4

We have a VNET (let's call it VN_MAIN) that is configured to have a S2S VPN connection to our on-premise network. The VMs deployed within subnets of VN_MAIN are reachable from on-premise.

What I'm trying to do is to create another VNET (VN_OTHER) and make sure that you can reach on-premise from VN_OTHER and vice-versa, through VN_MAIN acting as a hub.

VN_MAIN has an address space of 10.123.128.0/20 (not created by me). I needed a /16 address space for my new VNET and wanted to avoid overlap, so I created VN_OTHER with address space 10.230.0.0/16.

Taking inspiration from the hub-spoke topology described here, I've created a peering on each VNET:

  • On VN_MAIN: main-to-other-peering to VN_OTHER, forwarded traffic allowed + gateway transit allowed
  • On VN_OTHER: other-to-main-peeringto VN_MAIN, forwarded traffic allowed + use remote gateways checked

Afterwards, to test this, I launched 2 linux machines: machine-1 on VN_MAIN (subnet 10.123.129.0/24) and machine-2on VN_OTHER (subnet 10.230.0.0/16 = the whole space).

According to my understanding of the article I linked, this should be enough for what I'm trying to accomplish. However, it doesn't work properly. Here are the pings I attempted:

  • machine-1 to machine-2: OK
  • machine-2 to machine-1: OK
  • my-laptop to machine-1: OK
  • machine-1 to my-laptop: OK
  • my-laptop to machine-2: NOT OK
  • machine-2 to my-laptop: NOT OK

So, the peering between the VNETs works, but the gateway transit does not, even though I believe I've done everything I was supposed to do to allow it. I am positive this is not an issue with any NSG rules.

Can anyone tell if there's something I am missing here please?

Improve this question

2 Answers 2

Reset to default
2

It sounds like your onprem Gateway doesn’t have a route to the 10.230.0.0/16 (VN_Other) vía the S2S VPN

Improve this answer
2
  • 1
    Yes that's a good point thanks. Wouldn't that only explain the ping from on-premise to the VNET ? If VN_Main is able to ping my-laptop in the current configuration, VN_Other should be too, shouldn't it ?
    – valorl
    Apr 15, 2018 at 17:30
  • @valorl, what was the solution to the issue?
    – Senior Systems Engineer
    Nov 17, 2020 at 12:37
1

Not only do you need a route defined on premises to route thru the tunnel, but your vpn appliance on prem needs to be aware that it should allow traffic from that address space. Once you do that, it should work fine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .