Intermittent connectivity and RDP disconnects across site-to-site VPN

Question

Intermittent connectivity and RDP disconnects across site-to-site VPN

Jeff Chase 0

We are troubleshooting intermittent Remote Desktop disconnects between an on-premises office and a Windows Server 2022 Datacenter VM in Azure.

Environment:

Windows Server 2022 VM running Remote Desktop Session Host in Azure

Site-to-site IPsec VPN between a Sophos XGS firewall and an Azure VPN Gateway

Main-office client subnet: 192.168.0.0/24

Additional remote offices connect to the Sophos firewall through Sophos RED devices

RDS licensing is configured for Per User and RD Licensing Diagnoser reports no licensing problems

The main office recently upgraded to a 1 Gbps fiber Internet connection

Some Azure firewall/security and routing configuration was changed previously to improve security

Symptoms:

Multiple users at the main office sometimes lose their RDP sessions at approximately the same time. The sessions normally reconnect afterward. During at least one occurrence, a user reported that regular Internet connectivity also failed.

The RDS event logs contain network-related disconnects, including:

0x80070079 — The semaphore timeout period has expired

0x80070040 — The specified network name is no longer available

The server logs show sessions disconnecting and reconnecting rather than being logged off. RD Licensing Diagnoser reports no problems.

Troubleshooting completed:

Replaced the Ethernet patch cable between the Sophos firewall and the main switch

Confirmed the firewall and switch ports negotiate at 1 Gbps full duplex

Restarted the firewall and main switch

Continuous ping tests have shown very little packet loss, although one-second pings may not capture a brief interruption

Configured the RDS Session Host policy “Select RDP transport protocols” to “Use only TCP” to rule out problems with RDP over UDP

Verified through Group Policy Results that the TCP-only policy is applied

The problem has continued

We are collecting additional simultaneous ping results to the firewall LAN interface, Internet, Azure VM, and remote-site addresses

Questions:

Which Azure VPN Gateway diagnostic logs and metrics should we enable to identify brief tunnel resets, IPsec renegotiations, packet loss, or routing changes?

Could an Azure Firewall, NSG, route table/UDR, or asymmetric return path cause established RDP sessions to disconnect intermittently while reconnecting shortly afterward?

What is the recommended MTU and TCP MSS configuration for a Sophos-to-Azure site-to-site IPsec VPN?

Should the Azure VPN Gateway connection use any particular DPD, IKE/IPsec, or connection-mode settings with a Sophos XGS firewall?

What should we check in Network Watcher, Effective Routes, Next Hop, Connection Monitor, or VPN Troubleshoot?

Are there specific Azure VPN Gateway metrics that can be correlated with the exact disconnect times?

We would appreciate guidance on determining whether these interruptions originate with the Azure VPN Gateway, Azure routing/firewall configuration, or the on-premises connection.We are troubleshooting intermittent Remote Desktop disconnects between an on-premises office and a Windows Server 2022 Datacenter VM in Azure.

Environment:

Windows Server 2022 VM running Remote Desktop Session Host in Azure

Site-to-site IPsec VPN between a Sophos XGS firewall and an Azure VPN Gateway

Main-office client subnet: 192.168.0.0/24

Additional remote offices connect to the Sophos firewall through Sophos RED devices

RDS licensing is configured for Per User and RD Licensing Diagnoser reports no licensing problems

The main office recently upgraded to a 1 Gbps fiber Internet connection

Some Azure firewall/security and routing configuration was changed previously to improve security

Symptoms:

Multiple users at the main office sometimes lose their RDP sessions at approximately the same time. The sessions normally reconnect afterward. During at least one occurrence, a user reported that regular Internet connectivity also failed.

The RDS event logs contain network-related disconnects, including:

0x80070079 — The semaphore timeout period has expired

0x80070040 — The specified network name is no longer available

The server logs show sessions disconnecting and reconnecting rather than being logged off. RD Licensing Diagnoser reports no problems.

