public ip PII not reachable using GSA but is reachable using MSFT-AzVPN-Manual

Question

public ip PII not reachable using GSA but is reachable using MSFT-AzVPN-Manual

Jim Zelenka 20 Microsoft Employee

nb: the tags selected for this are bogus; I couldn't find a good match

My team has several Azure VMs in the CORP tenant that we use for various internal loads.

These are Linux VMs accessed via ssh.

To make them reachable, we've assigned them public IPs.

This works fine when connected to VPN MSFT-AzVPN-Manual, but some of the VMs are not reachable when using only GSA (Global Secure Access).

Example public address of a VM that works with both: PII

Example public address of a VM that is not reachable by GSA but is reachable with MSFT-AzVPN-Manual: PII

I filed for both addresses to be reachable via GSA, and that's when both became reachable using MSFT-AzVPN-Manual.

At least one other user has confirmed this behavior, so it seems unlikely to be a client-side problem.

I originally filed this issue with helpdesk as PII.

They informed me that they do not support this and that I must open a ticket with Azure Support.

I collected GSA logs per instructions, but the file is too large for the support tool.

I filled out the support request form three times, but that was rejected and I was redireted here.

Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T12:49:47.9966667+00:00

Teams is not a great way to reach me - too noisy and no good filtering tools. Can you ask your questions here or e-mail them to me?
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T13:31:10.0133333+00:00

Hi Jim Zelenka,

Sure, we will reach you through e-mail or here.

Regards
Venkatesan.S
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T13:45:53.7933333+00:00

Hi Jim Zelenka,

Could you confirm whether the detailed overview of GSA is hosted on Azure cloud or with a third-party service?

https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T14:10:22.9233333+00:00

This is GSA as auto-deployed to my CORP laptop. AFAIK, no third party involved.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T14:11:13.1466667+00:00

All of the symptoms suggest that the address is simply not being handled by GSA, although it is handled by MSFT-AzVPN-Manual
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T15:33:22.3566667+00:00
Hi Jim Zelenka,

Test these on 128.xx.xxx.xxx (failing IP):

Azure portal: IP flow verify > Source: your GSA public IP (check via whatismyip), Dest: 128.xx.xxx.xx, Protocol TCP port 22. Screenshot the drop reason.

CLI: az network nic show-effective-security-group --resource-group <rg> --name <nic-name> --output table ensure inbound SSH allows from "Any" or Internet.

VM shell: sudo ss -tuln | grep 22, sudo iptables -L -n -v, and sudo ufw status verbose (if UFW active).

Could you let me know who handles the GSA setup in your environment? If you're not sure, no worries, perhaps reach out to your internal team who deployed the GSA client?

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T18:03:47.2+00:00

MS helpdesk informed me that you handle GSA. FWIW, that sounded wrong to me, but they referred me here. Can you elaborate on "whatismyip"?

SFI requires that the host not be reachable from the internet. An identically-configured VM on the same subnet is reachable through GSA, so the problem seems very specific to this individual IP address.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-13T07:34:25.4833333+00:00
Hi Jim Zelenka,

From Azure Network Watcher IP flow verify overview,

Steps:

Portal > Network Watcher (enable in CORP subscription/region if needed)

IP flow verify > Target: 128.xx.1xx.xx VM's Network Interface

Direction: Inbound, Protocol: TCP, Local port: 22

Remote IP: Your GSA public outbound (whatismyipaddress.com from GSA browser) or *

Check → Returns Allow/Deny + exact NSG rule name + edit link

Tests all NSGs on NIC/subnet + Virtual Network Manager rules. TCP/UDP only (perfect for SSH).

VM-Level Diagnostics

On 128.xx.1xx.xx vs working VM:

sudo ss -tuln | grep :22 # SSH listener active? sudo iptables -L -n -v # OS firewall rules sudo ufw status verbose # UFW if enabled

GSA Client Known Issues

From Global Secure Access limitations:

Disable Secure DNS (DoH/DoT/DNSSEC) in Edge/Chrome/Firefox—blocks traffic acquisition

Edge: HKLM\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled=0

Chrome: chrome://flags → Disable "Async DNS resolver"

NRPT Group Policy overrides client private DNS

Client doesn't support IPv6 tunneling (IPv4 only).

