Azure VPN Site-to-site connected but host not reachable Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern) Come Celebrate our 10 Year Anniversary!Routing Help Needed - Site to Site VPNAzure VPN and On Site routingRouting in Azure between point-to-site and site-to-site networksCannot initiate connections from AzureVM to On Premises machines via Dynamic route site-to-site VPNAzure vpn is establish but causing delay or no traffic sometimesCannot connect back to local site over S2S connection via Azure Point-to-Site VPN clientAzure Site-to-Site VPN Tunnel Cisco ASA 8.2VPN gateway not produce trafficadding machines to VPN gateway inside AzureRoute traffic between two Azure site-to-site VPN locations

Moving a wrapfig vertically to encroach partially on a subsection title

White walkers, cemeteries and wights

How does light 'choose' between wave and particle behaviour?

Simple Http Server

Why datecode is SO IMPORTANT to chip manufacturers?

Most effective melee weapons for arboreal combat? (pre-gunpowder technology)

Mounting TV on a weird wall that has some material between the drywall and stud

GDP with Intermediate Production

What would you call this weird metallic apparatus that allows you to lift people?

Does silver oxide react with hydrogen sulfide?

Printing attributes of selection in ArcPy?

The Nth Gryphon Number

Why is a lens darker than other ones when applying the same settings?

How to change the tick of the color bar legend to black

Central Vacuuming: Is it worth it, and how does it compare to normal vacuuming?

What initially awakened the Balrog?

Should a wizard buy fine inks every time he want to copy spells into his spellbook?

Special flights

Did pre-Columbian Americans know the spherical shape of the Earth?

How to align enumerate environment inside description environment

Relating to the President and obstruction, were Mueller's conclusions preordained?

The test team as an enemy of development? And how can this be avoided?

Why not send Voyager 3 and 4 following up the paths taken by Voyager 1 and 2 to re-transmit signals of later as they fly away from Earth?

Can an iPhone 7 be made to function as a NFC Tag?



Azure VPN Site-to-site connected but host not reachable



Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Routing Help Needed - Site to Site VPNAzure VPN and On Site routingRouting in Azure between point-to-site and site-to-site networksCannot initiate connections from AzureVM to On Premises machines via Dynamic route site-to-site VPNAzure vpn is establish but causing delay or no traffic sometimesCannot connect back to local site over S2S connection via Azure Point-to-Site VPN clientAzure Site-to-Site VPN Tunnel Cisco ASA 8.2VPN gateway not produce trafficadding machines to VPN gateway inside AzureRoute traffic between two Azure site-to-site VPN locations



.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








0















Using Azure gateway VPN I created a site to site connection with another vpn device (checkpoint) over which I have no control (customer endpoint).



I created the connection, using their public ip, declared the secret key and for local address space I discussed with the client what 'local' IP is desired from both sides. We agreed to an IP in the 172.0.0.0 range.



The gateway connection says succeeded/connected, and I see very little traffic in the data-out field (kb's not mb's).



However, when I try to ping the local address space (172.xxx.xxx.xxx) from my windows server 2016 VM I only get Request timed out-errors.



Do I need to create additional routes in windows? I tried adding route



 route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 0.0.0.0


but the host is still unreachable.



Any Ideas? Thanks



EDIT: added some progress below



Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route
"route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4"



and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?



Edit 2



By now, when running the vpn diag. log I do see some traffic, but I still cannot reach the other side.



Connectivity State : Connected
Remote Tunnel Endpoint : XXX.XXX.XXX.XXX
Ingress Bytes (since last connected) : 360 B
Egress Bytes (since last connected) : 5272 B
Ingress Packets (since last connected) : 3 Packets
Egress Packets (since last connected) : 130 Packets
Ingress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Egress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Bandwidth : 0 b/s
Peak Bandwidth : 0 b/s
Connected Since : 9/18/2017 5:33:18 AM









share|improve this question
























  • Could you try to RDP your local PC, ICMP package may block by Firewall.

