App service not working with on-premises VPN
I've been trying to set up an App Service which communicates with a server in our on-premises environment. I've set up everything regarding VNET, Local network gateway, Virtual network gateway, Point-to-Site and so on. I've also set up a Linux VM to enable testing, the VM can communicate with on-prem and on-prem reaches our VM.
I also connected the app service to the VNET and it is able to tcpping the VM. But I can't get the app service to communicate with the on-prem service.
In the App Service Plan everything looks normal, I can see all the subnets, site-to-site, point-to-site and that the certificates are in sync.
But when I look at the Networking for the App Service it does not show as connected and Azure says that the certificates are not in sync. Could this be one of the reasons why the App Service and the on-prem can't communicate? Do I have to add routes for the Point-to-Site to the on-prem network?
azure azure-web-app-service azure-virtual-network vnet edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
add a comment |
I've been trying to set up an App Service which communicates with a server in our on-premises environment. I've set up everything regarding VNET, Local network gateway, Virtual network gateway, Point-to-Site and so on. I've also set up a Linux VM to enable testing, the VM can communicate with on-prem and on-prem reaches our VM.
I also connected the app service to the VNET and it is able to tcpping the VM. But I can't get the app service to communicate with the on-prem service.
In the App Service Plan everything looks normal, I can see all the subnets, site-to-site, point-to-site and that the certificates are in sync.
But when I look at the Networking for the App Service it does not show as connected and Azure says that the certificates are not in sync. Could this be one of the reasons why the App Service and the on-prem can't communicate? Do I have to add routes for the Point-to-Site to the on-prem network?
azure azure-web-app-service azure-virtual-network vnet edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24
add a comment |
I've been trying to set up an App Service which communicates with a server in our on-premises environment. I've set up everything regarding VNET, Local network gateway, Virtual network gateway, Point-to-Site and so on. I've also set up a Linux VM to enable testing, the VM can communicate with on-prem and on-prem reaches our VM.
I also connected the app service to the VNET and it is able to tcpping the VM. But I can't get the app service to communicate with the on-prem service.
In the App Service Plan everything looks normal, I can see all the subnets, site-to-site, point-to-site and that the certificates are in sync.
But when I look at the Networking for the App Service it does not show as connected and Azure says that the certificates are not in sync. Could this be one of the reasons why the App Service and the on-prem can't communicate? Do I have to add routes for the Point-to-Site to the on-prem network?
azure azure-web-app-service azure-virtual-network vnet edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
I've been trying to set up an App Service which communicates with a server in our on-premises environment. I've set up everything regarding VNET, Local network gateway, Virtual network gateway, Point-to-Site and so on. I've also set up a Linux VM to enable testing, the VM can communicate with on-prem and on-prem reaches our VM.
I also connected the app service to the VNET and it is able to tcpping the VM. But I can't get the app service to communicate with the on-prem service.
In the App Service Plan everything looks normal, I can see all the subnets, site-to-site, point-to-site and that the certificates are in sync.
But when I look at the Networking for the App Service it does not show as connected and Azure says that the certificates are not in sync. Could this be one of the reasons why the App Service and the on-prem can't communicate? Do I have to add routes for the Point-to-Site to the on-prem network?
azure azure-web-app-service azure-virtual-network vnet azure azure-web-app-service azure-virtual-network vnet edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
edited Nov 12 '18 at 18:48
David Makogon
56.4k15104151
56.4k15104151
asked Nov 12 '18 at 16:22
CribCrib
11
asked Nov 12 '18 at 16:22
CribCrib
11
asked Nov 12 '18 at 16:22
CribCrib
11
11
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24
add a comment |
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24
add a comment |
1 Answer
1
active
oldest
votes
If the Networking for the App Service is working well it should show as connected and the certificates are in sync. One or more of the possible actions you could try:
Avoid picking IP address space that overlaps with other networks.
When the Site to Site VPN is first set up then the scripts used to configure it should set up routes including your Point-to-Site VPN. If you add the Point-to-Site VPN after you create your Site to Site VPN, then you need to update the routes manually.
If those certificates or network information is changed, then you need to click Sync Network to forcibly sync the certificate to ensure the security of the connection. NOTE: When you click Sync Network then you cause a brief outage in connectivity between your app and your VNet. While your app is not restarted, the loss of connectivity could cause your site to not function properly.
You can get more details from the VNet Integrations.
Update
If your VNet hosted VM can reach your on-premises system but your app can't then the reason is likely one of the following:
- your routes are not configured with your point to site IP ranges in your on-premises gateway
- your network security groups are blocking access for your Point-to-Site IP range
- your on-premises firewalls are blocking traffic from your Point-to-Site IP range
- you have a User Defined Route(UDR) in your VNet that prevents your Point-to-Site based traffic from reaching your on-premises network
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53266221%2fapp-service-not-working-with-on-premises-vpn%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If the Networking for the App Service is working well it should show as connected and the certificates are in sync. One or more of the possible actions you could try:
Avoid picking IP address space that overlaps with other networks.
When the Site to Site VPN is first set up then the scripts used to configure it should set up routes including your Point-to-Site VPN. If you add the Point-to-Site VPN after you create your Site to Site VPN, then you need to update the routes manually.
