Unable to use the virutal network gateway from peered VNET via transit gateway

Ritesh Agrahari 1

We have hub-spoke VNet connection, and both are peered where transit gateway is enabled both side. On hub we have Virtual network gateway and on spoke we have a VM which tries to connect to an instance outside Azure. Tested the connectivity with this instance from Hub Vnet/Subnet works fine. But from spoke Vnet/Subnet it fails to connect. Although from Spoke i could connect successfully to Hub Vnet/Subnet Virtual machine via peering connection.

I suspect these is something with NSG or Route Table. Please help/advice.

Appreciate quick response.

GitaraniSharma-MSFT 49,626 Reputation points Microsoft Employee

2022-07-08T13:10:36.49+00:00
Hello @Ritesh Agrahari ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you have a hub-spoke model, where both Vnets are peered with transit gateway option and you are able to access the spoke Vnet from Hub Vnet but unable to connect to Hub Vnet from spoke Vnet.

You mentioned "both are peered where transit gateway is enabled both side". I'm not sure which options you have chosen but below should be the options enabled on Hub and Spoke Vnet respectively:

On Hub Vnet peering:

Traffic to remote virtual network: Allow

Traffic forwarded from remote virtual network: Allow

Virtual network gateway or Route Server: Use this virtual network's gateway or Route Server

On Spoke Vnet peering:

Traffic to remote virtual network: Allow

Traffic forwarded from remote virtual network: Allow

Virtual network gateway or Route Server: Use the remote virtual network's gateway or Route Server

Could you please confirm if your Vnet peering is configured as above?

Also, could you please let me know if there is any UDR associated to the Hub or spoke subnets? If yes, could you let me know which subnet they are associated to and what routes are configured in them?
And what type of connection you are attempting from the spoke Vnet - ping/RDP etc.?

Regards,
Gita
GitaraniSharma-MSFT 49,626 Reputation points Microsoft Employee

2022-07-11T15:34:03.87+00:00

Hello @Ritesh Agrahari ,

Could you please provide an update on this post?

Regards,
Gita
GitaraniSharma-MSFT 49,626 Reputation points Microsoft Employee

2022-07-13T13:33:07.377+00:00

Hello @Ritesh Agrahari , do you have any further updates on this issue?

3 answers

Tchimwa Sougang 941 Reputation points Microsoft Employee

2022-07-08T14:14:56.363+00:00

@Ritesh Agrahari Thank you for your question. I suspect the routing here. I believe you have a Site-to-Site VPN connection, make sure on your on-premises (other side where you are connecting to Azure) VPN appliance, you have added the address space of the Spoke VNET so that you have that route as well. You probably only have the address space of the Hub VNET but not the Spoke. Please add the Spoke address space on your VPN appliance.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rishabh mishra 156 Reputation points

2022-07-18T12:09:28.413+00:00

@Ritesh Agrahari Hi Ritesh, I think this may be due to route table. Since you mentioned hub spoke can u please check if peering is enabled and also you if try traceroute see where packet getting dropped.
Please sign in to rate this answer.
Rishabh mishra 156 Reputation points

2022-07-18T12:10:34.393+00:00

also post your nsg screenshot as well

Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Harshvir Bhati 26 Reputation points

2022-12-14T17:48:52.437+00:00

Hello,

I have a similar issue. I can able to ping On-prem from the hub and hub to spoke. But when I am trying to Spoke to On-prem, I cannot ping. I have allowed RDP and ICMP traffic in both Inbound and Outbound in NSG and VM. The GW transit on the Hub network is enabled but disabled on the Spoke network.

Any suggestions?
Please sign in to rate this answer.
Harshvir Bhati 26 Reputation points

2022-12-14T19:37:52.737+00:00

Hello,

I have figured this out. I have to add the static route of the Spoke network in the PALO Firewall and my local routers to communicate with Azure.

Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to use the virutal network gateway from peered VNET via transit gateway

3 answers

Your answer