    – Shui shengbao
    Sep 14 '17 at 6:44











  • Or you could try to RDP Azure VM from your local PC?

    – Shui shengbao
    Sep 14 '17 at 6:47











  • Hi, could you do this successful?

    – Shui shengbao
    Sep 14 '17 at 7:09











  • I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

    – user2713516
    Sep 14 '17 at 8:14












  • According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

    – Shui shengbao
    Sep 14 '17 at 8:17

















0















Using Azure gateway VPN I created a site to site connection with another vpn device (checkpoint) over which I have no control (customer endpoint).



I created the connection, using their public ip, declared the secret key and for local address space I discussed with the client what 'local' IP is desired from both sides. We agreed to an IP in the 172.0.0.0 range.



The gateway connection says succeeded/connected, and I see very little traffic in the data-out field (kb's not mb's).



However, when I try to ping the local address space (172.xxx.xxx.xxx) from my windows server 2016 VM I only get Request timed out-errors.



Do I need to create additional routes in windows? I tried adding route



 route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 0.0.0.0


but the host is still unreachable.



Any Ideas? Thanks



EDIT: added some progress below



Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route
"route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4"



and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?



Edit 2



By now, when running the vpn diag. log I do see some traffic, but I still cannot reach the other side.



Connectivity State : Connected
Remote Tunnel Endpoint : XXX.XXX.XXX.XXX
Ingress Bytes (since last connected) : 360 B
Egress Bytes (since last connected) : 5272 B
Ingress Packets (since last connected) : 3 Packets
Egress Packets (since last connected) : 130 Packets
Ingress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Egress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Bandwidth : 0 b/s
Peak Bandwidth : 0 b/s
Connected Since : 9/18/2017 5:33:18 AM









share|improve this question
























  • Could you try to RDP your local PC, ICMP package may block by Firewall.

    – Shui shengbao
    Sep 14 '17 at 6:44











  • Or you could try to RDP Azure VM from your local PC?

    – Shui shengbao
    Sep 14 '17 at 6:47











  • Hi, could you do this successful?

    – Shui shengbao
    Sep 14 '17 at 7:09











  • I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

    – user2713516
    Sep 14 '17 at 8:14












  • According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

    – Shui shengbao
    Sep 14 '17 at 8:17













0












0








0








Using Azure gateway VPN I created a site to site connection with another vpn device (checkpoint) over which I have no control (customer endpoint).



I created the connection, using their public ip, declared the secret key and for local address space I discussed with the client what 'local' IP is desired from both sides. We agreed to an IP in the 172.0.0.0 range.



The gateway connection says succeeded/connected, and I see very little traffic in the data-out field (kb's not mb's).



However, when I try to ping the local address space (172.xxx.xxx.xxx) from my windows server 2016 VM I only get Request timed out-errors.



Do I need to create additional routes in windows? I tried adding route



 route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 0.0.0.0


but the host is still unreachable.



Any Ideas? Thanks



EDIT: added some progress below



Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route
"route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4"



and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?



Edit 2



By now, when running the vpn diag. log I do see some traffic, but I still cannot reach the other side.



Connectivity State : Connected
Remote Tunnel Endpoint : XXX.XXX.XXX.XXX
Ingress Bytes (since last connected) : 360 B
Egress Bytes (since last connected) : 5272 B
Ingress Packets (since last connected) : 3 Packets
Egress Packets (since last connected) : 130 Packets
Ingress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Egress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Bandwidth : 0 b/s
Peak Bandwidth : 0 b/s
Connected Since : 9/18/2017 5:33:18 AM









share|improve this question
















Using Azure gateway VPN I created a site to site connection with another vpn device (checkpoint) over which I have no control (customer endpoint).



I created the connection, using their public ip, declared the secret key and for local address space I discussed with the client what 'local' IP is desired from both sides. We agreed to an IP in the 172.0.0.0 range.



The gateway connection says succeeded/connected, and I see very little traffic in the data-out field (kb's not mb's).



However, when I try to ping the local address space (172.xxx.xxx.xxx) from my windows server 2016 VM I only get Request timed out-errors.



