Diagnose on-premises VPN connectivity with Azure

In this article, you learn how to use Azure Network Watcher VPN troubleshoot capability to diagnose and troubleshoot your VPN gateway and its connection to your on-premises VPN device. For a list of validated VPN devices and their configuration guides, see VPN devices.

VPN troubleshoot allows you to quickly diagnose issues with your gateway and connections. It checks for common issues and returns a list of diagnostic logs that can be used to further troubleshoot the issue. The logs are stored in a storage account that you specify.

Prerequisites

Troubleshoot using Network Watcher VPN troubleshoot

Use the VPN troubleshoot capability of Network Watcher to diagnose and troubleshoot your VPN gateway and its connection to your on-premises network.

  1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

    Screenshot shows how to search for Network Watcher in the Azure portal.

  2. Under Network diagnostic tools, select VPN troubleshoot.

  3. In the VPN troubleshoot, select Select storage account to choose or create a Standard storage account to save the diagnostic files to.

  4. Select the virtual network gateway and connection that you want to troubleshoot.

  5. Select Start troubleshooting.

  6. Once the check is completed, the troubleshooting status of the gateway and connection is displayed. The Unhealthy status indicates that there's an issue with the resource.

  7. Go to the vpn container in the storage account that you previously specified and download the zip file that was generated during the VPN troubleshoot check session. Network Watcher creates a zip folder that contains the following diagnostic log files:

    Screenshot shows log files created after running VPN troubleshoot check on a virtual network gateway.

    Note

    • In some cases, only a subset of the log files is generated.
    • For newer gateway versions, the IKEErrors.txt, Scrubbed-wfpdiag.txt and wfpdiag.txt.sum have been replaced by an IkeLogs.txt file that contains the whole IKE activity including any errors.

A common misconfiguration error is due to using incorrect shared keys where you can check the IKEErrors.txt to see the following error message:

Error: Authentication failed. Check shared key.

Another common error is due the misconfiguration of the IPsec parameters, where you can find the following error message in the IKEErrors.txt file:

Error: On-premises device rejected Quick Mode settings. Check values.
		based on log : Peer sent NO_PROPOSAL_CHOSEN notify

For a detailed list of fault types that Network Watcher can diagnose and their logs, see Gateway faults and Connection faults.

Next step

Learn how to monitor VPN gateways using Azure Automation: