Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,663 questions
Networks in different subscriptions with error in gateway provisioning when trying to use s2s VPN - Azure
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 2%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAN%3C/text%3E%3C/svg%3E)
Alex Negreiros
80
Reputation points
Good morning everyone!
I hope you are all well.
I have the same tenant, several subscriptions.
In these subscriptions, there are several VNets (in different regions).
I have a VNet Hub, in Subscription A, with peering to several other Vnets (including in other subscriptions).
In this VNet Hub, I have a Virtual Network Gateway (SKU VPNGw1).
The peering is correctly configured, as are the tunnels to the branches in the on-premise environment.
But, when I perform Connection Troubleshooting on VM1 (in Subscription B) to reach an IP of the on-premise network, I receive an error in gateway provisioning.
Is there some kind of limitation that makes this scenario impossible?
Best regards,
Alex Negreiros
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 71%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
Ganesh Patapati 4,320 Reputation points Microsoft External Staff2025-03-12T14:38:39.9433333+00:00 Could you please share a screenshot of the error for further troubleshooting? Also, verify the gateway tunnel status from Azure to on-prem and ensure it is enabled.
To allow gateway traffic to flow from spoke to hub and connect to remote networks, you must Configure the peering connection in the hub to allow gateway transit. Configure the peering connection in each spoke to use remote gateways. Configure all peering connections to allow forwarded traffic.
Verify the on-prem IP address space is whitelisted on the Azure Local Network Gateway. If these settings are correct, you should be able to ping/connect from Azure to on-prem.
Also make sure that On-prem firewall traffic is allowed from azure to on-prem and vice versa, sometimes windows firewall at On-prem machine will block the Ping traffic you just make sure that it is allowed.
Can you please update us if the action plan provided by was helpful?
Should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Sign in to comment
Sign in to answer