No traffic is passing between on-premises and Azure VMs.

Question

I have configured a Site-to-Site VPN between my on-premises network (Cisco ASA firewall) and Azure VPN Gateway (Route-Based VPN). The VPN tunnel shows "Connected" in the Azure portal, but no traffic is passing between on-premises and Azure VMs.

Network Setup Details:

On-Premises Device: Cisco ASA

Azure VPN Gateway SKU: VpnGw1 (Route-Based)

IKE Version: IKEv2

IPsec Parameters: AES256, SHA256, DH Group 14

On-Premises Subnet: 10.1.0.0/16

Azure VNet Subnet: 10.2.0.0/16

Firewall Rules: UDP 500, UDP 4500, ESP allowed

BGP Disabled

What I Have Checked So Far:

VPN Tunnel is Established (checked via show crypto isakmp sa on ASA)

No packet loss or latency issues between on-prem and Azure (tested with ICMP)

On-Prem Firewall Allows VPN Traffic

Azure Network Security Group (NSG) is Configured Correctly (allows traffic on necessary ports)

No Overlapping IP Subnets

Despite this, traffic is not reaching Azure from on-prem, or vice versa.

Questions:

Why is the VPN tunnel up but no traffic is passing?

How can I troubleshoot and fix this issue?

Answer 1

@Tej Devansh

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Routing Issues on On-Prem or Azure Side.

1. Check if the on-premises routes are properly set to send traffic to Azure via the VPN tunnel.
2. In Azure, ensure User-Defined Routes (UDR) are not forcing traffic elsewhere (e.g., sending 10.2.0.0/16 traffic to another appliance).
3. If you're testing with an Azure VM, ensure IP forwarding is enabled on the NIC if the VM is acting as a router.

Azure NSG or On-Prem Firewall Blocking Specific Traffic.

1. Use a diagnostic flow tool in Azure Network Watcher to check where packets are getting dropped.

Status "Connected" - traffic not flowing:

• Check for and remove the user-defined routing (UDR) and network security groups (NSGs) on the gateway subnet and then test the result. If the problem is resolved, validate the settings that UDR or NSG applied. A user-defined route on the gateway subnet may be restricting some traffic and allowing other traffic. This makes it appear that the VPN connection is unreliable for some traffic, and good for others.
• Check the on-premises VPN device external interface address.
  • If the internet-facing IP address of the VPN device is included in the Local network definition in Azure Stack Hub, you might experience sporadic disconnections.
  • The device's external interface must be directly on the internet. There should be no network address translation or firewall between the internet and the device.
  • To configure firewall clustering to have a virtual IP, you must break the cluster and expose the VPN appliance directly to a public interface with which the gateway can interface.
• Verify that the subnets match exactly.
  • Verify that the virtual network address space(s) match exactly between the Azure Stack Hub virtual network and on-premises definitions.
  • Verify that the subnets match exactly between the Local Network Gateway and on-premises definitions for the on-premises network.

Refer: https://stackoverflow.com/questions/40134015/azure-site-to-site-vpn-does-not-let-traffic-through

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect?wt.mc_id=knowledgesearch_inproduct_9ccfc0ae-fdbf-4e6d-99fc-db7dd8a70d95#troubleshooting-steps

Refer: https://learn.microsoft.com/en-us/azure-stack/user/site-to-site?view=azs-2501&wt.mc_id=knowledgesearch_inproduct_9ccfc0ae-fdbf-4e6d-99fc-db7dd8a70d95&tabs=az#status-connected---traffic-not-flowing

If everything appears correct, restart the VPN connection on both ends.

If issues persist, please share the below details

1. Run a trace route from an Azure VM to an on-prem VM and vice versa to identify where packets drop.
2. Check Azure VPN Gateway diagnostic logs for dropped traffic reasons.
3. Capture packets on both ends to see if traffic is reaching Azure and whether replies are sent but lost.

---

I hope this has been helpful!

If above is unclear and/or you are unsure about something add a comment below.

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.