Unable to Connect from Azure VM to Local FLEXlm License Server over VPN

Question

Unable to Connect from Azure VM to Local FLEXlm License Server over VPN

Adhirath Mane 0

Hi,

I am facing an issue where my Azure virtual machine is unable to communicate with my local laptop’s FLEXlm (LMTOOLS) license server, even though a VPN connection is established. Below are the details of my setup and the issue:

A] Setup Details:

Azure VM: Standard_HBv3_120 (AMD EPYC 7003, Infiniband-enabled)

Operating System: Windows Server (Azure VM)

Local Machine (License Server): Windows 11 laptop with FLEXlm (LMTOOLS) installed and FLOW-3D license configured and working locally

License Type: Floating (FLEXlm-based)

VPN Connection: Active and verified between laptop and Azure VM

FLEXlm Port: 27000 (default)

Vendor Daemon Port: As specified in license file

B] Issue Description:

The Azure VM can be accessed normally via Remote Desktop Connection.

However, the Azure VM cannot ping or connect to my local laptop IP over the VPN.

Due to this, the VM cannot check out FLOW-3D license tokens from the FLEXlm server running on my local laptop.

The command Test-NetConnection

Thanmayi Godithi 2,460 Reputation points Microsoft External Staff Moderator

2025-11-11T04:15:41.7466667+00:00
Hi @Adhirath Mane ,

Thank you for reaching out on Microsoft Q&A forum.

To help diagnose your issue, could you please confirm if your Azure Point-to-Site (P2S) VPN is configured to use the IKEv2 protocol?

If you are using IKEv2, the problem you’re facing, where your Azure VM cannot initiate connections to your local laptop’s FLEXlm license server over the VPN is a known limitation of Azure P2S VPNs with IKEv2. This happens because:

P2S with IKEv2 establishes a client-initiated tunnel from your laptop into Azure, allowing outbound traffic from the VPN client to Azure VMs.

However, inbound traffic from Azure VMs back to the P2S client often fails due to asymmetric routing and the way Azure handles routing for P2S client IP pools.

Azure injects system routes to allow outbound connections but does not treat P2S clients the same as fully routable network endpoints, so return traffic from Azure to VPN clients is not correctly routed by default.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

To work around this limitation, consider these options:

Use OpenVPN instead of IKEv2 for your P2S VPN. OpenVPN often provides more reliable bidirectional traffic handling and overcomes some NAT/firewall traversal issues.

Enable NAT on the Azure VPN Gateway (if available for your region and SKU) to rewrite IP addresses for symmetric routing.

Use Azure Virtual WAN for better network control and VPN client handling.

Deploy relay or proxy VMs inside your VNet to mediate communication between Azure VMs and VPN clients.

Enable BGP on the VPN Gateway to advertise P2S address pools back into your VNet for better routing.

Consider forced tunneling with custom routes to explicitly direct return traffic via the VPN gateway.

Also, ensure your Azure Network Security Groups (NSGs) and routing tables allow the required traffic and logs via Network Watcher for dropped packets could give further clues.

Also refer: https://learn.microsoft.com/en-us/answers/questions/2283636/inbound-icmp-failure-from-azure-p2s-vpn-to-vm-no-r

Also, could you please share additional requested details over "Private message".

Thanks,

Thanmayi

Share via

Unable to Connect from Azure VM to Local FLEXlm License Server over VPN

Your answer