This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 21%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJC%3C/text%3E%3C/svg%3E)
Hi all,
I created Azure Kubernetes service and deployed my app to it. My app need to authenticate with Active Directory on premise , so I created VPN site to site between Azure and my on premise (Fortinet device - domain controller on premise network 192.168.0.0/24).
I follow instruction here https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal
The Connection status is connected but how can I make sure that my app (my pod ?) can connect to domain controller on premise successfully ?
I tried SSH to Azure Kubernetes Service (AKS) cluster node (ubuntu) and ping my domain controller but it failed
Here some info about AKS and VPN connecion:
AKS virtual net : 10.0.0.0/8
AKS
VPN connection
@Jack Chuong , thank you for your question. To minimize network vulnerability, ICMP traffic is blocked by default between Azure and outside networks. Since you are trying to perform a ping test to your VPN connected on-premise DC, I would encourage you to use a tool like nping from the NMap package.
After connecting to the node using SSH you can perform the following operations:
sudo -i
apt install nmap
nping -c 10 --tcp <destination-ip>
This will generate 10 TCP pings from the AKS node to the remote device. Please check if you get a response from the remote device.
I created a new VM 10.240.0.115 , same network with AKS node (10.240.0.0/16) , ssh to new VM , I can ping internet ok but ping to domain controller on premise fail
azureuser@jacktest:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=0.968 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=0.945 ms
azureuser@jacktest:~$ ping 192.168.0.103
PING 192.168.0.103 (192.168.0.103) 56(84) bytes of data.
^C
--- 192.168.0.103 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2043ms
nping from AKS node (10.240.0.4) also fail
root@aks-agentpool-39719571-vmss000004:/# nping -c 10 --tcp 192.168.0.103
Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2021-11-23 07:35 UTC
SENT (0.0353s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (1.0356s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
Raw packets sent: 10 (400B) | Rcvd: 0 (0B) | Lost: 10 (100.00%)
Nping done: 1 IP address pinged in 10.08 seconds
Hi all,
The issue is fixed, the reason is my network team hasn't add route , sorry for bother you guys.
I have the same problem, would you mind if you explain me how to resolve?
@SRIJIT-BOSE-MSFT thank you for your reply, here the result
root@aks-agentpool-39719571-vmss000004:/# nping -c 10 --tcp 192.168.0.103
Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2021-11-23 07:35 UTC
SENT (0.0353s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (1.0356s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (2.0369s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (3.0381s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (4.0393s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (5.0405s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (6.0417s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (7.0429s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (8.0442s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
SENT (9.0451s) TCP 10.240.0.4:22034 > 192.168.0.103:80 S ttl=64 id=2927 iplen=40 seq=2939769783 win=1480
Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
Raw packets sent: 10 (400B) | Rcvd: 0 (0B) | Lost: 10 (100.00%)
Nping done: 1 IP address pinged in 10.08 seconds
root@aks-agentpool-39719571-vmss000004:/# nping -c 10 --tcp 192.168.0.104
Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2021-11-23 07:35 UTC
SENT (0.0370s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (1.0372s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (2.0384s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (3.0406s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (4.0417s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (5.0430s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (6.0442s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (7.0453s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (8.0464s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
SENT (9.0483s) TCP 10.240.0.4:19333 > 192.168.0.104:80 S ttl=64 id=5309 iplen=40 seq=3766330681 win=1480
Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
Raw packets sent: 10 (400B) | Rcvd: 0 (0B) | Lost: 10 (100.00%)
Nping done: 1 IP address pinged in 10.08 seconds