Azure Server not able to reach on-prem server


Created Azure VM and IPsec tunnel to on-premise Cisco firewall.
On-premise server connected to Cisco firewall is able to reach Azure VM server using private IP.
Azure VM is not able to ping/ reach on-premise server through the tunnel.
Attached architecture for reference.


Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
4,582 questions
{count} votes

Accepted answer
  1. Evgeny Grishchenko 466 Reputation points

    The assumption is that the incoming traffic is blocked by On-Prem Windows firewall or Cisco ASA.

    To troubleshoot it:

    1. I would not recommend to use ping to check the reachability.
    2. Make sure, that you have some service, which listens to the incoming requests on your On-Prem Windows Server. For example, IIS (port 80)
    3. Check if your On-Prem Windows firewall allows that inbound connection. If not, enable it.
    4. Check if your Cisco Firewall allows connections from Azure to your windows server.
    5. Check if your NSG, which is assigned you your Azure Server is not blocking your outbound connection (normally, it is allowed)
    6. Enable real-time monitoring on your On-Onprem Windows Server, Cisco ASA, and Azure Windows Server (NSG flow logs)
    7. On your Azure Windows Server run telnet <listening port> and check all your logs.

    After that, if not fixed, you could check the next assumptions:

    • misconfigured IPSEC tunnel
    No comments

1 additional answer

Sort by: Most helpful
  1. Evgeny Grishchenko 466 Reputation points

    The 1st suggestion is to remove username & password, and keys from your diagram....

    No comments