Home / Azure

AzureRunbookIntermediate

Azure site-to-site VPN tunnel is down: a runbook

Check connection status and gateway diagnostics, then match IKE/IPsec settings, shared keys, traffic selectors and on-premises device config to bring the tunnel back.

Deepak Bhardwaj2 min read

Applies toAzure VPN Gateway (route-based), on-premises IPsec devices

1. Status from Azure

az network vpn-connection show -g rg-net -n conn-onprem-dc1 \
  --query "{status:connectionStatus, in:ingressBytesTransferred, out:egressBytesTransferred}" -o table
  • Connected but no traffic → routing, NSG or firewall problem (step 5).
  • Connecting / NotConnected → IKE negotiation is failing (steps 2–4).

Also check Resource Health on the gateway. Planned maintenance can briefly reset tunnels.

2. Gateway diagnostic logs

Send IKEDiagnosticLog and TunnelDiagnosticLog to Log Analytics:

AzureDiagnostics
| where Category == "IKEDiagnosticLog" and TimeGenerated > ago(1h)
| project TimeGenerated, Message
| order by TimeGenerated desc

Messages to look for:

Message contains Cause
NO_PROPOSAL_CHOSEN IKE/IPsec encryption, integrity or DH group mismatch
AUTHENTICATION_FAILED Pre-shared key mismatch
TS_UNACCEPTABLE Traffic selectors (address spaces) differ
No IKE messages from the peer The on-premises device isn't sending, or UDP 500/4500 is blocked

3. Compare settings on both ends

az network vpn-connection show -g rg-net -n conn-onprem-dc1 --query "{protocol:connectionProtocol, ipsec:ipsecPolicies, policyBased:usePolicyBasedTrafficSelectors, dpd:dpdTimeoutSeconds}"
az network vpn-connection shared-key show -g rg-net --connection-name conn-onprem-dc1
az network local-gateway show -g rg-net -n lgw-dc1 --query "{ip:gatewayIpAddress, prefixes:localNetworkAddressSpace.addressPrefixes, bgp:bgpSettings}"

Checklist:

  • IKE version matches (IKEv2 recommended).
  • Shared key is identical on both sides, with no trailing spaces.
  • If a custom IPsec policy is set, the on-premises device uses exactly those algorithms, DH group and PFS group.
  • Local network gateway has the on-premises device's current public IP. ISPs do change it.
  • Address prefixes on the local network gateway match the on-premises networks.
  • For a policy-based on-premises device, usePolicyBasedTrafficSelectors is set to true on the connection.

4. Reset

az network vpn-connection reset -g rg-net -n conn-onprem-dc1   # resets the connection
# Last resort: gateway reset (brief outage for all tunnels on it)
az network vnet-gateway reset -g rg-net -n vpngw-prod

5. Connected but no traffic

  • Effective routes on a VM NIC show the on-premises prefix via VirtualNetworkGateway.
  • No UDR sends that prefix to an NVA or firewall by mistake.
  • NSGs allow the traffic, and the on-premises firewall allows the Azure VNet ranges.
  • With BGP, the routes are actually learned: az network vnet-gateway list-learned-routes -g rg-net -n vpngw-prod -o table

Prevent it next time

  • Use active-active gateways with two tunnels, plus BGP for automatic failover.
  • Alert on the TunnelAverageBandwidth metric dropping to 0, and on connection status changes.

Related fixes