Do I need to create additional routes in windows? I tried adding route



 route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 0.0.0.0


but the host is still unreachable.



Any Ideas? Thanks



EDIT: added some progress below



Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route
"route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4"



and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?



Edit 2



By now, when running the vpn diag. log I do see some traffic, but I still cannot reach the other side.



Connectivity State : Connected
Remote Tunnel Endpoint : XXX.XXX.XXX.XXX
Ingress Bytes (since last connected) : 360 B
Egress Bytes (since last connected) : 5272 B
Ingress Packets (since last connected) : 3 Packets
Egress Packets (since last connected) : 130 Packets
Ingress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Egress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets
Bandwidth : 0 b/s
Peak Bandwidth : 0 b/s
Connected Since : 9/18/2017 5:33:18 AM






vpn azure windows-server-2016 site-to-site-vpn checkpoint






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Sep 18 '17 at 5:53







user2713516

















asked Sep 13 '17 at 13:54









user2713516user2713516

16219




16219












  • Could you try to RDP your local PC, ICMP package may block by Firewall.

    – Shui shengbao
    Sep 14 '17 at 6:44











  • Or you could try to RDP Azure VM from your local PC?

    – Shui shengbao
    Sep 14 '17 at 6:47











  • Hi, could you do this successful?

    – Shui shengbao
    Sep 14 '17 at 7:09











  • I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

    – user2713516
    Sep 14 '17 at 8:14












  • According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

    – Shui shengbao
    Sep 14 '17 at 8:17

















  • Could you try to RDP your local PC, ICMP package may block by Firewall.

    – Shui shengbao
    Sep 14 '17 at 6:44











  • Or you could try to RDP Azure VM from your local PC?

    – Shui shengbao
    Sep 14 '17 at 6:47











  • Hi, could you do this successful?

    – Shui shengbao
    Sep 14 '17 at 7:09











  • I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

    – user2713516
    Sep 14 '17 at 8:14












  • According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

    – Shui shengbao
    Sep 14 '17 at 8:17
















Could you try to RDP your local PC, ICMP package may block by Firewall.

– Shui shengbao
Sep 14 '17 at 6:44





Could you try to RDP your local PC, ICMP package may block by Firewall.

– Shui shengbao
Sep 14 '17 at 6:44













Or you could try to RDP Azure VM from your local PC?

– Shui shengbao
Sep 14 '17 at 6:47





Or you could try to RDP Azure VM from your local PC?

– Shui shengbao
Sep 14 '17 at 6:47













Hi, could you do this successful?

– Shui shengbao
Sep 14 '17 at 7:09





Hi, could you do this successful?

– Shui shengbao
Sep 14 '17 at 7:09













I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

– user2713516
Sep 14 '17 at 8:14






I can RDP via my P2S VPN I have configured in parallel, the site-to-site connection is from my azure virtual network to a customer's network I have no control over. I can ping the vpn gateway now from within my azure VM. running 'tracert 172.xxxxx' from my Azure VM results in 1 line of 2ms, 6ms, 1ms, 10.XXX.XXX.4 (the gateway), and all other lines are timed out.

– user2713516
Sep 14 '17 at 8:14














According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

– Shui shengbao
Sep 14 '17 at 8:17





According to your description, it seems your custom network disable ICMP(There may be an edge network firewall implementation). I suggest you could test other service(such as RDP or http).

– Shui shengbao
Sep 14 '17 at 8:17










3 Answers
3






active

oldest

votes


















0














First of all, check if Windows Firewall is not blocking ICMP.



Search for Windows Firewall, and click to open it.



  1. Click Advanced Settings on the left.

  2. From the left pane of the resulting window, click Inbound Rules.

  3. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).

