Azure VPN P2S connectivity back to on premise failing

Question

I have following network topology:

On-premise network: 192.168.15.0/24

Server: 192.168.15.7

Router: 192.168.15.1

Azure VNET: 10.0.0.0/16

Subnets: default 10.0.0.0/24, Gateway subnet 10.0.255.0/27

Server: 10.0.0.4

Azure VPN Gateway: 52.232.34.98

I have S2S connection between on premise and azure. I'm able to ping from azure server to on premise server and vice versa.

I have P2S connection to Azure. Address pool is 10.2.0.0/24. I'm able to ping from VPN Client (client IP 10.2.0.4) to server in Azure (10.0.0.4). However, I'm not able to ping from VPN Client to on premise (192.168.15.7).

I followed this article: https://www.altitude365.com/2016/04/26/azure-p2s-vpn-how-to-route-between-vnets/ and then I added this to routes.txt:

ADD 192.168.15.0 MASK 255.255.255.0 default METRIC default IF default

However, I still cannot ping from VPN client to 192.168.15.7 and I'm out of ideas now.

Tracert from VPN client to azure:

Tracing route to 10.0.0.4 over a maximum of 30 hops

1 55 ms 47 ms 35 ms 10.2.0.0

2 40 ms 55 ms 46 ms 10.0.0.4

Trace complete.

Tracert from VPN client to on premise:

Tracing route to 192.168.15.7 over a maximum of 30 hops

1 47 ms 36 ms 39 ms 10.2.0.0

2 * * * Request timed out.

Answer 1

Basically your topology should be configured like this one below. You probably have not configured BGP between your On-premises to Azure S2S VPN. In this case is not possible to reach out your branch office from P2S client VPN. More detail you find here.

In order to make it work you must configure BGP between your On-premises to Azure S2S VPN where you can see more details here.

Windows clients can access the VNet and the branch office (Site1), but the routes to Site1 must be manually added to the client. Non-Windows clients can access the VNet as well as the on-premises branch office.

There are many different scenarios cover on this page.