0

I have following network topology:

On-premise network: 192.168.15.0/24

Server: 192.168.15.7

Router: 192.168.15.1

Azure VNET: 10.0.0.0/16

Subnets: default 10.0.0.0/24, Gateway subnet 10.0.255.0/27

Server: 10.0.0.4

Azure VPN Gateway: 52.232.34.98

I have S2S connection between on premise and azure. I'm able to ping from azure server to on premise server and vice versa.

I have P2S connection to Azure. Address pool is 10.2.0.0/24. I'm able to ping from VPN Client (client IP 10.2.0.4) to server in Azure (10.0.0.4). However, I'm not able to ping from VPN Client to on premise (192.168.15.7).

I followed this article: https://www.altitude365.com/2016/04/26/azure-p2s-vpn-how-to-route-between-vnets/ and then I added this to routes.txt:

ADD 192.168.15.0 MASK 255.255.255.0 default METRIC default IF default

However, I still cannot ping from VPN client to 192.168.15.7 and I'm out of ideas now.

Tracert from VPN client to azure:

Tracing route to 10.0.0.4 over a maximum of 30 hops

1 55 ms 47 ms 35 ms 10.2.0.0

2 40 ms 55 ms 46 ms 10.0.0.4

Trace complete.

Tracert from VPN client to on premise:

Tracing route to 192.168.15.7 over a maximum of 30 hops

1 47 ms 36 ms 39 ms 10.2.0.0

2 * * * Request timed out.

  • Can you please send a screenshot of VM's effective route? You can go to your VM's NIC 10.0.0.4 there is an option Effective Route. Don't forget to hide public IP or any sensitive information, just leave all private IP visible. – Taguada Jul 13 at 16:17
  • Thank you! !Image. – Petr Jankovský Jul 17 at 9:28
0

Basically your topology should be configured like this one below. You probably have not configured BGP between your On-premises to Azure S2S VPN. In this case is not possible to reach out your branch office from P2S client VPN. More detail you find here.

topology

In order to make it work you must configure BGP between your On-premises to Azure S2S VPN where you can see more details here.

Windows clients can access the VNet and the branch office (Site1), but the routes to Site1 must be manually added to the client. Non-Windows clients can access the VNet as well as the on-premises branch office.

There are many different scenarios cover on this page.

| improve this answer | |
  • Thank you! So I need BGP, which is not included in VPN Basic gateway I have right now. – Petr Jankovský Jul 23 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.