Troubleshooting completed:

Replaced the Ethernet patch cable between the Sophos firewall and the main switch

Confirmed the firewall and switch ports negotiate at 1 Gbps full duplex

Restarted the firewall and main switch

Continuous ping tests have shown very little packet loss, although one-second pings may not capture a brief interruption

Configured the RDS Session Host policy “Select RDP transport protocols” to “Use only TCP” to rule out problems with RDP over UDP

Verified through Group Policy Results that the TCP-only policy is applied

The problem has continued

We are collecting additional simultaneous ping results to the firewall LAN interface, Internet, Azure VM, and remote-site addresses

Questions:

Which Azure VPN Gateway diagnostic logs and metrics should we enable to identify brief tunnel resets, IPsec renegotiations, packet loss, or routing changes?

Could an Azure Firewall, NSG, route table/UDR, or asymmetric return path cause established RDP sessions to disconnect intermittently while reconnecting shortly afterward?

What is the recommended MTU and TCP MSS configuration for a Sophos-to-Azure site-to-site IPsec VPN?

Should the Azure VPN Gateway connection use any particular DPD, IKE/IPsec, or connection-mode settings with a Sophos XGS firewall?

What should we check in Network Watcher, Effective Routes, Next Hop, Connection Monitor, or VPN Troubleshoot?

Are there specific Azure VPN Gateway metrics that can be correlated with the exact disconnect times?

We would appreciate guidance on determining whether these interruptions originate with the Azure VPN Gateway, Azure routing/firewall configuration, or the on-premises connection.

Vinayteja Lellela 100 Reputation points Microsoft External Staff Moderator

2026-07-23T19:47:12.8966667+00:00
Hello Jeff Chase,

Sounds like you’re seeing intermittent, coordinated RDP disconnect/reconnect events from multiple users on the same office subnet, over an IPsec site-to-site VPN (Sophos XGS ↔ Azure VPN Gateway). That pattern (many users impacted at ~the same time, sessions reconnecting) strongly suggests something in the underlying VPN/tunnel/routing behavior is briefly interrupting the path, even if your short pings don’t always show packet loss.

Below is the most relevant guidance you can use to focus the investigation.

1) Enable the right Azure VPN Gateway diagnostic logs (and where to look)

In the Azure portal, go to your Virtual network gateway → Diagnostic settings → Add diagnostic setting, then enable these categories:

TunnelDiagnosticLog

RouteDiagnosticLog

IKEDiagnosticLog

Send them to a Log Analytics workspace so you can filter by time windows that match the RDP disconnects.

What each log helps you identify

IKEDiagnosticLog: IKE handshake / keying events and failures (useful to correlate with brief tunnel resets or “remote device unreachable” style failures).

TunnelDiagnosticLog: tunnel up/down and tunnel state changes.

RouteDiagnosticLog: routing/BGP-style connected/disconnected events (if applicable) and route-related state churn.

Example correlation query

An example for BGP event correlation using RouteDiagnosticLog (adapt as needed to your scenario/time window):

AzureDiagnostics | where Category == "RouteDiagnosticLog" | where OperationName == "BgpConnectedEvent" or OperationName == "BgpDisconnectedEvent" | project TimeGenerated, OperationName, Message, Resource | order by TimeGenerated desc

Even if you’re not using BGP, the same approach (filtering by Category and OperationName around the incident time) is the right technique to find “what changed” during those exact moments.

2) Health probe check (quick “is the gateway itself unhealthy?” signal)

Checking VPN Gateway health probes:

If the gateway uses a single public IP:

https://<Azure-Gateway-PublicIP>:8081/healthprobe

If the gateway uses Active/Active (second IP also matters):

https://<Azure-Gateway-PublicIP>:8083/healthprobe

If these probes fail around the same time as disconnects, you have a strong clue that the gateway side is impacted.

3) Could Azure Firewall/NSG/UDR or asymmetric routing cause disconnects that then recover?

Yes—based on the provided documentation, this is absolutely plausible.

From the “troubleshoot intermittent connectivity” guidance, common causes include:

NSG or UDR misconfiguration on the GatewaySubnet

The docs call out that NSGs/UDRs on GatewaySubnet can block traffic and make connectivity appear unreliable.

Asymmetric routing

The docs explicitly list asymmetric routing as a common cause of connectivity drops/failures.

IP address/routing mismatches

Especially around how address spaces are defined on the Azure Local Network Gateway / on-prem side.

