Troubleshooting an Azure site-to-site VPN connection

Go back to Tutorial

After you configure a site-to-site VPN connection between an on-premises network and an Azure virtual network, the VPN connection suddenly stops working and cannot be reconnected. In this, we will learn the troubleshooting steps to help you resolve this problem.

Troubleshooting steps

An Azure site-to-site VPN connection allows on-premises resources to securely communicate with Azure resources over an encrypted VPN tunnel. However, if the VPN connection is not functioning properly, it can impact the availability and performance of critical applications and services. Here are some troubleshooting steps to resolve issues with an Azure site-to-site VPN connection:

Step 1. Check whether the on-premises VPN device is validated

Firstly, check whether you are using a validated VPN device and operating system version. And, if the device is not a validated VPN device, you might have to contact the device manufacturer to see if there is a compatibility issue.

Step 2. Verify the shared key

Firstly, compare the shared key for the on-premises VPN device to the Azure Virtual Network VPN to make sure that the keys match. However, to view the shared key for the Azure VPN connection, use one of the following methods:

Azure portal

Firstly, go to the VPN gateway site-to-site connection that you created.
Then, in the Settings section, click Shared key.

Azure PowerShell

For the Azure Resource Manager deployment model:

Azure PowerShell
Get-AzVirtualNetworkGatewayConnectionSharedKey -Name -ResourceGroupName

For the classic deployment model:

Azure PowerShell
Get-AzureVNetGatewayKey -VNetName -LocalNetworkSiteName

Step 3. Verify the VPN peer IPs

The IP definition in the Local Network Gateway object in Azure should match the on-premises device IP.
The Azure gateway IP definition that is set on the on-premises device should match the Azure gateway IP.

Step 4. Check UDR and NSGs on the gateway subnet

First, Check for and remove user-defined routing (UDR) or Network Security Groups (NSGs) on the gateway subnet. And then, test the result. If the problem is resolved, validate the settings that UDR or NSG applied.

Step 5. Check the on-premises VPN device external interface address

Firstly, if the Internet-facing IP address of the VPN device is included in the Local network definition in Azure, you might experience sporadic disconnections.
Secondly, the device’s external interface must be directly on the Internet. There should be no network address translation or firewall between the Internet and the device.
Thirdly, to configure firewall clustering to have a virtual IP, you must break the cluster and expose the VPN appliance directly to a public interface that the gateway can interface with.

Step 6. Verify that the subnets match exactly (Azure policy-based gateways)

Firstly, verify that the virtual network address space(s) match exactly between the Azure virtual network and on-premises definitions.
Then, verify that the subnets match exactly between the Local Network Gateway and on-premises definitions for the on-premises network.

Step 7. Verify the Azure gateway health probe

Firstly, open health probe by browsing URL.
Then, click through the certificate warning.
Then, if you receive a response, the VPN gateway is considered healthy. And, if you don’t receive a response, the gateway might not be healthy or an NSG on the gateway subnet is causing the problem. The following text is a sample response:

XML
<?xml version=”1.0″?> <string xmlns=”http://schemas.microsoft.com/2003/10/Serialization/”>Primary Instance: GatewayTenantWorker_IN_1 GatewayTenantVersion: 14.7.24.6</string>

Step 8. Check whether the on-premises VPN device has the perfect forward secrecy feature enabled

The perfect forward secrecy feature can cause disconnection problems. If the VPN device has perfect forward secrecy enabled, disable the feature. Then update the VPN gateway IPsec policy.

Troubleshooting an Azure site-to-site VPN connection AZ-104 online course

AZ-104 Exam Practice Questions

Question: You have configured an Azure site-to-site VPN connection between your on-premises network and an Azure virtual network. However, you are unable to access resources in the Azure virtual network from the on-premises network. What could be the issue?

A) Incorrect VPN type configured on the Azure VPN gateway

B) Incorrect routing tables on the on-premises network

C) Firewall settings blocking traffic over the VPN connection

D) Incorrect IP address configured on the Azure VPN gateway

Answer: b) Incorrect routing tables on the on-premises network. The routing tables on both the on-premises and Azure networks need to be correctly configured to route traffic between the two networks through the VPN connection.

Question: You are monitoring network traffic between your on-premises network and an Azure virtual network over a site-to-site VPN connection. You notice that traffic is being dropped at the Azure VPN gateway. What could be the issue?

A) Incorrect subnet configured on the Azure VPN gateway

B) Incorrect shared key configured on the on-premises VPN device

C) Firewall settings blocking traffic over the VPN connection

D) Incorrect VPN type configured on the on-premises VPN device

Answer: c) Firewall settings blocking traffic over the VPN connection. Firewall settings on both the on-premises and Azure networks need to be correctly configured to allow traffic over the VPN connection.

Question: You have configured an Azure site-to-site VPN connection between your on-premises network and an Azure virtual network. However, you are experiencing performance issues when accessing resources in the Azure virtual network from the on-premises network. What could be the issue?