  4. Right-click each rule and choose Enable Rule.

Second, make sure you have the proper routing in place. The servers in your on-premises environment need to know how to reach the Azure environment. If your gateway can ping the Azure servers and the other way around is also true, then it's all good except that the only device that know this route is your GW. Make sure the servers in your network know how to reach the Azure network as well by adding a route to the Azure network through the GW. Example:



Next hop is also on-prem VPN:



VMs -> Default Windows Gw/Vpn Device -> Azure VPN Gw
route -p add <azure_network> mask <azure_net_mask> gw <azure_vpn_gw_ip>


As your VMs next hop is usually the Default Windows Gw, this will make sure that the next hop to reach azure_network is the azure_vpn_gw_ip. Make sure the route tables (local gateway configuration in Azure) has your on-premises network segment as well.






share|improve this answer

























  • Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

    – user2713516
    Sep 14 '17 at 6:16


















0














According to your description, it seems your custom network disable ICMP. There may be an edge network firewall implementation or Windows Firewall.



I suggest you could use test with other service (such as RDP or http). Also, you could use tcping to determine network connectivity.



For debug your issue, I suggest you could check your VPN gateway log, please refer to this link.



Update:



According to OP's VPN gateway log.



Connectivity State : Connected 
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 0 B
Egress Bytes (Since last connected) : 107604 B
Connected Since : 9/14/2017 6:35:28 AM


VPN tunnel did not configure correctly. You need check your VPN configure again.






share|improve this answer

























  • Hi, see my updated answer

    – user2713516
    Sep 18 '17 at 5:52











  • Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

    – Shui shengbao
    Sep 18 '17 at 6:01











  • Thanks, ill contact the 'other side' and see what they can do with their configuration

    – user2713516
    Sep 18 '17 at 6:11











  • @user2713516 Hi, do you solve this?

    – Shui shengbao
    Sep 25 '17 at 6:45











  • Hi, not yet, I'm waiting on the other party to review their side of the tunnel

    – user2713516
    Sep 25 '17 at 13:14


















0














What kind of VPN did you provision? If you're not using Basic, BGP will automatically set up the needed routes for you.



If it's basic, then you will need to set up a route table in Azure yourself to direct traffic to the correct network.



Set up the route table like this:



enter image description here



You should have the GatewaySubnet and your local subnet in the table with the next hop being the Virtual network gateway.



If that doesn't work, use the IP flow verify option to ensure traffic can get through your security groups. By default RDP should be reachable even if ping is not, so try different ports.






share|improve this answer























  • It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

    – user2713516
    Sep 17 '17 at 5:45











  • I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

    – user2713516
    Sep 18 '17 at 5:16











Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f873467%2fazure-vpn-site-to-site-connected-but-host-not-reachable%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























3 Answers
3






active

oldest

votes








3 Answers
3






active

oldest

votes









active

oldest

votes






active

oldest

votes









0














First of all, check if Windows Firewall is not blocking ICMP.



Search for Windows Firewall, and click to open it.



  1. Click Advanced Settings on the left.

  2. From the left pane of the resulting window, click Inbound Rules.

  3. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).

  4. Right-click each rule and choose Enable Rule.

Second, make sure you have the proper routing in place. The servers in your on-premises environment need to know how to reach the Azure environment. If your gateway can ping the Azure servers and the other way around is also true, then it's all good except that the only device that know this route is your GW. Make sure the servers in your network know how to reach the Azure network as well by adding a route to the Azure network through the GW. Example:



Next hop is also on-prem VPN:



VMs -> Default Windows Gw/Vpn Device -> Azure VPN Gw
route -p add <azure_network> mask <azure_net_mask> gw <azure_vpn_gw_ip>


As your VMs next hop is usually the Default Windows Gw, this will make sure that the next hop to reach azure_network is the azure_vpn_gw_ip. Make sure the route tables (local gateway configuration in Azure) has your on-premises network segment as well.






share|improve this answer

























  • Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

    – user2713516
    Sep 14 '17 at 6:16















0














First of all, check if Windows Firewall is not blocking ICMP.



Search for Windows Firewall, and click to open it.



  1. Click Advanced Settings on the left.

  2. From the left pane of the resulting window, click Inbound Rules.

  3. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).

