Hello, I set up a Site-to-Site VPN connection from an Azure VNET to an on-premise network to access a private SMS gateway, following this tutorial: Site-to-Site VPN Gateway Setup . Here’s the setup: The on-premise VPN device is supported. The local network gateway is configured with the VPN device's public IP and two address ranges: sms-gateway-private-ip-1/32 and sms-gateway-private-ip-2/32 . The connection was working fine with a status of Connected . However, it suddenly changed to Unknown . Troubleshooting details: Connection stats show: Ingress Packets Dropped due to Traffic Selector Mismatch : 0 Packets Egress Packets Dropped due to Traffic Selector Mismatch : 0 Packets VPN Gateway Resource Health reports: At 05:40 PM, Wednesday, 20 November 2024 UTC, the Azure monitoring system received the following information regarding your VPN connection: The connection cannot be established because the other VPN device is unreachable. If the on-premises VPN device is unreachable or not responding to the Azure VPN gateway IKE handshake, the VPN connection cannot establish. When we restarted the IPSec tunnel on the on-premise VPN device, the connection briefly showed Connected but reverted to Unknown shortly afterward. Question: What could be causing this issue, and how can I resolve it? Are there additional diagnostics or configurations I should check on either the Azure side or the on-premise VPN device? Any guidance would be greatly appreciated!

Hi @ Hidaya El Habti , Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that " The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to " Accept " the answer. Issue : Site-to-Site VPN Connection Status Changes to Unknown Solution: Op has raised a Microsoft support ticket to resolve the issue. Summary: From azure side, all the configuration seems fine and doesn't have any issues. IKE logs error message: (Error)[Remote] 151.253.176.240:500 [Local] 20.174.67.224:500 [SESSION_ID] {9c7e2af6-8aa6-4b27-b127-3c3dc966bb82} [ConnType] IKEv2-S2S [ICookie] 0x422029F0DFF1D75D [RCookie] 0x0 [TunnelId] 0x1 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Outbound [FailureDirection] Outbound [ErrorCode] 0x35ED [ErrorMessage] Negotiation timed out The above logs share by you suggests a negotiation timeout, indicating that the opposing device has not responded, leading to a timeout on Azure's side. Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-error-codes#negotiation-timed-out-error-code-13805-hex-0x35ed This issue is related to on-premises services, and we handle only Azure-related issues. Kindly reach out to your on-premises device vendor for further assistance if required. Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members Thanks, Sai.

Site-to-Site VPN Connection Status Changes to Unknown

Hidaya El Habti 20

Hello,

I set up a Site-to-Site VPN connection from an Azure VNET to an on-premise network to access a private SMS gateway, following this tutorial: Site-to-Site VPN Gateway Setup.

Here’s the setup:

The on-premise VPN device is supported.
The local network gateway is configured with the VPN device's public IP and two address ranges: sms-gateway-private-ip-1/32 and sms-gateway-private-ip-2/32.

The connection was working fine with a status of Connected. However, it suddenly changed to Unknown.

Troubleshooting details:

Connection stats show:
- Ingress Packets Dropped due to Traffic Selector Mismatch: 0 Packets
  - Egress Packets Dropped due to Traffic Selector Mismatch: 0 Packets
  1. VPN Gateway Resource Health reports:
  At 05:40 PM, Wednesday, 20 November 2024 UTC, the Azure monitoring system received the following information regarding your VPN connection: The connection cannot be established because the other VPN device is unreachable. If the on-premises VPN device is unreachable or not responding to the Azure VPN gateway IKE handshake, the VPN connection cannot establish.

When we restarted the IPSec tunnel on the on-premise VPN device, the connection briefly showed Connected but reverted to Unknown shortly afterward.

Question:

What could be causing this issue, and how can I resolve it?
Are there additional diagnostics or configurations I should check on either the Azure side or the on-premise VPN device?

Any guidance would be greatly appreciated!

Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-21T06:45:05.2733333+00:00
Hi @Hidaya El Habti,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I would like to confirm that you have followed https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect and it did not resolve the issue.

