Hello Microsoft Azure Community , I've been created S2S VPn to our Virtual HUB from SaaS Skytap Application according to Skytap documentation. Both sides are same parameters (PSK etc) and all the time I have Connectivity status : Not Connected , any idea what I missed or wrong cofigured ? Thank you

@Maciej Rybak , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are setting up a VPN Tunnel between vWAN and a third party Device. You can leverage the Diagnostic Logs to understand what's the problem between the appliances. Especially " TunnelDiagnosticLog " and " RouteDiagnosticLog " Can you share the error messages you see in the above logs? Cheers, Kapil

Azure Virtual WAN S2S VPN to Skytap App

Accepted answer

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-10-25T07:45:53.4233333+00:00
@Maciej Rybak ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are setting up a VPN Tunnel between vWAN and a third party Device.

You can leverage the Diagnostic Logs to understand what's the problem between the appliances.

Especially "TunnelDiagnosticLog"

and "RouteDiagnosticLog"

Can you share the error messages you see in the above logs?

Cheers,

Kapil
Please sign in to rate this answer.
Maciej Rybak 40 Reputation points

2024-10-25T08:31:43.2166667+00:00

Hello ,

Thanks for your replay

error log shows this:

(Error)[Remote] 206.198.149.x:500 [Local] 20.157.65.x:500 [SESSION_ID] {e7c11644-ab33-4f25-8d8e-91c61b42d6db} [ConnType] IKEv2-S2S [ICookie] 0x94A6C6EFB6D08F4E [RCookie] 0x0 [TunnelId] 0x3 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Outbound [FailureDirection] Outbound [ErrorCode] 0x35ED [ErrorMessage] Negotiation timed out

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-10-28T04:34:33.5366667+00:00

@Maciej Rybak ,

The error indicates that the OnPrem Device did not respond to the SA initiation request from Azure VPN Gateway.

[FailureDirection] Outbound

[ErrorMessage] Negotiation timed out

For the same time stamp, please check the OnPrem device logs as well

Did the OnPrem device receive the negotiation packets from VPN Gateway? (for MM - Main Mode)

If so, did the device respond?

Or did the device never received the packet from VPN Gateway in the first place

Cheers,

Kapil

Maciej Rybak 40 Reputation points

2024-10-28T07:10:57.4666667+00:00

Hello ,

This is not device , this is Skytap - SaaS application which need VPN site to site to correct work with Azure environments. Unfortunately there are no any logs ;/ But I've noticed one additional strange thing , I'm not able to ping IP address from this Skytap App , maybe this is te reason ? What do you think ?

Thank you

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-10-28T08:50:59.71+00:00

@Maciej Rybak , Not able to ping the Public IP of the VPN Gateway is expected.

If you want to check the health of the VPN Gateway,

you should use https://<YourVirtualNetworkGatewayIP>:8081/healthprobe

See : Verify the Azure gateway health probe

In that case, please check with your vendor on how to collect logs or do a packet dump on the 3rd party.

From Azure logs, it appears as if the application is not responding to the MM negotiation packets.

Cheers,

Kapil

Maciej Rybak 40 Reputation points

2024-10-28T09:31:49.9566667+00:00

No no , I mean 3rd party public IP is not pingable and with my VPN Gateway everything is ok.

I gues there can be some issue with parameters in Phase 1 on this 3rd part appliction.

Let see today I will have meeting with them

At the moment Thank you for your help

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-10-28T10:07:46.14+00:00

@Maciej Rybak , You are welcome :)

Let us know how it goes

Maciej Rybak 40 Reputation points

2024-10-30T09:44:33.55+00:00

Hello , issue has been fixed , finally in this 3rd part application Virtual Machine hast to be online to properly work communication in VPN tunnel , a little tricky but that's true.

Thanks you for your help

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2024-10-30T09:50:45.52+00:00

@Maciej Rybak ,

You are most welcome. Glad we could be of service

I would greatly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Virtual WAN S2S VPN to Skytap App

0 additional answers

Your answer