  4. Right-click each rule and choose Enable Rule.

Second, make sure you have the proper routing in place. The servers in your on-premises environment need to know how to reach the Azure environment. If your gateway can ping the Azure servers and the other way around is also true, then it's all good except that the only device that know this route is your GW. Make sure the servers in your network know how to reach the Azure network as well by adding a route to the Azure network through the GW. Example:



Next hop is also on-prem VPN:



VMs -> Default Windows Gw/Vpn Device -> Azure VPN Gw
route -p add <azure_network> mask <azure_net_mask> gw <azure_vpn_gw_ip>


As your VMs next hop is usually the Default Windows Gw, this will make sure that the next hop to reach azure_network is the azure_vpn_gw_ip. Make sure the route tables (local gateway configuration in Azure) has your on-premises network segment as well.






share|improve this answer

























  • Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

    – user2713516
    Sep 14 '17 at 6:16













0












0








0







First of all, check if Windows Firewall is not blocking ICMP.



Search for Windows Firewall, and click to open it.



  1. Click Advanced Settings on the left.

  2. From the left pane of the resulting window, click Inbound Rules.

  3. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).

  4. Right-click each rule and choose Enable Rule.

Second, make sure you have the proper routing in place. The servers in your on-premises environment need to know how to reach the Azure environment. If your gateway can ping the Azure servers and the other way around is also true, then it's all good except that the only device that know this route is your GW. Make sure the servers in your network know how to reach the Azure network as well by adding a route to the Azure network through the GW. Example:



Next hop is also on-prem VPN:



VMs -> Default Windows Gw/Vpn Device -> Azure VPN Gw
route -p add <azure_network> mask <azure_net_mask> gw <azure_vpn_gw_ip>


As your VMs next hop is usually the Default Windows Gw, this will make sure that the next hop to reach azure_network is the azure_vpn_gw_ip. Make sure the route tables (local gateway configuration in Azure) has your on-premises network segment as well.






share|improve this answer















First of all, check if Windows Firewall is not blocking ICMP.



Search for Windows Firewall, and click to open it.



  1. Click Advanced Settings on the left.

  2. From the left pane of the resulting window, click Inbound Rules.

  3. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).

  4. Right-click each rule and choose Enable Rule.

Second, make sure you have the proper routing in place. The servers in your on-premises environment need to know how to reach the Azure environment. If your gateway can ping the Azure servers and the other way around is also true, then it's all good except that the only device that know this route is your GW. Make sure the servers in your network know how to reach the Azure network as well by adding a route to the Azure network through the GW. Example:



Next hop is also on-prem VPN:



VMs -> Default Windows Gw/Vpn Device -> Azure VPN Gw
route -p add <azure_network> mask <azure_net_mask> gw <azure_vpn_gw_ip>


As your VMs next hop is usually the Default Windows Gw, this will make sure that the next hop to reach azure_network is the azure_vpn_gw_ip. Make sure the route tables (local gateway configuration in Azure) has your on-premises network segment as well.







share|improve this answer














share|improve this answer



share|improve this answer








edited Sep 13 '17 at 23:23

























answered Sep 13 '17 at 23:12









Bruno FariaBruno Faria

3,4541616




3,4541616












  • Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

    – user2713516
    Sep 14 '17 at 6:16

















  • Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

    – user2713516
    Sep 14 '17 at 6:16
















Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

– user2713516
Sep 14 '17 at 6:16





Thanks, I allowed the ping and I can now ping my VPN Gateway from my Azure VM (which is 10.XXX.XXX.4). I then added the route "route -p ADD 172.xxx.xxx.xxx MASK 255.255.255.255 10.XXX.XXX.4" and via tracert I can see the 172 address is routed to/via de vpn gateway, but then it times out. Does this mean the issue now is on the on-premise side?

– user2713516
Sep 14 '17 at 6:16













0














According to your description, it seems your custom network disable ICMP. There may be an edge network firewall implementation or Windows Firewall.



I suggest you could use test with other service (such as RDP or http). Also, you could use tcping to determine network connectivity.



