Azure Container App routing over one VPN gateway, not routing over second

Question

Azure Container App routing over one VPN gateway, not routing over second

David-3580644 0

We have an Azure Container App sitting on VNET subnet. We also have a VNET Gateway we're using as a VPN device to connect S2S to two different sites. The container app is able to route to one site without issue, but isn't routing to the second. Both connections have a local gateway with the target IP range configured, and both connections are showing as "Active". One connection has a NAT config, the other does not.

Does anyone have any ideas or troubleshooting steps for this issue?

Thanks!

Silvia Wibowo 5,861 Reputation points Microsoft Employee

2025-03-11T01:15:49.98+00:00
Hi @David-3580644 , please clarify:

Which connection works: the one with NAT or the one without?

Is there any IP overlap that requires you to put NAT?

Do you use dynamic routing (BGP) or static routing for your VPN?

Have you checked your on-premises routing configuration, the site that does not work? Does it have a route to Azure virtual network?
David-3580644 0 Reputation points

2025-03-11T01:41:25.1466667+00:00

Hi - the one without NAT is the one that is not working. The NAT'd one works great.

We do not use BGP routing.

We've confirmed on-prem has a route - we're able to get connectivity from an Azure VM to on-prem, the issue is specific to our Container Apps instance (which is unable to get the same connectivity).
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Ryan Hill 30,186 Reputation points Microsoft Employee

2025-03-11T21:11:37.97+00:00

Hey @David just confirm, you have a setup somewhat like the following? Since the VM is working across both connections, are the any configuration differences between the two?
David-3580644 0 Reputation points

2025-03-12T00:20:58.9566667+00:00

Thanks for the reply - rough network diagram attached.
s2s_connection_1/Onprem network 1 is reachable from container_app, s2s_connection_2/Onprem network 2 is not.

Aside from the address space, NAT, and IKE config, there's no difference in how they're set up on the Azure side. They are on different ports. The strange thing is that vm_1 is able to reach both s2s_connection_1 and s2s_connection_2, the issue appears to be specific to the container app.

199.xxx.xx.xx is technically a public address, but it is in the local_gateway_2 address space, so the container_app traffic should be routed to the vnet_gateway... wondering if the break is with that routing.
Silvia Wibowo 5,861 Reputation points Microsoft Employee

2025-03-12T01:23:20.3933333+00:00

Hi @David , isn't IP address 199.x.x.x a public IP address? Container app would try to go out to internet to reach that address. Your VM probably reached that address via internet, not VPN.
David-3580644 0 Reputation points

2025-03-13T19:01:44.6366667+00:00

Yeah, I'm not sure why but the network is using a public address for that resource. It needs to be accessed over the tunnel however, is there any way to force the container app to route that traffic over the tunnel (and not to the internet)? I've tried assigning a route table to the subnet the container app instance sits on, but that didn't work.
David-3580644 0 Reputation points

2025-03-13T19:02:26.4833333+00:00

Oh - I have confirmed the VM was reaching it over the tunnel.
Ryan Hill 30,186 Reputation points Microsoft Employee

2025-03-17T17:56:26.4566667+00:00

Hey @David and thanks for the diagram. I'm curious, if the app container is in the 10.0.3.0/24 subnet just like VM, is it still not able to access the 199.x.x.x? From the VM, does nslookup on the container app resolves correctly to the container app's private IP? This will confirm the container app's private DNS zone is configured correctly.

I'm also going to send you a private message to gather some additional details from you.

1 answer

Your answer

Silvia Wibowo 5,861 Reputation points Microsoft Employee

2025-03-11T01:15:49.98+00:00

Hi @David-3580644 , please clarify:

Which connection works: the one with NAT or the one without?

Is there any IP overlap that requires you to put NAT?

Do you use dynamic routing (BGP) or static routing for your VPN?

Have you checked your on-premises routing configuration, the site that does not work? Does it have a route to Azure virtual network?
David-3580644 0 Reputation points

2025-03-11T01:41:25.1466667+00:00

Hi - the one without NAT is the one that is not working. The NAT'd one works great.

We do not use BGP routing.

We've confirmed on-prem has a route - we're able to get connectivity from an Azure VM to on-prem, the issue is specific to our Container Apps instance (which is unable to get the same connectivity).
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Ryan Hill 30,186 Reputation points Microsoft Employee

2025-03-11T21:11:37.97+00:00

Hey @David just confirm, you have a setup somewhat like the following? Since the VM is working across both connections, are the any configuration differences between the two?
David-3580644 0 Reputation points

2025-03-12T00:20:58.9566667+00:00

Thanks for the reply - rough network diagram attached.
s2s_connection_1/Onprem network 1 is reachable from container_app, s2s_connection_2/Onprem network 2 is not.

Aside from the address space, NAT, and IKE config, there's no difference in how they're set up on the Azure side. They are on different ports. The strange thing is that vm_1 is able to reach both s2s_connection_1 and s2s_connection_2, the issue appears to be specific to the container app.

199.xxx.xx.xx is technically a public address, but it is in the local_gateway_2 address space, so the container_app traffic should be routed to the vnet_gateway... wondering if the break is with that routing.
Silvia Wibowo 5,861 Reputation points Microsoft Employee

2025-03-12T01:23:20.3933333+00:00

Hi @David , isn't IP address 199.x.x.x a public IP address? Container app would try to go out to internet to reach that address. Your VM probably reached that address via internet, not VPN.
David-3580644 0 Reputation points

2025-03-13T19:01:44.6366667+00:00

Yeah, I'm not sure why but the network is using a public address for that resource. It needs to be accessed over the tunnel however, is there any way to force the container app to route that traffic over the tunnel (and not to the internet)? I've tried assigning a route table to the subnet the container app instance sits on, but that didn't work.
David-3580644 0 Reputation points

2025-03-13T19:02:26.4833333+00:00

Oh - I have confirmed the VM was reaching it over the tunnel.
Ryan Hill 30,186 Reputation points Microsoft Employee

2025-03-17T17:56:26.4566667+00:00

Hey @David and thanks for the diagram. I'm curious, if the app container is in the 10.0.3.0/24 subnet just like VM, is it still not able to access the 199.x.x.x? From the VM, does nslookup on the container app resolves correctly to the container app's private IP? This will confirm the container app's private DNS zone is configured correctly.

I'm also going to send you a private message to gather some additional details from you.

Answer 1

Hi @David-3580644
I wanted to share some links I discovered that hopefully will help troubleshoot your networking issue. For one, you can use tcpdump to capture a network trace when your container app is attempting to reach the s2s_connection_2. Container Apps: How to capture a network trace using TCPDUMP outlines how you can install the tool and its usage so that you can analyze the dump in Wireshark. In addition, Installing troubleshooting tools in a Container Apps ‘hello-world’ image list additional tools you can install, like netstat, dig, tcptraceroute, etc. that you can use to identify why the container app traffic isn't going over connection.

Share via

Azure Container App routing over one VPN gateway, not routing over second

1 answer

Your answer