Please consider the additional troubleshooting steps below to further investigate this problem.

Could you please verify if the pre-shared key shared in both environments is correct?

Please verify the address space mentioned in the Local Network Gateway and ensure it is not overlapping.

Please use the below document to troubleshoot the VPN gateway issues using diagnostic logs. Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Please make sure you have not used the NSGs on your gateway subnet level. The NSG on the gateway subnet are not supported. Associating a network security group to this subnet might cause your virtual network gateway to stop functioning as expected.

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
Hidaya El Habti 20 Reputation points

2024-11-21T08:34:23.6266667+00:00

Hello @Sai Prasanna Sinde ,

Thank you for your recommendations. I’ve gone through all the suggested steps, but unfortunately, the connection status remains Unknown.

If there are any additional troubleshooting steps or diagnostic tools that could help further investigate this issue, please let me know.

Thank you!
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-22T09:46:55.3733333+00:00
Hi @Hidaya El Habti

Greetings!

Could you please review the TunnelDiagnosticLog and RouteDiagnosticLog logs, particularly around the time the issue occurred, and identify any errors that appear?

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Could you please verify the duration it takes for the status to transition from "connected" to "Unknown"?

Could you please attempt resetting the VPN gateway to see if it addresses the problem?

Perform continuous pings from the on-premises network to Azure and then gather packet captures.

Please check IKE logs. It would be helpful to check these logs while conducting the ping test.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics#IKEDiagnosticLog

Use a single sequence to filter and determine where the traffic is getting blocked, based on the log insights.

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-25T07:09:50.12+00:00

Hi @Hidaya El Habti

Following up to see if the above suggestion was helpful. And, if you have any further queries do let us know. We are pleased to assist you.

Thanks,

Sai.
Hidaya El Habti 20 Reputation points

2024-11-25T07:30:30.2133333+00:00
Dear @Sai Prasanna Sinde ,

Thank you for your troubleshooting recommendations. Here’s an update on the actions we’ve taken and our current observations:

VPN Gateway Active-Active Mode:

Initially, the VPN gateway was in Active-Active mode with two public IPs. However, we discovered that the on-premise VPN device only expects traffic from a single IP address. To address this, we disabled Active-Active mode, and the connection status changed to Not Connected. We also observed that the Data In and Data Out properties now show a few hundred KiB of data, where they previously showed 0.

Log Queries on VPN Gateway Scope:

Running log queries within the VPN gateway scope returned no results.

Gateway and Connection Reset:

We attempted to reset both the VPN gateway and the connection, but this had no impact on the connection status.

IKE Logs:

Here is a snippet from the IKE logs for reference:

11/20/2024 6:04:33 PM | [SEND Network Packet] Remote 151.253.176.240:500: Local 20.174.70.85:500: Packet : IKEVersion : IKEv2 ; iCookie : 0x82c687c5e38a3278 ; rCookie : 0x0 ; Exchange type : IKEv2 SA Init Mode ; Length : 536 ; NextPayload : SA ; Flags : 0x8(INITIATOR,REQUEST) ; Messid : 0x00000000

Although the tunnel appears up from the on-premise side, no connection can be established. We continue to see the same resource health error:

The connection cannot be established because the other VPN device is unreachable. If the on-premises VPN device is unreachable or not responding to the Azure VPN gateway IKE handshake, the VPN connection cannot establish.

Could you advise on any further troubleshooting steps we should consider, or let us know if additional diagnostics would be helpful?

Thank you for your assistance.
Patchfox 4,006 Reputation points

2024-11-25T09:15:43.01+00:00
Hi, I rad that you tried several things already, but my next step would be to check possible network routing problems or misconfigurations.
Could you use Network Watcher and use the VPN troubleshooting feature to troubleshoot VPN problems.- Login to Azure Portal and go to Network Watcher

Once network watcher is opened go to VPN troubleshoot

Then select your storage account and container and click on start troubleshooting that will give you the errors.

Under the Status and Action you could find the reason.