For debug your issue, I suggest you could check your VPN gateway log, please refer to this link.



Update:



According to OP's VPN gateway log.



Connectivity State : Connected 
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 0 B
Egress Bytes (Since last connected) : 107604 B
Connected Since : 9/14/2017 6:35:28 AM


VPN tunnel did not configure correctly. You need check your VPN configure again.






share|improve this answer

























  • Hi, see my updated answer

    – user2713516
    Sep 18 '17 at 5:52











  • Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

    – Shui shengbao
    Sep 18 '17 at 6:01











  • Thanks, ill contact the 'other side' and see what they can do with their configuration

    – user2713516
    Sep 18 '17 at 6:11











  • @user2713516 Hi, do you solve this?

    – Shui shengbao
    Sep 25 '17 at 6:45











  • Hi, not yet, I'm waiting on the other party to review their side of the tunnel

    – user2713516
    Sep 25 '17 at 13:14















0














According to your description, it seems your custom network disable ICMP. There may be an edge network firewall implementation or Windows Firewall.



I suggest you could use test with other service (such as RDP or http). Also, you could use tcping to determine network connectivity.



For debug your issue, I suggest you could check your VPN gateway log, please refer to this link.



Update:



According to OP's VPN gateway log.



Connectivity State : Connected 
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 0 B
Egress Bytes (Since last connected) : 107604 B
Connected Since : 9/14/2017 6:35:28 AM


VPN tunnel did not configure correctly. You need check your VPN configure again.






share|improve this answer

























  • Hi, see my updated answer

    – user2713516
    Sep 18 '17 at 5:52











  • Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

    – Shui shengbao
    Sep 18 '17 at 6:01











  • Thanks, ill contact the 'other side' and see what they can do with their configuration

    – user2713516
    Sep 18 '17 at 6:11











  • @user2713516 Hi, do you solve this?

    – Shui shengbao
    Sep 25 '17 at 6:45











  • Hi, not yet, I'm waiting on the other party to review their side of the tunnel

    – user2713516
    Sep 25 '17 at 13:14













0












0








0







According to your description, it seems your custom network disable ICMP. There may be an edge network firewall implementation or Windows Firewall.



I suggest you could use test with other service (such as RDP or http). Also, you could use tcping to determine network connectivity.



For debug your issue, I suggest you could check your VPN gateway log, please refer to this link.



Update:



According to OP's VPN gateway log.



Connectivity State : Connected 
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 0 B
Egress Bytes (Since last connected) : 107604 B
Connected Since : 9/14/2017 6:35:28 AM


VPN tunnel did not configure correctly. You need check your VPN configure again.






share|improve this answer















According to your description, it seems your custom network disable ICMP. There may be an edge network firewall implementation or Windows Firewall.



I suggest you could use test with other service (such as RDP or http). Also, you could use tcping to determine network connectivity.



For debug your issue, I suggest you could check your VPN gateway log, please refer to this link.



Update:



According to OP's VPN gateway log.



Connectivity State : Connected 
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 0 B
Egress Bytes (Since last connected) : 107604 B
Connected Since : 9/14/2017 6:35:28 AM


VPN tunnel did not configure correctly. You need check your VPN configure again.







share|improve this answer














share|improve this answer



share|improve this answer








edited Sep 15 '17 at 5:24

























answered Sep 14 '17 at 8:21









Shui shengbaoShui shengbao

3,0871518




3,0871518












  • Hi, see my updated answer

    – user2713516
    Sep 18 '17 at 5:52











  • Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

    – Shui shengbao
    Sep 18 '17 at 6:01











  • Thanks, ill contact the 'other side' and see what they can do with their configuration

    – user2713516
    Sep 18 '17 at 6:11











  • @user2713516 Hi, do you solve this?

