Hi, So I have a Azure Site to Site VPN that connect to my client network and the status of the VPN shows connected but there is no data going in and out. I have a Azure VM and I am trying to RDP to a server in the client network and it is not reachable. Azure VM is in the default subnet 172.20.0.0/24 Gateway is in GatewaySubnet 172.20.1.0/27 I have added a route table which is associated to the GatewaySubnet that routes to the client network. And the Client has allowed allowed this route 172.20.1.0/27 on their end. Can you let me know what am I missing in here or is there anything incorrect here? I cannot establish an RDP on a client server on their network using a Azure VM in my subnet

Hi @ Faisal Kabeer , please check the routing table of your Azure VM. There should be a route to the "client network" using the VPN Gateway connection. Also verify the routing in the "client network". There should be a route defined that points to the Azure VM subnet (172.20.0.0/24). (If the reply was helpful please don't forget to upvote and/or accept as answer , thank you) Regards Andreas Baumgarten

Site to Site VPN is connected but still can not access resource on the other network

Accepted answer

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-24T18:36:31.2733333+00:00

Hi @Faisal Kabeer ,

please check the routing table of your Azure VM.

There should be a route to the "client network" using the VPN Gateway connection.

Also verify the routing in the "client network". There should be a route defined that points to the Azure VM subnet (172.20.0.0/24).

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.
Ganesh Patapati (Quadrant Resource LLC) 175 Reputation points Microsoft Vendor

2024-08-28T11:11:41.84+00:00

Hi Faisal Kabeer,

Just checking in to see if you have got a chance to see the answer posted by Andreas Baumgarten in resolving the issue.

If it was helpful, please click "Upvote and Accept Answer" on his post to let us know.

We're here to help, so if you have any further questions, don't hesitate to ask.

Thank You.

Faisal Kabeer 20 Reputation points

2024-08-28T11:36:14.58+00:00

@Andreas Baumgarten So in the clients network do they need to mention the routes for both of these:
Azure VM is in the default subnet 172.20.0.0/24

Gateway is in GatewaySubnet 172.20.1.0/27

Because at the moment they have only added this route in there end - GatewaySubnet 172.20.1.0/27

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-28T12:03:41.8566667+00:00

Hi @Faisal Kabeer ,

in the client network they need to know the Azure VM default subnet as well.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-08-28T12:52:35.39+00:00

and how about from my end - Do I need to create routes in azure so that it knows my client network, if yes do I have to create routes for both Default Subnet & Gateway Subnet?

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-28T13:41:57.38+00:00

Hi @Faisal Kabeer ,

as I wrote in my first answer:

The Azure subnets need the routing details for the client network as well.

Basically every network needs the information which way to send the packages to the destination (including the response packages as well).

From Azure to client network (on-premises)

From client network (on-premises) to Azure

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Ganesh Patapati (Quadrant Resource LLC) 175 Reputation points Microsoft Vendor

2024-08-29T13:11:01.97+00:00

Hi Faisal Kabeer,

I’m following up to see if you’ve had a chance to review the answer provided by Andreas Baumgarten regarding your issue. If you found the response helpful, please click "Upvote and Accept Answer" on his post to let us know.

If you have any further questions or need additional assistance, feel free to ask. We’re here to help!

Thank you!

Best regards,

Ganesh Patapati

Faisal Kabeer 20 Reputation points

2024-08-30T06:19:23.01+00:00

@Andreas Baumgarten I had to change the subnet range because as per client. so now the new address space is 172.20.1.0/26 under which there is 02 subnets
172.20.1.0/27 - Default Subnet
172.20.1.32/27 - Gateway Subnet

And I have asked the client to to allow route 172.20.1.0/26 on their end. and I have created route table in azure to their network. then I have established the connection but now that the status of the connection is "Not Connected"

Noted: The client is using a policy based VPN where as on Azure I have a route based firewall but I have enabled - Use policy based traffic selector option as well. I have attached a snip above.

Is there anything I am missing here which could be the reason my the connection is still not connect status.

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-30T06:25:33.76+00:00

Hi @Faisal Kabeer ,

the Azure VPN Site To Site connection to the on-premises client network worked before?