Another assumption is a mismatch of the crypto algorythms. Please verify that the algorythms are available on both sides. Your error message looks like your VPN connection stucks at the Init phase, its the first phase where the crypto algorythms are exchanged. Only then the auth phase will start to check the preshared keys.
Hidaya El Habti 20 Reputation points

2024-11-25T10:13:04.3266667+00:00
Dear @Patchfox ,

After running the VPN troubleshooting tool, we received the following message:

"Your VPN connectivity is impacted because the S2S VPN tunnels are disconnected. The S2S VPN tunnels could not connect because of IKE or connectivity issues. The connection cannot be established because the other VPN device is unreachable. If the on-premises VPN device is unreachable or not responding to the Azure VPN gateway IKE handshake, the VPN connection cannot establish."

For further context, I’ve attached screenshots of the cryptographic algorithm configurations for both sides:

On-premise configuration:

Azure configuration:

Could you advise on any additional steps we should take?

Thank you for your assistance.
Hidaya El Habti 20 Reputation points

2024-11-25T10:21:14.8433333+00:00

Dear @Sai Prasanna Sinde ,

Is there any additionnal steps we could try?

Thank you in advance.
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-26T12:11:09.39+00:00
Hi @Hidaya El Habti

Greetings!

There are no issues with the IKE logs you have provided.

So, could you provide the GatewayDiagnosticLog, TunnelDiagnosticLog and RouteDiagnosticLog so that we could identify the exact issue and can assist you better.

Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Could you please tell us about the source of the error mentioned below?

The connection cannot be established because the other VPN device is unreachable. If the on-premises VPN device is unreachable or not responding to the Azure VPN gateway IKE handshake, the VPN connection cannot establish.

Thanks,

Sai Prasanna.
Hidaya El Habti 20 Reputation points

2024-11-26T12:50:51.2966667+00:00
Dear @Sai Prasanna Sinde

Thank you for your response.

The GatewayDiagnosticLog, TunnelDiagnosticLog, and RouteDiagnosticLog are all empty.

The error message is displayed in the Resource Health section of the S2S connection.

Please let me know if there are any additional steps or logs to check.

Best regards,

Hidaya
Patchfox 4,006 Reputation points

2024-11-26T14:29:29.54+00:00

Hi, with the newly posted error message it looks like you have a problem on the other side of the VPN.
Could you double-check that you don't miss a NAT rule or Static Route? When the endpoint can't reach each other it most of the time a.) wrong IPs set in the configs or b.) Routes missing
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-27T11:30:41.14+00:00

Hi @Hidaya El Habti,

According to my understanding, the logs should not be empty.

Could you verify if the diagnostic settings are correctly configured?

Please provide screenshots of the logs after reviewing the diagnostic settings configuration, so we can better understand the issue.

Without the log information, we are unable to determine the cause of the issue.

Kindly refer to the thread below to check the diagnostic settings configuration and inform us of your findings.

Refer: https://learn.microsoft.com/en-us/answers/questions/216637/how-to-enable-vpn-gateway-diagnostics

https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference

Thanks,

Sai.
Hidaya El Habti 20 Reputation points

2024-11-27T11:58:58.3166667+00:00

Dear @Sai Prasanna Sinde

Thank you for your response. Will share with you the logs shortly.

Best regards,

Hidaya
Hidaya El Habti 20 Reputation points

2024-11-27T12:22:15.24+00:00

Dear @Sai Prasanna Sinde

The logs were initially empty because no diagnostic settings had been configured for the VPN gateway. After adding the required diagnostic settings and allowing a few hours for data to accumulate, here is what we found:

IKE logs error message : (Error)[Remote] 151.253.176.240:500 [Local] 20.174.67.224:500 [SESSION_ID] {9c7e2af6-8aa6-4b27-b127-3c3dc966bb82} [ConnType] IKEv2-S2S [ICookie] 0x422029F0DFF1D75D [RCookie] 0x0 [TunnelId] 0x1 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Outbound [FailureDirection] Outbound [ErrorCode] 0x35ED [ErrorMessage] Negotiation timed out

Best regards,
Hidaya
Patchfox 4,006 Reputation points

2024-11-27T17:59:01.16+00:00

Hi Hidaya El Habti, thanks for the logs, apart from the subnet which overlaps with another subnet on the other side, I think we need a network diagram to understand how your two sites are connected, and which services are in use.
My assumption is still a misconfigured routing.
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-28T06:04:14.1366667+00:00

Hi @Hidaya El Habti,

Thanks for providing the logs.

