Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,722 questions
VPN Gateway not routing 1 subnet
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 57.00000000000001%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJL%3C/text%3E%3C/svg%3E)
Jimmy Lamon
0
Reputation points
**I have a working VPN Gateway with 3 local gateways and 3 connections all going to 3 Meraki sites. For each site I have multiple subnets setup under the local gateways. All but one is working. 10.1.0.0/16 will simply not work. The traffic never hits the Meraki MX. I verified and even open a ticket to make sure I was right. From on premise, any device in that subnet cannot route to VM's in Azure. But all other devices can. for my other 6 subnets across the 3 sites I have bidirectional routing and even DNS working. I have completely rebuilt all this on the Azure side and even changed my public IP on the VPN gateway. I have rebuilt the local gateways. I have also tried more specific subnets (10.1.0.0/24)
It is acting like that subnet is some reserved space.
I can see the subnet in my routes on the NIC of the VM. So I know it is being advertised and is not being blocked by the NSG.
The guy before me thought nothing was working and started adding route tables. I deleted them but it took like 24 hours for the processes to finish.**
Azure VPN Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 17%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERV%3C/text%3E%3C/svg%3E)
Rohith Vinnakota 4,345 Reputation points Microsoft External Staff2025-04-23T19:13:45.5966667+00:00 Hi @Jimmy Lamon,
- Are you using any firewall or NVA in Azure, and how did you configure the route table?
- Which VPN gateway are you using, the policy-based or route-based one?
- Also, please share the support ticket number.
-
UJTyagi-MSFT 930 Reputation points Microsoft Employee2025-04-24T06:44:07.5933333+00:00 Hi @Jimmy Lamon ,
Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
From your description it seems traffic for 10.1.0.0/16 and its sub prefixes is being routed somewhere else from Virtual Network. Kindly check the following -
- The Vnet where your virtual network Gateway resides has any peeing with another vnet which has either same or overlapping address 10.1.0.0/16.
- Check the route table of the vnic of the VM and try to see all the routes starting with 10.1.x.x and see if there are multiple routes learnt. there should be only one route 10.1.x.x with next hop virtual network gateway.
- Try to do a packet captures for this connection and see if the traffic is reaching through Azure Virtual Network Gateway
- If you are using any Firewall NVA, check if the traffic is allowed through the NVA.
- If the VPN Gateway is part of the VWAN look out if the similar routes are learnt from other means.
Kindly keep me posted if you have checked all the above points.
Regards
Ujjawal Tyagi
-
Jimmy Lamon 0 Reputation points
2025-04-24T13:54:02.55+00:00 One 1 VNET, no firewall, checked the vnic route tables and no overlapping routes.
Also to note. traffic from devices on 10.1.0.0/16 (Meraki on premise) is being sent the VPN gateway but then dies there. SO its like the Gateway simply does not see the subnet on the local gateway. But it is there and is advertised AND the other subnets on that local gateway are working -
Jimmy Lamon 0 Reputation points
2025-04-24T14:09:14.44+00:00 no route tables are configured
using route based VPN Gateway Version 1
only 1 vnet and NSGs
I don't have a support ticket yet as that has to flow through Carahsoft -
Rohith Vinnakota 4,345 Reputation points Microsoft External Staff
2025-04-24T18:49:31.23+00:00 Hi @Jimmy Lamon,
- Can you please share the Meraki Sites CIDR that you have configured on the 3 local network gateways?
- Since you informed that there is only one VNET and no firewall in between, could you confirm if the connectivity flow is as follows: VNET (Subnets) >VPN Gateway >> S2S connection >> (on-prem Meraki Site)?
- Use the connection troubleshoot on the Azure VM towards Meraki or the destination server and share the "see details" result.
Refer this link : https://learn.microsoft.com/en-us/azure/network-watcher/connection-troubleshoot-manage?tabs=portal
Kindly let us know if the above helps or you need further assistance on this issue.
-
Rohith Vinnakota 4,345 Reputation points Microsoft External Staff
2025-04-25T19:51:58.4833333+00:00 HI @Jimmy Lamon
Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
-
Rohith Vinnakota 4,345 Reputation points Microsoft External Staff
2025-04-28T18:28:03.9733333+00:00 HI @Jimmy Lamon
Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
-
Jimmy Lamon 0 Reputation points
2025-04-28T18:35:01.68+00:00 Unfortunately, I can't share the details you are asking for in a public forum. Connectivity is good for everything but 1 subnet using the same VM's. I tested using Ping, HTTP, HTTPS, and SSH. It works on all the subnets (6) across the 3(local gateways) in both directions except for 1 subnet. That local gateway also has the IP subnet for our vpn clients and that one works in both directions with all protocols and DNS name resolution.
-
Rohith Vinnakota 4,345 Reputation points Microsoft External Staff
2025-04-28T18:37:48.8966667+00:00 Hi @Jimmy Lamon ||
Could you please share those details in a private message? -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 82%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVV%3C/text%3E%3C/svg%3E)
Venkat V 1,800 Reputation points Microsoft External Staff2025-04-29T09:02:16.39+00:00 If the
10.1.1.0/24subnet isn’t routing properly through your Azure VPN Gateway, you can try checking the below points.- Check Effective Routes on the affected VM's NIC to ensure traffic to
10.1.1.0/24is routed via the correct gateway or NVA. - Verify the Local Network Gateway included
10.1.1.0/24in the on-prem address space. - Review UDRs and VNet peering for overlapping or conflicting routes.
- Use Azure Network Watcher to run connection troubleshooting or capture packets to see if traffic leaves the subnet and reaches the gateway.
I hope this is helpful! Do not hesitate to let me know if you have any other questions.
- Check Effective Routes on the affected VM's NIC to ensure traffic to
-
Venkat V 1,800 Reputation points Microsoft External Staff
2025-04-30T05:03:27.91+00:00 I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Sign in to comment
Sign in to answer