I have 2 VNETs - one classic and one ARM. Both VNETs are connected to different onprem VPN devices in our network. Whenever I'm onprem, I try to connect to a resource in these VNETs using its public IP and the connection fails.

I figured out the issue is occurring when the Local Site address space is configured for our primary IP block, a /16 public IP address space. That's right! Everybody in my org gets a public class B (but we are firewalled).

When I remove the XXX.XXX.0.0/16 from the local site address space, public IP connections are established immediately.

My thought is since our onprem firewall's public IP is in the space, Azure doesn't know how to route properly when it sees me trying to access a resource through it via an Azure Public IP.

Is there a solution out there, which will allow me to list the /16 block in local site config and connect from onprem to public Azure IPs? Or am I doomed to breakup the /16 to not include my web firewall's public IP address space?


That's the reason why people design the private IP address, to prevent the overlap.

If we configure a public IP range on an intranet, it will overlap with the same subnet on internet, which cause routing issue when you try to access the public IP address.(In your case, it's your firewall's public IP)

To my knowledge, to resolve this issue once and for all, you need reconfigure your intranet to migrate it to a private IP range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.