Site to Site VPN Connection

VATIKA SAXENA 20

I have configured site to site VPN as per the Microsoft documentation.

We have created:

Vnet

Vnet Gateway

Local network gateway

Connection

We have configured with all the client's requirement.

We are seeing connection status: Unknown

We have also created the policy in their Firewall still we are not able to connect that VM with Private IP.

KINDLY HELP!

Rajini 0 Reputation points

2024-10-25T12:46:14.3966667+00:00

Hi Vatika,

Have you checked this? https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect
VATIKA SAXENA 20 Reputation points

2024-10-25T13:49:22.5166667+00:00

I have checked

But i want to be sure that from Azure side it is well configured.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-10-28T04:03:26.0633333+00:00
Hi @VATIKA SAXENA ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Could you please cross-verify the below steps for Site-to-Site configuration:

From Cloud side:

Deploy a Virtual Network and a name specific subnet called gateway subnet.

Deploy the VPN gateway in the gateway subnet

Deploy the Local Network Gateway and provide the On-Prem Public IP and Local LAN IP series. [Please select the same region for both VPN and LNG]

Go to connections in LNG:

Give the connection name

Connection type: Site to Site.

Virtual Network gateway (It will select automatically which you have created)

Select the LNG which you have created.

Give a Pre-Shared Key (Alpha Numeric) and share it in both the environments (Cloud & On-Prem)

IKE Protocol: IKEv2

Leave the options as default and create a connection.

Go to Network interface of you On-Prem server and configure a static route by giving the pre-shared key value which you have given in Cloud.

Configure the static route under IPv4 by selecting the interface which you have created and give the rest of the details.

Go to Network interface and select the respective interface and right click on it and connect, once it is connected.

Go to LNG and the connection status will be connected.

If you are still facing the same issue after following the above, please refer to below points:

1. Please make sure you have not used the NSGs on your gateway subnet level. The NSG on the gateway subnet are not supported. Associating a network security group to this subnet might cause your virtual network gateway to stop functioning as expected. Please refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal#view

2. Check the IP Flow verify in Network Watcher, whether the access is allowed or not.

Troubleshoot Azure VPN Gateway using diagnostic logs, you can troubleshoot multiple VPN gateway-related events including configuration activity, VPN Tunnel connectivity.

Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Please perform a packet capture on your S2S VPN to help pinpoint this issue.

Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/packet-capture

Also, did you try to reset the Azure VPN gateway twice as recommended?

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway

If all that's fine, then also check that your local firewall is configured to route traffic to through the right interface.

Finally try to run e.g. tracert <remote vm ip> and see what it returns.

If the above mentioned did not help, could you please share your entire configuration/network diagram of your setup with details if possible so that we can assist you better.

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
VATIKA SAXENA 20 Reputation points

2024-10-28T09:53:21.6666667+00:00

Hi,

As the Client give us the range of IPV4 addresses 10.50.50.0-250 and subnet 255.255.255.0

In Azure, we provided the Address space: 10.50.0.0/16 and range 10.50.0.0 - 10.50.255.255

Subnet1: 10.50.0.0/24

Gateway Subnet: 10.50.50.0/24

Note:- VM is using Subnet1

Could you please help me to verify the correct details for the Virtual Network in Azure?
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-10-29T01:37:13.0633333+00:00
Hi @VATIKA SAXENA ,

Greetings!

As you mentioned you have deployed a VNet (10.50.0.0/16) and Subnets like, Subnet1 (10.50.0.0/24) & gateway subnet (10.50.50.0/24)

In that gateway subnet (10.50.50.0/24) deploy a VPN gateway.

Also deploy a Local Network gateway by providing the IP address (On-Prem device Public IP) and Address Space (On-Prem Local LAN IP series, Ex: 192.168.0.0/24).

Go to connections in LNG:

Give the connection name

Connection type: Site to Site.

Virtual Network gateway (It will select automatically which you have created)

Select the LNG which you have created.

Give a Pre-Shared Key (Alpha Numeric) and share it in both the environments (Cloud & On-Prem)

IKE Protocol: IKEv2

Refer the document to cross verify the configurations from azure end: https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

If you are still facing the issue, please refer the above troubleshooting steps and let us know the status.

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai prasanna.
VATIKA SAXENA 20 Reputation points

2024-10-29T12:39:56.3366667+00:00

We have configure these settings and also downloaded the configuration file currently we are able to see Connection status: Not Connected
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-04T06:56:49.6733333+00:00
Hi @VATIKA SAXENA ,

Greetings!

Sorry for the delay in response.

Could You please share the additional information like logs so that we can assist you further.

Also, please check Troubleshooting Azure VPN Gateway using diagnostic logs | Microsoft Lear

Especially the below mentioned and please let us know.

GatewayDiagnosticLog

TunnelDiagnosticLog

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-06T00:52:10.4+00:00

Hi @VATIKA SAXENA ,

Greetings of the day!

I would like to follow up with the thread.

Could you please go through the last comment and provide us the required information to drive the thread further.

Regards,

Sai Prasanna.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-07T01:45:04.1166667+00:00

Hi @VATIKA SAXENA ,

Greetings of the day!

I would like to follow up with the thread.

Could you please go through the last comment and provide us the required information to drive the thread further.

If you need any further assistance, please don't hesitate to reach out to us. We are happy to assist you.

Regards,

Sai Prasanna.
VATIKA SAXENA 20 Reputation points

2024-11-07T09:27:48.9733333+00:00

I have checked everything from azure side i don't have access to client's VPN so that i can look into it.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-11T07:04:07.31+00:00

Hi @VATIKA SAXENA,

Thanks for getting back.