Practical implication for your symptom:

If established TCP sessions (like RDP’s transport) are briefly disrupted due to tunnel/route state changes or filtering/asymmetry, Windows may drop and then transparently reconnect the session shortly afterward—matching what you’re seeing.

4) Confirm/validate key VPN configuration pitfalls (things that cause intermittent disconnects)

The docs list several specific causes that commonly lead to intermittent drops:

a) Local Network Gateway / VPN peer IP configuration mismatches

Ensure the Local Network Gateway object’s IP settings match the on-prem VPN device.

Also ensure the Azure gateway IP configured on-prem matches the actual Azure gateway IP.

b) Don’t apply NSG/UDR to GatewaySubnet

The troubleshooting steps explicitly say to remove NSGs or UDRs from GatewaySubnet and retest.

c) External interface IP included in Local Network Gateway address space

If the on-prem device’s internet-facing/external interface IP is included in the Local Network Gateway address space in Azure, the docs warn this can cause sporadic disconnections.

Mitigation: update Azure Local Network Gateway so that external interface IP isn’t included.

d) Perfect Forward Secrecy (PFS) enabled

If the on-prem VPN device has PFS enabled, the docs recommend disabling it and updating Azure IPsec policy accordingly (since mismatches can cause disconnects).

e) Gateway health / intermittent tunnel down events

If the gateway itself is unhealthy, connectivity may drop intermittently (diagnostic logs + health probe are the evidence).

5) Network Watcher “VPN Troubleshoot” (good for deeper on-prem vs Azure diagnosis)

If the VPN logs/probes don’t make the root cause clear, then Azure Network Watcher → VPN Troubleshoot:

Open Network Watcher in Azure.

Under Network diagnostic tools, select VPN Troubleshoot.

Choose a storage account for diagnostic outputs.

Select the virtual network gateway and VPN connection.

Start troubleshooting, then review downloaded logs.

6) About MTU/MSS, DPD/IKE settings, and “what to check” in Effective Routes/Next Hop/Connection Monitor

From the information you provided, the relevant docs do not specify:

a recommended MTU/TCP MSS value for “Sophos-to-Azure site-to-site IPsec”

specific DPD / IKE / connection-mode settings for Sophos XGS

which exact checks to use in Effective Routes / Next Hop / Connection Monitor beyond the general guidance to inspect routing/UDR/NSG behavior and use Network Watcher VPN troubleshooting

So for this part, focus on Local Network Gateway + on-prem alignment, GatewaySubnet NSG/UDR removals, PFS, and diagnostic logs (IKE/Tunnel/Route), plus Network Watcher VPN Troubleshoot.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Vinayteja Lellela 100 Reputation points Microsoft External Staff Moderator

2026-07-25T16:51:47.4166667+00:00

Hello Jeff Chase, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Vinayteja Lellela 100 Reputation points Microsoft External Staff Moderator

2026-07-28T21:11:26.48+00:00

Hello Jeff Chase, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

1 answer

Your answer

Vinayteja Lellela 100 Reputation points Microsoft External Staff Moderator

2026-07-25T16:51:47.4166667+00:00

Hello Jeff Chase, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Vinayteja Lellela 100 Reputation points Microsoft External Staff Moderator

2026-07-28T21:11:26.48+00:00

Hello Jeff Chase, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

Answer 1

Correlate one incident to an exact UTC time. Enable VPN Gateway resource logs for GatewayDiagnosticLog, TunnelDiagnosticLog, RouteDiagnosticLog, and IKEDiagnosticLog, sending them to Log Analytics. A TunnelDisconnected event followed by reconnection on the same gateway instance points toward DPD, the on-premises device, or the WAN path; a different instance can indicate Azure failover or maintenance. Run Connection Monitor with TCP 3389 from an Arc-enabled on-premises host to the VM, alongside tests to the Sophos gateway and an Internet target, so simultaneous loss identifies the failing segment. Check Effective Routes, Network Watcher Next Hop and IP Flow Verify, plus NSG and firewall flow logs for asymmetric routing. Avoid arbitrary MTU changes: Azure VPN Gateway clamps IPv4 TCP MSS to 1360 bytes over the Internet. Match the Sophos IKE/IPsec policy to Azure-supported parameters. If Azure logs show a gateway event, open Support with timestamps and diagnostic records; otherwise involve the ISP or Sophos.