Share screenshots/outputs + GSA logs link. Who deployed auto-GSA on CORP laptops? (IT/Security team?) Helps check tenant policies.

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-13T15:06:48.3666667+00:00

I am in the office until Thursday. I will be able to perform these steps then.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-13T15:36:23.9366667+00:00

Sure, please let me know if you need anything from us.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-16T09:33:10.3+00:00

Hi Jim Zelenka,

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-16T14:03:44.3866667+00:00

I accessed the serial console of the VM via the portal. As root, I did:

tcpdump -n "tcp[tcpflags] & tcp-syn != 0 and port 22"

When I am connected to the Azure VPN, I see:

PII removed.

and I connect successfully.

When I disconnect from that VPN and enable GSA private, the connection times out and the tcpdump shows nothing.

I do not believe this is a client-side issue because I can use GSA to connect to an identically configured VM on the same subnet.

DNS is not involved because I am connecting using the ipv4 address.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-16T15:44:53.9+00:00

Hi Jim Zelenka,

Could you please share the requested details via private message?
Ganesh Patapati 10,840 Reputation points Microsoft External Staff Moderator

2026-01-20T13:26:37.7766667+00:00

Hello Jim Zelenka

Thanks for the reply!

I have Initiated a private message with you. Kindly provide the necessary details in the private chat.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-23T13:17:34.6666667+00:00

Thank you! I agree that this seems to be a GSA problem. Unfortunately, I am not having any luck engaging that team. The link you provided is to some Viva channel. I did not see how to generate a ticket or ICM from there, but I may be missing it in the UI clutter.

Answer accepted by question author

1 additional answer

Your answer

Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T12:49:47.9966667+00:00

Teams is not a great way to reach me - too noisy and no good filtering tools. Can you ask your questions here or e-mail them to me?
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T13:31:10.0133333+00:00

Hi Jim Zelenka,

Sure, we will reach you through e-mail or here.

Regards
Venkatesan.S
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T13:45:53.7933333+00:00

Hi Jim Zelenka,

Could you confirm whether the detailed overview of GSA is hosted on Azure cloud or with a third-party service?

https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T14:10:22.9233333+00:00

This is GSA as auto-deployed to my CORP laptop. AFAIK, no third party involved.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T14:11:13.1466667+00:00

All of the symptoms suggest that the address is simply not being handled by GSA, although it is handled by MSFT-AzVPN-Manual
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-12T15:33:22.3566667+00:00

Hi Jim Zelenka,

Test these on 128.xx.xxx.xxx (failing IP):

Azure portal: IP flow verify > Source: your GSA public IP (check via whatismyip), Dest: 128.xx.xxx.xx, Protocol TCP port 22. Screenshot the drop reason.

CLI: az network nic show-effective-security-group --resource-group <rg> --name <nic-name> --output table ensure inbound SSH allows from "Any" or Internet.

VM shell: sudo ss -tuln | grep 22, sudo iptables -L -n -v, and sudo ufw status verbose (if UFW active).

Could you let me know who handles the GSA setup in your environment? If you're not sure, no worries, perhaps reach out to your internal team who deployed the GSA client?

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-12T18:03:47.2+00:00

MS helpdesk informed me that you handle GSA. FWIW, that sounded wrong to me, but they referred me here. Can you elaborate on "whatismyip"?

SFI requires that the host not be reachable from the internet. An identically-configured VM on the same subnet is reachable through GSA, so the problem seems very specific to this individual IP address.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-13T07:34:25.4833333+00:00

Hi Jim Zelenka,

From Azure Network Watcher IP flow verify overview,

Steps:

Portal > Network Watcher (enable in CORP subscription/region if needed)

IP flow verify > Target: 128.xx.1xx.xx VM's Network Interface

Direction: Inbound, Protocol: TCP, Local port: 22

Remote IP: Your GSA public outbound (whatismyipaddress.com from GSA browser) or *

Check → Returns Allow/Deny + exact NSG rule name + edit link

Tests all NSGs on NIC/subnet + Virtual Network Manager rules. TCP/UDP only (perfect for SSH).