Kindly provide the VPN gateway logs from azure side, particularly on: GatewayDiagnosticLog & TunnelDiagnosticLog, so that we can go through it and get back to you with an update.For your reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Thanks,

Sai Prasanna.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-12T07:40:16.8766667+00:00

Hi @VATIKA SAXENA ,

Greetings!

Could you please go through the last comment and provide us the required information to drive the thread further.

Regards,

Sai Prasanna.
VATIKA SAXENA 20 Reputation points

2024-11-27T14:22:29.2+00:00

i cant find the diagnostic logs form azure
VATIKA SAXENA 20 Reputation points

2024-11-27T14:26:41.8266667+00:00

in VPN Troubleshoot i am seeing
Your VPN connectivity is impacted because the S2S VPN tunnels are disconnected

Detail

The S2S VPN tunnels could not connect because of IKE or connectivity issues

Last run
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-28T01:41:57.78+00:00
Hi @VATIKA SAXENA ,

To enable VPN Gateway Diagnostics, you need to use Azure Monitor.

You can get the below resource logs once you enable VPN diagnostics:

GatewayDiagnosticLog - Contains resource logs for gateway configuration events, primary changes and maintenance events.

TunnelDiagnosticLog - Contains tunnel state change events. Tunnel connect/disconnect events have a summarized reason for the state change if applicable.

RouteDiagnosticLog - Logs changes to static routes and BGP events that occur on the gateway.

IKEDiagnosticLog - Logs IKE control messages and events on the gateway.

Could you provide the screenshots of GatewayDiagnosticLog, TunnelDiagnosticLog, IKE Logs and RouteDiagnosticLog so that we could identify the exact issue and can assist you better.

In your Azure portal, search for Monitor. Go to Diagnostics settings blade within Monitor and search for your VPN gateway in which you would like to enable diagnostics. To turn on diagnostics, double-click the gateway and then select Turn on diagnostics. Fill in the details, and ensure that Send to Log Analytics and TunnelDiagnosticLog are selected. Choose the Log Analytics Workspace where you want to send the logs to. It may take a few hours for the data to show up initially.

Refer: https://learn.microsoft.com/en-us/answers/questions/216637/how-to-enable-vpn-gateway-diagnostics

https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference

Thanks,

Sai.
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-11-29T09:48:18.56+00:00

Hi @VATIKA SAXENA ,

Greetings!

Following up to see if the above suggestion was helpful. Please share the requested information so that we could assist you further.

Thanks,

Sai.
VATIKA SAXENA 20 Reputation points

2024-11-29T11:32:10.2566667+00:00

Created the Monitor and log analytics workspace still unable to get the logs.
VATIKA SAXENA 20 Reputation points

2024-11-29T13:40:40.72+00:00

PT1H.txt
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-12-02T01:33:55.56+00:00

Hi @VATIKA SAXENA,

Please share the screenshots of GatewayDiagnosticLog, TunnelDiagnosticLog, IKE Logs and RouteDiagnosticLog so that we could identify the exact issue and can assist you better.

Thanks,

Sai.
VATIKA SAXENA 20 Reputation points

2024-12-03T14:50:00.7433333+00:00

hi @Sai Prasanna Sinde

We are only able to see the following IKE logs.

Kindly suggest us

Previously I also get below issue on Client Side
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-12-05T09:20:43.7766667+00:00

Hi @VATIKA SAXENA,

Thanks for sharing the logs.

*The S2S VPN tunnels could not connect because of IKE or connectivity issues.
*
Please try the below troubleshooting steps and let us know if it works for you.

To resolve the problem, first, try to reset the Azure VPN gateway. If the problem persists, follow these steps to identify the cause of the problem.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect

Thanks,

Sai.
VATIKA SAXENA 20 Reputation points

2024-12-05T12:31:33.89+00:00

Hi ,

We have successfully connected with the Connection.

Thanks for the help!
Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-12-06T02:48:35.9133333+00:00

Hi @VATIKA SAXENA,

Glad that your issue has been resolved.

Could you please share the solution you followed so that we can post it as an answer as it would be helpful to the other community members facing the same issues.

Thanks,

Sai.
VATIKA SAXENA 20 Reputation points

2024-12-06T17:15:46.6266667+00:00

As i mentioned created the necessary resources that is used for setup the connection:

https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

Follow this document.

Secondly, Configured everything as per the Client's Network and troubleshoot it through VPN troubleshoot capture (Health check) and then resolve the issue.

Thirdly we should download the configuration file from the Connections and send to Client so that they will not misconfigured the Routes and Policy.

I have followed above points and able to connect successfully within the Client Network.

Thanks,

Vatika

Accepted answer

Sai Prasanna Sinde 2,685 Reputation points Microsoft Vendor

2024-12-09T01:15:53.5133333+00:00

Hi @VATIKA SAXENA

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: Site to Site VPN Connection, we are seeing connection status: Unknown.

Solution: As i mentioned created the necessary resources that is used for setup the connection:https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

Secondly, configured everything as per the Client's Network and troubleshoot it through VPN troubleshoot capture (Health check) and then resolve the issue.

Thirdly we should download the configuration file from the Connections and send to Client so that they will not misconfigure the Routes and Policy.

I have followed above points and able to connect successfully within the Client Network.

Please don’t forget to close the thread by clicking "Accept answer" so that other community members facing the same issues can find the right answers.

Your contribution is highly appreciated.

Thanks,

Sai.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Site to Site VPN Connection

0 additional answers

Your answer