VPN Gateway is not replying for the traffic inside tunnel.

Question

I have established a site to site vpn to my onpremise firewall, both sides the status is connected and i can see the logs from my firewall that the vpn is connected.

When i try to access my azure resources, i dont get any response. we have checked the firewall packets and can see that packets are entering the tunnel but there is response from azure back to tunnel. Inside Azure VPN Gateway also i can see the metrics that there is inbound traffic but i cant see any outbound traffic.

Answer 1

Hi Lokesh,

thanks for posting vpn issue )) since u see inbound traffic but no outbound, it's likely a routing or security rule hiccup. in azure, check the route table associated with ur gateway subnet. make sure u have proper routes pointing back to ur onprem network. sometimes azure adds default routes that mess things up )) to verify that https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings.

peek at ur network security groups. they might be blocking the return traffic. u can check the effective security rules right in the azure portal under 'effective security rules' for the subnet. yes yes, its easy to overlook ))

try this quick test from azure, do a continuous ping to ur onprem resource while checking the vpn gateway metrics. if u see outbound packets suddenly, then bingo - its probably a timeout or asymmetric routing issue.

as well check this sometimes the onprem firewall needs specific policies for azure's public ip ranges. https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview. worth looking into if u haven't whitelisted them yet.

always check both ends of the tunnel when vpn acts up. its like plumbing - u gotta check all the pipes ), packet captures are ur best friend. azure has built in diagnostics for this https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview

this might help in other tools too - try reducing the mtu size temporarily. some devices get fussy with default sizes.

btw u can see realtime metrics under 'connection troubleshoot' in the portal. pretty slick :))

keep us posted if this helps

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/