If those certificates or network information is changed, then you need to click Sync Network to forcibly sync the certificate to ensure the security of the connection. NOTE: When you click Sync Network then you cause a brief outage in connectivity between your app and your VNet. While your app is not restarted, the loss of connectivity could cause your site to not function properly.
You can get more details from the VNet Integrations.
Update
If your VNet hosted VM can reach your on-premises system but your app can't then the reason is likely one of the following:
- your routes are not configured with your point to site IP ranges in your on-premises gateway
- your network security groups are blocking access for your Point-to-Site IP range
- your on-premises firewalls are blocking traffic from your Point-to-Site IP range
- you have a User Defined Route(UDR) in your VNet that prevents your Point-to-Site based traffic from reaching your on-premises network
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
add a comment |
If the Networking for the App Service is working well it should show as connected and the certificates are in sync. One or more of the possible actions you could try:
Avoid picking IP address space that overlaps with other networks.
When the Site to Site VPN is first set up then the scripts used to configure it should set up routes including your Point-to-Site VPN. If you add the Point-to-Site VPN after you create your Site to Site VPN, then you need to update the routes manually.
If those certificates or network information is changed, then you need to click Sync Network to forcibly sync the certificate to ensure the security of the connection. NOTE: When you click Sync Network then you cause a brief outage in connectivity between your app and your VNet. While your app is not restarted, the loss of connectivity could cause your site to not function properly.
You can get more details from the VNet Integrations.
Update
If your VNet hosted VM can reach your on-premises system but your app can't then the reason is likely one of the following:
- your routes are not configured with your point to site IP ranges in your on-premises gateway
- your network security groups are blocking access for your Point-to-Site IP range
- your on-premises firewalls are blocking traffic from your Point-to-Site IP range
- you have a User Defined Route(UDR) in your VNet that prevents your Point-to-Site based traffic from reaching your on-premises network
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
add a comment |
If the Networking for the App Service is working well it should show as connected and the certificates are in sync. One or more of the possible actions you could try:
Avoid picking IP address space that overlaps with other networks.
When the Site to Site VPN is first set up then the scripts used to configure it should set up routes including your Point-to-Site VPN. If you add the Point-to-Site VPN after you create your Site to Site VPN, then you need to update the routes manually.
If those certificates or network information is changed, then you need to click Sync Network to forcibly sync the certificate to ensure the security of the connection. NOTE: When you click Sync Network then you cause a brief outage in connectivity between your app and your VNet. While your app is not restarted, the loss of connectivity could cause your site to not function properly.
You can get more details from the VNet Integrations.
Update
If your VNet hosted VM can reach your on-premises system but your app can't then the reason is likely one of the following:
- your routes are not configured with your point to site IP ranges in your on-premises gateway
- your network security groups are blocking access for your Point-to-Site IP range
- your on-premises firewalls are blocking traffic from your Point-to-Site IP range
- you have a User Defined Route(UDR) in your VNet that prevents your Point-to-Site based traffic from reaching your on-premises network
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
If the Networking for the App Service is working well it should show as connected and the certificates are in sync. One or more of the possible actions you could try:
Avoid picking IP address space that overlaps with other networks.
When the Site to Site VPN is first set up then the scripts used to configure it should set up routes including your Point-to-Site VPN. If you add the Point-to-Site VPN after you create your Site to Site VPN, then you need to update the routes manually.
If those certificates or network information is changed, then you need to click Sync Network to forcibly sync the certificate to ensure the security of the connection. NOTE: When you click Sync Network then you cause a brief outage in connectivity between your app and your VNet. While your app is not restarted, the loss of connectivity could cause your site to not function properly.
You can get more details from the VNet Integrations.
Update
If your VNet hosted VM can reach your on-premises system but your app can't then the reason is likely one of the following:
- your routes are not configured with your point to site IP ranges in your on-premises gateway
- your network security groups are blocking access for your Point-to-Site IP range
- your on-premises firewalls are blocking traffic from your Point-to-Site IP range
- you have a User Defined Route(UDR) in your VNet that prevents your Point-to-Site based traffic from reaching your on-premises network
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
edited Nov 13 '18 at 10:40
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
answered Nov 13 '18 at 2:21
Nancy XiongNancy Xiong
2,813118
2,813118
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
add a comment |
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Thank you for your reply! Regarding your second point, Point-to-Site addresses don't seem to be added to the configuration generated by the connection between virtual network gateway and local network gateway. So the part with "need to update the routes manually", does this mean updating the vnet integration or the on premise configurations?
– Crib
Nov 13 '18 at 8:46
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
Yes, you may need to update your on-premises VPN gateway with the routes for your Point-to-Site IP range. Add an update in my reply, hope this can help others.
– Nancy Xiong
Nov 13 '18 at 10:40
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53266221%2fapp-service-not-working-with-on-premises-vpn%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
May I know if there is an update on your side?
– Nancy Xiong
Nov 13 '18 at 8:04
@NancyXiong-MSFT Everything is working now, I spoke with IT and they had apparently missed some settings in their FW which blocked all request from the App but only some from the VM in the VNET.
– Crib
Nov 13 '18 at 9:24