Are there any changes in the VPN Site To Site configuration or on the on-premises configuration beside different IP ranges?

Please take a look here: Troubleshooting: An Azure site-to-site VPN connection can't connect and stops working

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-08-30T06:32:06.8466667+00:00

Yes earlier with the old subnet the connected status was "connected"

I do not think so there is any changes with the configuration because I used the same one. any changes on the whole configuration is the "address space" previously it was 172.20.0.0/20 under which i had these -
Azure VM is in the default subnet 172.20.0.0/24

Gateway is in GatewaySubnet 172.20.1.0/27 (This was the only range the client allowed at their end)

The client was not happy to allow this 172.20.0.0/20 which it was a huge scope.

So then I had the change the address space to this 172.20.1.0/26 which has

172.20.1.0/27 - Default Subnet

172.20.1.32/27 - Gateway Subnet

They have allowed 172.20.1.0/26 this space from there end which means both my deafult subnet & Gateway Subnet are allowed to communicated in their end right?

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-30T08:26:51.77+00:00

Hi @Faisal Kabeer ,

have you checked through the troubleshooting guide I provided above?

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-08-30T08:42:45.14+00:00

@Andreas Baumgarten Yes I did and everything seems to be correctly set

Above are the parameters and both my side and client side are having the same parameters.

Just wondering where I am missing

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-30T08:48:18.1766667+00:00

Hi @Faisal Kabeer ,

anything in the logs of the Azure VPN Gateway or/and on-premises VPN Gateway?
Troubleshoot Azure VPN Gateway using diagnostic logs

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-08-30T09:51:27.04+00:00

@Andreas Baumgarten Yes I have found this in the logs query_data.txt in the logs

Andreas Baumgarten 107.9K Reputation points MVP

2024-08-30T10:33:56.86+00:00

Hi @Faisal Kabeer ,

it looks like the IKE Tunnel could not be established.

Could you please verify on both ends if the settings are matching.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-09-02T09:01:17.6866667+00:00

@Andreas Baumgarten I was able to sort this out, Thank you very much, I have an other query.

How/Can I create a Point to Site Connection so that user's can connect to the site to site VPN and access client's network?

Andreas Baumgarten 107.9K Reputation points MVP

2024-09-02T09:15:55.04+00:00

Hi @Faisal Kabeer ,

maybe you like to share what the issue was with the tunnel connection?
This might be helpful for the community as well.

For Point To Site configuration please take a look here: Configure server settings for P2S VPN Gateway certificate authentication

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-09-02T09:30:12.3866667+00:00

@Andreas Baumgarten hey sure, so the client only allowed the Gateway Subnet from their end which is why we could not communicate to their network, I asked them to allow the whole address space that is when it worked.

Also I created a P2S connection with the link you provided but I will still not able to connect to it. the address space I gave for my P2S was 10.0.0.0/24 and I even added a route for this in our subnet. Does the client also need to allow the route 10.0.0.0/24 in this end?

But I though the P2S works in a way that user's use the P2S connection to establish with the Site to Site and then the traffic goes through that tunnel so does the P2S IP address 10.0.0.0/24 gets exposed to the client no right?

Andreas Baumgarten 107.9K Reputation points MVP

2024-09-02T09:53:47.8466667+00:00

Hi @Faisal Kabeer ,

thanks for sharing the details.

By default the P2S VPN connection should be able to connect to the Azure resources.

If the computer using the P2S VPN connection should be able to connect to the on-premises network you need to add the routing for this (like described for the S2S VPN connection).

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-09-02T09:58:58.08+00:00

So does the Client also need to allow the routes for whatever IP the P2S is using?

Andreas Baumgarten 107.9K Reputation points MVP

2024-09-02T10:51:44.4466667+00:00

Hi @Faisal Kabeer ,

I am not 100% sure and I can't test this at the moment. Please give it a try by yourself.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Faisal Kabeer 20 Reputation points

2024-09-02T10:54:45.5333333+00:00

Thanks alot @Andreas Baumgarten
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Site to Site VPN is connected but still can not access resource on the other network

0 additional answers

Your answer