Forum Discussion

gonace's avatar
gonace
Copper Contributor
May 10, 2017

Mutliple subnets VPN S2S can't access peered VNets in Azure from Site B

I'm having problems setting up an S2S VPN Connection towards Azure, the connection it self is working and I can access the virtual machines connected to this Virtual Network (let's call it VNet-VPN).

However I'm not able to access network devices (in this case virtual machines) on the Virtual Networks this network are peered with, if I access a machine on VNet-VPN then try to access a machine on any other Virtual Network it is successful.

But these machines on the other Virtual Networks can't be reach from the VPN S2S Site B.

On Site B (On-premises) I've set up a pfSense machine:

 

I have no idea of why I'm able to access the Virtual Networks that are peered with VNet-VPN. I've even tried to detach all Network Security Groups but that didn't change a thing.

Any ideas?

So I tried to setup a Route table, not really sure if I'm doing it right. In the Route Table I added the Virtual Network connected to the Gateway that handle the VPN Connection.

I then added the following routes:

Name|Address|Next Hop

RouteToShared | 10.123.5.0/25 | Virtual network

RouteToProduction | 10.123.10.0/25 | Virtual network

RouteToStage | 10.123.20.0/25 | Virtual network

RouteToTest | 10.123.30.0/25 | Virtual network

But this doesn't work, I'm sure I'm doing it wrong.
Regards

Networking

2 Replies

Sort By
  • Kent Gaardmand's avatar
    Kent Gaardmand
    Steel Contributor
    May 14, 2017

    normaly when specifying your next hop, you would have to indicate the acualy ip of the device able to handle the request. I belive you would need a VM with Routing and remote services to help assist the packets reaching the subnet on the other side of you VNET peering.

     

    i could be mistaken, but lets start with what VPN version are you using, policy or Route based ?

    • gonace's avatar
      gonace
      Copper Contributor
      May 15, 2017

      Hi

      Thanks for your reply, we're using booth Route- and policy-based VPN Connections some of our customers need Policy-based. But as of now we've just created a Route-based VPN Connection which is up andr running. 

       

      And Site-B have access to Site-A, well at least the VMs and resources connected to that VNet.

       

      Regards,

      Erik

Resources