Home / Azure

AzureRunbookAdvanced

Sev1: Azure VPN Gateway site-to-site tunnel down — IKE, shared key, BGP and routing checks in order

The S2S VPN to on-premises is down and hybrid apps fail. Work through connection status, IKE logs, shared key, policy mismatch, BGP and effective routes to get traffic flowing again.

Deepak Bhardwaj3 min read

Applies toAzure VPN Gateway (route-based, VpnGw SKUs), Azure CLI 2.50+, Azure PowerShell Az.Network

Symptoms

  • Applications in Azure cannot reach on-premises databases or AD, or the reverse.
  • Connection status in the portal shows NotConnected or Connecting.
  • It started after a firewall change on-premises, a public IP change, a key rotation or a gateway reset.

1. Read the connection state

az network vpn-connection show -g rg-hub -n cn-onprem-dc1 \
  --query "{status:connectionStatus, in:ingressBytesTransferred, out:egressBytesTransferred, proto:connectionProtocol}"
az network vpn-connection list -g rg-hub -o table
Status Meaning Next step
Connected, but no traffic Tunnel up, routing or NSG problem Step 5
Connecting forever IKE negotiation failing Steps 2-3
NotConnected No response from peer, wrong IP, or key mismatch Steps 2-3

2. Check the basics the peer depends on

# Azure side public IP the on-prem device must target
az network public-ip show -g rg-hub -n pip-vpngw-1 --query ipAddress -o tsv

# What Azure thinks the on-prem device is
az network local-gateway show -g rg-hub -n lgw-dc1 \
  --query "{ip:gatewayIpAddress, prefixes:localNetworkAddressSpace.addressPrefixes, bgp:bgpSettings}"
  • Has the on-premises public IP changed (new ISP circuit, failover firewall)? Update gatewayIpAddress on the local network gateway.
  • Is UDP 500 and 4500 (and ESP) allowed inbound and outbound on the on-premises edge?

3. Read the IKE logs

Turn on diagnostics to Log Analytics if they are not already on, then:

AzureDiagnostics
| where Category == "IKEDiagnosticLog"
| where TimeGenerated > ago(1h)
| project TimeGenerated, Message
| order by TimeGenerated desc

Look for these patterns:

Log text contains Cause Fix
AUTHENTICATION_FAILED Shared key mismatch Re-set the key on both sides
NO_PROPOSAL_CHOSEN IKE/IPsec policy mismatch Align encryption, integrity, DH group, PFS
TS_UNACCEPTABLE Traffic selectors differ Match address spaces or use policy-based selectors
No entries at all Packets never arrive ISP, firewall, wrong peer IP

Reset the shared key so both sides are certain to match:

az network vpn-connection shared-key update -g rg-hub --connection-name cn-onprem-dc1 --value '<new-key>'

If you use a custom IPsec policy, show it and compare field by field with the on-premises device:

az network vpn-connection ipsec-policy list -g rg-hub --connection-name cn-onprem-dc1 -o table

4. Reset the gateway as a last resort

$gw = Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name vpngw-hub
Reset-AzVirtualNetworkGateway -VirtualNetworkGateway $gw

Warning

A reset reboots gateway instances and drops every tunnel on that gateway, including ones that work. In active-standby mode expect a short outage for all connections. Do it only after keys, IPs and policies have been checked.

5. Tunnel up, traffic still fails

# BGP: is Azure learning on-prem routes?
az network vnet-gateway list-learned-routes -g rg-hub -n vpngw-hub -o table
az network vnet-gateway list-bgp-peer-status -g rg-hub -n vpngw-hub -o table

# What a VM actually uses
az network nic show-effective-route-table -g rg-app -n vm-app01-nic -o table
  • A route table (UDR) on the spoke subnet sending 0.0.0.0/0 or the on-premises range to a firewall that has no route back.
  • Spoke peering without Use remote gateways on the spoke side and Allow gateway transit on the hub side.
  • Overlapping address space added on-premises, so the more specific route wins elsewhere.
  • NSG blocking the on-premises source range.

Prevent it next time

  • Use active-active gateways and two on-premises devices, or add ExpressRoute with VPN as backup.
  • Alert on TunnelIngressBytes dropping to zero and on connection status, not only on users calling.
  • Keep the IPsec policy, shared key location and on-prem device owner in the runbook.
  • Coordinate on-premises public IP and firewall changes with the Azure team as one change.

Related fixes