Azure Container Apps
An Azure service that provides a general-purpose, serverless container platform.
570 questions
Azure Container App routing over one VPN gateway, not routing over second
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 80%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
David
0
Reputation points
We have an Azure Container App sitting on VNET subnet. We also have a VNET Gateway we're using as a VPN device to connect S2S to two different sites. The container app is able to route to one site without issue, but isn't routing to the second. Both connections have a local gateway with the target IP range configured, and both connections are showing as "Active". One connection has a NAT config, the other does not.
Does anyone have any ideas or troubleshooting steps for this issue?
Thanks!
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 0%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
Silvia Wibowo 5,441 Reputation points Microsoft Employee2025-03-11T01:15:49.98+00:00 Hi @David , please clarify:
- Which connection works: the one with NAT or the one without?
- Is there any IP overlap that requires you to put NAT?
- Do you use dynamic routing (BGP) or static routing for your VPN?
- Have you checked your on-premises routing configuration, the site that does not work? Does it have a route to Azure virtual network?
-
David 0 Reputation points
2025-03-11T01:41:25.1466667+00:00 Hi - the one without NAT is the one that is not working. The NAT'd one works great.
We do not use BGP routing.
We've confirmed on-prem has a route - we're able to get connectivity from an Azure VM to on-prem, the issue is specific to our Container Apps instance (which is unable to get the same connectivity).
-
Deleted
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
-
-
David 0 Reputation points
2025-03-12T00:20:58.9566667+00:00 Thanks for the reply - rough network diagram attached.
s2s_connection_1/Onprem network 1is reachable fromcontainer_app,s2s_connection_2/Onprem network 2is not.Aside from the address space, NAT, and IKE config, there's no difference in how they're set up on the Azure side. They are on different ports. The strange thing is that
vm_1is able to reach boths2s_connection_1ands2s_connection_2, the issue appears to be specific to the container app.199.xxx.xx.xx is technically a public address, but it is in the
local_gateway_2address space, so the container_app traffic should be routed to thevnet_gateway... wondering if the break is with that routing. -
Silvia Wibowo 5,441 Reputation points Microsoft Employee
2025-03-12T01:23:20.3933333+00:00 Hi @David , isn't IP address 199.x.x.x a public IP address? Container app would try to go out to internet to reach that address. Your VM probably reached that address via internet, not VPN.
Sign in to comment
Sign in to answer