VM-Level Diagnostics

On 128.xx.1xx.xx vs working VM:

sudo ss -tuln | grep :22 # SSH listener active? sudo iptables -L -n -v # OS firewall rules sudo ufw status verbose # UFW if enabled

GSA Client Known Issues

From Global Secure Access limitations:

Disable Secure DNS (DoH/DoT/DNSSEC) in Edge/Chrome/Firefox—blocks traffic acquisition

Edge: HKLM\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled=0

Chrome: chrome://flags → Disable "Async DNS resolver"

NRPT Group Policy overrides client private DNS

Client doesn't support IPv6 tunneling (IPv4 only).

Share screenshots/outputs + GSA logs link. Who deployed auto-GSA on CORP laptops? (IT/Security team?) Helps check tenant policies.

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-13T15:06:48.3666667+00:00

I am in the office until Thursday. I will be able to perform these steps then.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-13T15:36:23.9366667+00:00

Sure, please let me know if you need anything from us.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-16T09:33:10.3+00:00

Hi Jim Zelenka,

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-16T14:03:44.3866667+00:00

I accessed the serial console of the VM via the portal. As root, I did:

tcpdump -n "tcp[tcpflags] & tcp-syn != 0 and port 22"

When I am connected to the Azure VPN, I see:

PII removed.

and I connect successfully.

When I disconnect from that VPN and enable GSA private, the connection times out and the tcpdump shows nothing.

I do not believe this is a client-side issue because I can use GSA to connect to an identically configured VM on the same subnet.

DNS is not involved because I am connecting using the ipv4 address.
Venkatesan S 3,645 Reputation points Microsoft External Staff Moderator

2026-01-16T15:44:53.9+00:00

Hi Jim Zelenka,

Could you please share the requested details via private message?
Ganesh Patapati 10,840 Reputation points Microsoft External Staff Moderator

2026-01-20T13:26:37.7766667+00:00

Hello Jim Zelenka

Thanks for the reply!

I have Initiated a private message with you. Kindly provide the necessary details in the private chat.
Jim Zelenka 20 Reputation points Microsoft Employee

2026-01-23T13:17:34.6666667+00:00

Thank you! I agree that this seems to be a GSA problem. Unfortunately, I am not having any luck engaging that team. The link you provided is to some Viva channel. I did not see how to generate a ticket or ICM from there, but I may be missing it in the UI clutter.

Answer 1

Hello Jim Zelenka

I have checked all your VM configurations, and everything is set up correctly. The Subnet and NIC level NSGs are also properly configured, and all VPN gateway routes are pointing to the internet, so everything appears fine on the Azure Networking side.

When you connect using the MSFT VPN, you can communicate with both VMs. However, when using the GSA VPN, you can only connect to one VM. Based on my analysis, the issue is not with Azure Networking but seems to be related to the GSA VPN. Please reach out to the GSA team for further assistance.

I have also found information on how to contact the GSA support team. Please use the link below to access tech support and submit your concern.

Below is the link:

Global Secure Access

https://engage.cloud.microsoft/main/org/microsoft.com/groups/eyJfdHlwZSI6Ikdyb3VwIiwiaWQiOiI4OTQ3MTEifQ/all

Please refer to the screenshot below for instructions on how to contact the GSA team:
User's image

Answer 2

Hi Jim Zelenka,

Thank you for contacting the Microsoft Q&A portal.

Test these on 128.xx.xxx.xxx (failing IP):

Azure portal: IP flow verify > Source: your GSA public IP (check via whatismyip), Dest: 128.xx.xxx.xx, Protocol TCP port 22. Screenshot the drop reason.

CLI: az network nic show-effective-security-group --resource-group <rg> --name <nic-name> --output table ensure inbound SSH allows from "Any" or Internet.

VM shell: sudo ss -tuln | grep 22, sudo iptables -L -n -v, and sudo ufw status verbose (if UFW active).

Could you let me know who handles the GSA setup in your environment? If you're not sure, no worries, perhaps reach out to your internal team who deployed the GSA client?

Kindly let us know if the above helps or you need further assistance on this issue.

Share via

public ip PII not reachable using GSA but is reachable using MSFT-AzVPN-Manual

1 additional answer

Your answer