLog is enabled.

You are querying the correct Log Analytics workspace.

Note : You must navigate to the "Monitor" from Azure Portal. Find your VPN Gateway and then go to Diagnostics settings blade

Please confirm that your P2SDiagnosticLog is enabled as shown in the above screenshot.

P.S :

Looking at your template file, Workspace ID is blank. I think this could be the issue

However, please verify using the Portal first

Cheers,

Kapil
Luca Castelli 20 Reputation points

2024-02-12T14:24:11.74+00:00

@KapilAnanth-MSFT
Thank you for the prompt reply. There is no need to use the JSON template file, I reported it on the previous message to prevent heavy image on this thread.
Unfortunately the JSON code was truncated and I confirm the WorkspaceID is correctly present.
I also confirm the P2SDiagnosticLog is enabled and I'm query the right (only one) Log Analytics workspace. In the image is the current Diagnostic setting enabled on the Virtual Network Gateway.
KapilAnanth-MSFT 43,896 Reputation points Microsoft Employee

2024-02-14T08:30:41.3666667+00:00
@Luca Castelli

Can you please share the results of what do you see when you run the below code

AzureDiagnostics | where Category == "P2SDiagnosticLog" | project TimeGenerated, OperationName, Message, Resource, ResourceGroup

Can you confirm users are connecting to this VPN Gateway via P2S?

If you are sure or aware of a time window (say last 24 hours), make sure you select the timewindow and run the query

Is it possible for you to delete this diagnostic configuration and create a new one (in this case, we may not be able to arrive at RCA)

Cheers,

Kapil
Luca Castelli 20 Reputation points

2024-02-14T09:32:46.2766667+00:00

@KapilAnanth-MSFT Again thank you for your suggestion. I'm sure the there are several users are connecting by P2S VPN every day, here the result of the query.

I finally removed the Diagnostics configuration and created it again. Then I waited 10 minutes to establish a new P2S session on the virtual network gateway, waited 10 more minutes but no events are still recorded on the Log Analytics workspace.
Luca Castelli 20 Reputation points

2024-02-28T11:34:01.6433333+00:00

Hi @KapilAnanth-MSFT, thank you to support us on this issue. We finally found the SSTP VPN connections are not logged by design. We will evaluate the upgrade the current "Basic" Virtual Network Gateway in order to implement OpenVPN authentication which are logged on the workspace. https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics#P2SDiagnosticLog
KapilAnanth-MSFT 43,896 Reputation points Microsoft Employee

2024-02-28T11:52:38.1933333+00:00

@Luca Castelli ,

I'm glad that we were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I have converted my comment to an answer and added the Root cause of the issue.

I'd highly appreciate if you could "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

Cheers,

Kapil

Accepted answer

KapilAnanth-MSFT 43,896 Reputation points Microsoft Employee

2024-02-15T06:43:32.55+00:00

@Luca Castelli ,

To troubleshoot further, I believe we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.

If you have a support plan you may file a support ticket, else please check the Private messages, where we will try and help you get an one-time free technical support.

Post working with Azure Support, you found the RCA as

SSTP VPN connections are not logged by design.

And informed us you will be upgrading the current "Basic" Virtual Network Gateway to a different SKU in order to implement OpenVPN authentication which are logged on the workspace Cheers,

Kapil
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Virtual Network Gateway does not record any P2SDiagnosticLog events

0 additional answers

Your answer