    – Shui shengbao
    Sep 25 '17 at 6:45











  • Hi, not yet, I'm waiting on the other party to review their side of the tunnel

    – user2713516
    Sep 25 '17 at 13:14

















  • Hi, see my updated answer

    – user2713516
    Sep 18 '17 at 5:52











  • Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

    – Shui shengbao
    Sep 18 '17 at 6:01











  • Thanks, ill contact the 'other side' and see what they can do with their configuration

    – user2713516
    Sep 18 '17 at 6:11











  • @user2713516 Hi, do you solve this?

    – Shui shengbao
    Sep 25 '17 at 6:45











  • Hi, not yet, I'm waiting on the other party to review their side of the tunnel

    – user2713516
    Sep 25 '17 at 13:14
















Hi, see my updated answer

– user2713516
Sep 18 '17 at 5:52





Hi, see my updated answer

– user2713516
Sep 18 '17 at 5:52













Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

– Shui shengbao
Sep 18 '17 at 6:01





Currently, Ingres has litter packets. But when VPN is connected, by default, you don't add route table. It seems your VPN connection has some issue. But I am not sure what is the issue on your custom side or Azure side.

– Shui shengbao
Sep 18 '17 at 6:01













Thanks, ill contact the 'other side' and see what they can do with their configuration

– user2713516
Sep 18 '17 at 6:11





Thanks, ill contact the 'other side' and see what they can do with their configuration

– user2713516
Sep 18 '17 at 6:11













@user2713516 Hi, do you solve this?

– Shui shengbao
Sep 25 '17 at 6:45





@user2713516 Hi, do you solve this?

– Shui shengbao
Sep 25 '17 at 6:45













Hi, not yet, I'm waiting on the other party to review their side of the tunnel

– user2713516
Sep 25 '17 at 13:14





Hi, not yet, I'm waiting on the other party to review their side of the tunnel

– user2713516
Sep 25 '17 at 13:14











0














What kind of VPN did you provision? If you're not using Basic, BGP will automatically set up the needed routes for you.



If it's basic, then you will need to set up a route table in Azure yourself to direct traffic to the correct network.



Set up the route table like this:



enter image description here



You should have the GatewaySubnet and your local subnet in the table with the next hop being the Virtual network gateway.



If that doesn't work, use the IP flow verify option to ensure traffic can get through your security groups. By default RDP should be reachable even if ping is not, so try different ports.






share|improve this answer























  • It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

    – user2713516
    Sep 17 '17 at 5:45











  • I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

    – user2713516
    Sep 18 '17 at 5:16















0














What kind of VPN did you provision? If you're not using Basic, BGP will automatically set up the needed routes for you.



If it's basic, then you will need to set up a route table in Azure yourself to direct traffic to the correct network.



Set up the route table like this:



enter image description here



You should have the GatewaySubnet and your local subnet in the table with the next hop being the Virtual network gateway.



If that doesn't work, use the IP flow verify option to ensure traffic can get through your security groups. By default RDP should be reachable even if ping is not, so try different ports.






share|improve this answer























  • It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

    – user2713516
    Sep 17 '17 at 5:45











  • I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

    – user2713516
    Sep 18 '17 at 5:16













0












0








0







What kind of VPN did you provision? If you're not using Basic, BGP will automatically set up the needed routes for you.



If it's basic, then you will need to set up a route table in Azure yourself to direct traffic to the correct network.



Set up the route table like this:



enter image description here



You should have the GatewaySubnet and your local subnet in the table with the next hop being the Virtual network gateway.



If that doesn't work, use the IP flow verify option to ensure traffic can get through your security groups. By default RDP should be reachable even if ping is not, so try different ports.






share|improve this answer













What kind of VPN did you provision? If you're not using Basic, BGP will automatically set up the needed routes for you.



If it's basic, then you will need to set up a route table in Azure yourself to direct traffic to the correct network.



Set up the route table like this:



enter image description here



You should have the GatewaySubnet and your local subnet in the table with the next hop being the Virtual network gateway.



