VM connectivity with Route Table

Question

VM connectivity with Route Table

Nandan NK 50

I have 3 azure VM's A, B and C in different Vnets I have peering between each and from A server I can connect to B and C, then I have created user defined route in VM A subnet to route traffic reaching C to B, I mean address prefix I gave C subnet and next hope Virtual appliance is VM B,

Now I tried to reach VM C from VM A, but I'm not able to reach according to my route table traffic should go to B and then C but I don't think it is working, I i tried to connect B from A it is working.
Can someone help me with this issue???

GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-25T10:10:20.0066667+00:00
Hello @Nandan NK ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you have 3 Azure VMs (A, B & C) in 3 different Vnets, which are all peered to each other, and you would like to connect to the VM C from the VM A via VM B. You have already configured the route table and have enabled IP forwarding on the NVA VM, but it is not working.

The setup you are trying to configure is documented in the below article but with 3 different subnets within a single Vnet.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

But as you are using 3 different Vnets, I hope the peering is as below:

Vnet A<--peering--> Vnet B

Vnet B <--peering--> Vnet C

Vnet A <--peering--> Vnet C

Now, coming to the route table part, destination as Vnet C's address prefix and next hop as Virtual appliance VM B's IP address is the correct configuration.

Now, let's focus on the IP forwarding part. To route traffic through the NVA, you must turn on IP forwarding in Azure and in the operating system of NVA machine.

You already confirmed that the IP forwarding is enabled in Azure. So, the next part is to configure this in the operating system of your VM B.

Since you mentioned Windows 2016, you can login to VM B and to enable IP forwarding within the operating system, enter the following command in PowerShell:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -Name IpEnableRouter -Value 1

Restart the NVA VM or VM B.

And if you are trying to ping VM C, then you need to make sure that ICMP is allowed in the VM C's OS Windows Firewall.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-powershell#route-traffic-through-an-nva

Please try the above and let me know if you need further help.

Regards,

Gita
Nandan NK 50 Reputation points

2024-04-25T10:52:21.4133333+00:00

Hello @GitaraniSharma-MSFT Excellent, ofter executing the script you have shared on VM, I'm able to reach VM C from A over B.
Can you please share more details on the script, how I can work if VA is of Linux OS.
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-25T11:18:28.4933333+00:00

@Nandan NK , thank you for the update. Glad to hear that the issue is now resolved.

If the NVA VM has Linux OS, then after connecting to the VM, you can follow the below steps:

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal#enable-ip-forwarding-in-the-operating-system

Regards,

Gita
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-26T12:42:55.3966667+00:00

@Nandan NK ,

Could you please provide an update on this post?

Kindly let us know if the above helps or you need further assistance on this issue.
Nandan NK 50 Reputation points

2024-04-26T13:22:14.1833333+00:00

This is helpful thank you.
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-26T15:19:31.7766667+00:00

@Nandan NK , glad to hear that it helped.

Since the initial solution was already shared by @Andreas Baumgarten below in his answer, I would request you to close the thread by clicking "Accept the answer". This will help us and others in the community as well.

1 answer

Your answer

GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-25T10:10:20.0066667+00:00

Hello @Nandan NK ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you have 3 Azure VMs (A, B & C) in 3 different Vnets, which are all peered to each other, and you would like to connect to the VM C from the VM A via VM B. You have already configured the route table and have enabled IP forwarding on the NVA VM, but it is not working.

The setup you are trying to configure is documented in the below article but with 3 different subnets within a single Vnet.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

But as you are using 3 different Vnets, I hope the peering is as below:

Vnet A<--peering--> Vnet B

Vnet B <--peering--> Vnet C

Vnet A <--peering--> Vnet C

Now, coming to the route table part, destination as Vnet C's address prefix and next hop as Virtual appliance VM B's IP address is the correct configuration.

Now, let's focus on the IP forwarding part. To route traffic through the NVA, you must turn on IP forwarding in Azure and in the operating system of NVA machine.

You already confirmed that the IP forwarding is enabled in Azure. So, the next part is to configure this in the operating system of your VM B.

Since you mentioned Windows 2016, you can login to VM B and to enable IP forwarding within the operating system, enter the following command in PowerShell:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -Name IpEnableRouter -Value 1

Restart the NVA VM or VM B.

And if you are trying to ping VM C, then you need to make sure that ICMP is allowed in the VM C's OS Windows Firewall.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-powershell#route-traffic-through-an-nva

Please try the above and let me know if you need further help.

Regards,

Gita
Nandan NK 50 Reputation points

2024-04-25T10:52:21.4133333+00:00

Hello @GitaraniSharma-MSFT Excellent, ofter executing the script you have shared on VM, I'm able to reach VM C from A over B.
Can you please share more details on the script, how I can work if VA is of Linux OS.
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-25T11:18:28.4933333+00:00

@Nandan NK , thank you for the update. Glad to hear that the issue is now resolved.

If the NVA VM has Linux OS, then after connecting to the VM, you can follow the below steps:

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal#enable-ip-forwarding-in-the-operating-system

Regards,

Gita
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-26T12:42:55.3966667+00:00

@Nandan NK ,

Could you please provide an update on this post?

Kindly let us know if the above helps or you need further assistance on this issue.
Nandan NK 50 Reputation points

2024-04-26T13:22:14.1833333+00:00

This is helpful thank you.
GitaraniSharma-MSFT 50,186 Reputation points Microsoft Employee Moderator

2024-04-26T15:19:31.7766667+00:00

@Nandan NK , glad to hear that it helped.

Since the initial solution was already shared by @Andreas Baumgarten below in his answer, I would request you to close the thread by clicking "Accept the answer". This will help us and others in the community as well.

Answer 1

Andreas Baumgarten 130.1K MVP Volunteer Moderator

Hi @Nandan NK ,

I am not sure if I fully got you configuration of vNets, subnets, user defined routes.

But there are some points you could verify:

Verify your routing covers all directions. For instance A to C over B / C to A over B and so on.

Did you activate the option Enable IP forwarding on the "routing/NVA VM"?

User's image

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Nandan NK 50 Reputation points

2024-04-24T13:55:45.34+00:00

Hello @Andreas Baumgarten

I have enabled Enable IP forwarding.
I have routing A to B over C but I don't require other routes according to our requirement, can you please let me know why other routes required, not having these routes impacting the connectivity?
Andreas Baumgarten 130.1K Reputation points MVP Volunteer Moderator

2024-04-24T14:01:25.3933333+00:00

Hi @Nandan NK ,

to get a network communication up and running you have to define the routes from A to C over B / C to A over B because the packages need to find the route both ways.

If you ping from A to C over B the ping packages need to know the way from source to target and also from C to A over B for the response packages.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Nandan NK 50 Reputation points

2024-04-24T14:16:15.5266667+00:00

@Andreas Baumgarten I have added route C to A over B and tested but it is not working ( I have attached this route to subnet of C)
Nandan NK 50 Reputation points

2024-04-24T15:21:38.39+00:00

@Andreas Baumgarten can you please help further on this?
Andreas Baumgarten 130.1K Reputation points MVP Volunteer Moderator

2024-04-24T16:52:50.3533333+00:00

Hi @Nandan NK ,

which OS is running on the VM that is responsible for the routing?
If it's Windows Server did you activate the Routing inside the VM OS?

I don't know if this is required in a Linux VM.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Nandan NK 50 Reputation points

2024-04-24T17:00:57.8666667+00:00

Hello @Andreas Baumgarten

I'm using windows 2016

Share via

VM connectivity with Route Table

1 answer

Your answer