(Error)[Remote] 151.253.176.240:500 [Local] 20.174.67.224:500 [SESSION_ID] {9c7e2af6-8aa6-4b27-b127-3c3dc966bb82} [ConnType] IKEv2-S2S [ICookie] 0x422029F0DFF1D75D [RCookie] 0x0 [TunnelId] 0x1 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Outbound [FailureDirection] Outbound [ErrorCode] 0x35ED [ErrorMessage] Negotiation timed out

The error mentioned above suggests a negotiation timeout, indicating that the opposing device has not responded, leading to a timeout on Azure's side.

This issue is related to on-premises services, and we handle only Azure-related issues. Kindly reach out to your on-premises device vendor for further assistance if required.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-error-codes#negotiation-timed-out-error-code-13805-hex-0x35ed

Thanks,

Sai.
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-29T09:45:20.91+00:00

Hi @Hidaya El Habti

Greetings!

Following up to see if the above suggestion was helpful. And, if you have any further queries do let us know. We are pleased to assist you.

Thanks,

Sai.
Patchfox 4,006 Reputation points

2024-11-29T15:57:24.7333333+00:00

Hi Hidaya El Habti, I can imagine that Sai Prasanna Sinde's answer is insufficient for you. I want to help you further if you need assistance to find a solution to your problem, please give us more info about your network design.
Otherwise, I cant help you here.
Hidaya El Habti 20 Reputation points

2024-12-05T09:26:06.5733333+00:00

Dear @Sai Prasanna Sinde / @Patchfox ,

Thank you for your help. We have raised a ticket with Microsoft Support and are currently awaiting their assistance.

Best regards,

Hidaya
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-12-06T02:57:03.6366667+00:00

Hi @Hidaya El Habti,

Glad that you have raised a Microsoft support ticket.

Please close this thread by clicking "Accept answer" so that it would be beneficial for other community members facing the same issue.

Your contribution is highly appreciated.

If you need help with any other query, please feel free to add a comment below.

Thanks,

Sai.

Accepted answer

Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-11-29T15:19:43.6133333+00:00

Hi @Hidaya El Habti,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: Site-to-Site VPN Connection Status Changes to Unknown

Solution:

Op has raised a Microsoft support ticket to resolve the issue.

Summary:

From azure side, all the configuration seems fine and doesn't have any issues.

IKE logs error message: (Error)[Remote] 151.253.176.240:500 [Local] 20.174.67.224:500 [SESSION_ID] {9c7e2af6-8aa6-4b27-b127-3c3dc966bb82} [ConnType] IKEv2-S2S [ICookie] 0x422029F0DFF1D75D [RCookie] 0x0 [TunnelId] 0x1 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Outbound [FailureDirection] Outbound [ErrorCode] 0x35ED [ErrorMessage] Negotiation timed out

The above logs share by you suggests a negotiation timeout, indicating that the opposing device has not responded, leading to a timeout on Azure's side.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-error-codes#negotiation-timed-out-error-code-13805-hex-0x35ed

This issue is related to on-premises services, and we handle only Azure-related issues. Kindly reach out to your on-premises device vendor for further assistance if required.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members

Thanks,

Sai.
Please sign in to rate this answer.
Sai Prasanna Sinde 1,890 Reputation points Microsoft Vendor

2024-12-09T01:20:13.04+00:00

Hi @Hidaya El Habti,

Greetings!

Please close this thread by clicking 'Accept answer' so that other community members facing the same issue can find the right answers.

Your contribution is highly appreciated.

Thanks,

Sai.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Site-to-Site VPN Connection Status Changes to Unknown

0 additional answers

Your answer