If that doesn't work, use the IP flow verify option to ensure traffic can get through your security groups. By default RDP should be reachable even if ping is not, so try different ports.







share|improve this answer












share|improve this answer



share|improve this answer










answered Sep 15 '17 at 22:20









Nathan CNathan C

13.8k33561




13.8k33561












  • It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

    – user2713516
    Sep 17 '17 at 5:45











  • I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

    – user2713516
    Sep 18 '17 at 5:16

















  • It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

    – user2713516
    Sep 17 '17 at 5:45











  • I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

    – user2713516
    Sep 18 '17 at 5:16
















It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

– user2713516
Sep 17 '17 at 5:45





It's the basic tier, never knew something like that was needed...I'll have a look at it tomorrow, thanks

– user2713516
Sep 17 '17 at 5:45













I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

– user2713516
Sep 18 '17 at 5:16





I created the routing table, and added the route, but then noticed via the Effective routes-page that the route already existed...so apparently that was already configured properly.

– user2713516
Sep 18 '17 at 5:16

















draft saved

draft discarded
















































Thanks for contributing an answer to Server Fault!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f873467%2fazure-vpn-site-to-site-connected-but-host-not-reachable%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

Club Baloncesto Breogán Índice Historia | Pavillón | Nome | O Breogán na cultura popular | Xogadores | Adestradores | Presidentes | Palmarés | Historial | Líderes | Notas | Véxase tamén | Menú de navegacióncbbreogan.galCadroGuía oficial da ACB 2009-10, páxina 201Guía oficial ACB 1992, páxina 183. Editorial DB.É de 6.500 espectadores sentados axeitándose á última normativa"Estudiantes Junior, entre as mellores canteiras"o orixinalHemeroteca El Mundo Deportivo, 16 setembro de 1970, páxina 12Historia do BreogánAlfredo Pérez, o último canoneiroHistoria C.B. BreogánHemeroteca de El Mundo DeportivoJimmy Wright, norteamericano do Breogán deixará Lugo por ameazas de morteResultados de Breogán en 1986-87Resultados de Breogán en 1990-91Ficha de Velimir Perasović en acb.comResultados de Breogán en 1994-95Breogán arrasa al Barça. "El Mundo Deportivo", 27 de setembro de 1999, páxina 58CB Breogán - FC BarcelonaA FEB invita a participar nunha nova Liga EuropeaCharlie Bell na prensa estatalMáximos anotadores 2005Tempada 2005-06 : Tódolos Xogadores da Xornada""Non quero pensar nunha man negra, mais pregúntome que está a pasar""o orixinalRaúl López, orgulloso dos xogadores, presume da boa saúde económica do BreogánJulio González confirma que cesa como presidente del BreogánHomenaxe a Lisardo GómezA tempada do rexurdimento celesteEntrevista a Lisardo GómezEl COB dinamita el Pazo para forzar el quinto (69-73)Cafés Candelas, patrocinador del CB Breogán"Suso Lázare, novo presidente do Breogán"o orixinalCafés Candelas Breogán firma el mayor triunfo de la historiaEl Breogán realizará 17 homenajes por su cincuenta aniversario"O Breogán honra ao seu fundador e primeiro presidente"o orixinalMiguel Giao recibiu a homenaxe do PazoHomenaxe aos primeiros gladiadores celestesO home que nos amosa como ver o Breo co corazónTita Franco será homenaxeada polos #50anosdeBreoJulio Vila recibirá unha homenaxe in memoriam polos #50anosdeBreo"O Breogán homenaxeará aos seus aboados máis veteráns"Pechada ovación a «Capi» Sanmartín e Ricardo «Corazón de González»Homenaxe por décadas de informaciónPaco García volve ao Pazo con motivo do 50 aniversario"Resultados y clasificaciones""O Cafés Candelas Breogán, campión da Copa Princesa""O Cafés Candelas Breogán, equipo ACB"C.B. Breogán"Proxecto social"o orixinal"Centros asociados"o orixinalFicha en imdb.comMario Camus trata la recuperación del amor en 'La vieja música', su última película"Páxina web oficial""Club Baloncesto Breogán""C. B. Breogán S.A.D."eehttp://www.fegaba.com

What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company