Troubleshoot an Azure site-to-site VPN connection that cannot connect - Azure VPN Gateway

rw-book-cover

In this article

  1. Troubleshooting steps
  2. Next steps

After you configure a site-to-site VPN connection between an on-premises network and an Azure virtual network, the VPN connection suddenly stops working and cannot be reconnected. This article provides troubleshooting steps to help you resolve this problem.

If your Azure issue is not addressed in this article, visit the Azure forums on Microsoft Q & A and Stack Overflow. You can post your issue in these forums, or post to @AzureSupport on Twitter. You also can submit an Azure support request. To submit a support request, on the Azure support page, select Get support.

Troubleshooting steps

To resolve the problem, first try to reset the Azure VPN gateway and reset the tunnel from the on-premises VPN device. If the problem persists, follow these steps to identify the cause of the problem.

Prerequisite step

Check the type of the Azure VPN gateway.

  1. Go to the Azure portal.
  2. Check the Overview page of the VPN gateway for the type information.

Overview of the gateway

Step 1. Check whether the on-premises VPN device is validated
  1. Check whether you are using a validated VPN device and operating system version. If the device is not a validated VPN device, you might have to contact the device manufacturer to see if there is a compatibility issue.
  2. Make sure that the VPN device is correctly configured. For more information, see Edit device configuration samples.
Step 2. Verify the shared key

Compare the shared key for the on-premises VPN device to the Azure Virtual Network VPN to make sure that the keys match.

To view the shared key for the Azure VPN connection, use one of the following methods:

Azure portal

  1. Go to the VPN gateway site-to-site connection that you created.
  2. In the Settings section, click Shared key.

Shared key

Azure PowerShell

Note

We recommend that you use the Azure Az PowerShell module to interact with Azure. See Install Azure PowerShell to get started. To learn how to migrate to the Az PowerShell module, see Migrate Azure PowerShell from AzureRM to Az.

For the Azure Resource Manager deployment model:

Azure PowerShell

Get-AzVirtualNetworkGatewayConnectionSharedKey -Name <Connection name> -ResourceGroupName <Resource group name>



For the classic deployment model:

Azure PowerShell

Get-AzureVNetGatewayKey -VNetName -LocalNetworkSiteName


Step 3. Verify the VPN peer IPs
Step 4. Check UDR and NSGs on the gateway subnet

Check for and remove user-defined routing (UDR) or Network Security Groups (NSGs) on the gateway subnet, and then test the result. If the problem is resolved, validate the settings that UDR or NSG applied.

Step 5. Check the on-premises VPN device external interface address

If the Internet-facing IP address of the VPN device is included in the Local network definition in Azure, you might experience sporadic disconnections.

Step 6. Verify that the subnets match exactly (Azure policy-based gateways)
Step 7. Verify the Azure gateway health probe
  1. Open health probe by browsing to the following URL:

https://<YourVirtualNetworkGatewayIP>:8081/healthprobe

For Active/Acive gateways use the following to check the second public IP:
https://<YourVirtualNetworkGatewayIP2>:8083/healthprobe
2. Click through the certificate warning.
3. If you receive a response, the VPN gateway is considered healthy. If you don't receive a response, the gateway might not be healthy or an NSG on the gateway subnet is causing the problem. The following text is a sample response:

XML

<?xml version="1.0"?>
<string xmlns="http://schemas.microsoft.com/2003/10/Serialization/">Primary Instance: GatewayTenantWorker_IN_1 GatewayTenantVersion: 14.7.24.6</string>

Note

Basic SKU VPN gateways do not reply to health probe. They are not recommended for production workloads.

Step 8. Check whether the on-premises VPN device has the perfect forward secrecy feature enabled

The perfect forward secrecy feature can cause disconnection problems. If the VPN device has perfect forward secrecy enabled, disable the feature. Then update the VPN gateway IPsec policy.

Note

VPN gateways do not reply to ICMP on their local address.

Next steps