Review: spoke, gateway and an old route
Problem
The office can't open the app on vm-spoke1 at 443.
Your job
- Let srv-onprem open the app on vm-spoke1 (443)
Without breaking
- Keep SSH from the office blockedbroken
Background
The office can't open the app on vm-spoke1 at 443. srv-onprem, an office server, reaches Azure over the hub's VPN gateway, vgw-hub. Spoke 1 has an NSG and a route table left from older projects. SSH from the office stays blocked.
How to work it
- 1See it fail
Prove the problem yourself before you change anything. Reports are often wrong.
VM commands forVMsssh srv-onpremWhat's this?
Opens a shell on srv-onprem, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.
nc -zv 10.1.1.4 443What's this?
netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.
-zonly check whether the port answers. Send no data-vprint the result in words10.1.1.4where to connect443the port to try
Ticks off when the test runs on srv-onprem.
- 2Find where it stops
- 3Name the cause
- 4Fix it and test again
0/3 changes
Network map
?
- Resource group, the outer dashed frame
- Virtual network, with its address space top right
- Subnet, with range and usable IPs (5 reserved)
- Network security group. A small shield on a VM's NIC means the NIC has one too
- Route table on the subnet
- VM Appliance Private endpoint
- Peering Connected Initiated or access off
- Goal working Goal broken, X marks where it stops
- Private DNS zone, dotted lines go to linked VNets
- Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
srv-onprem → vm-spoke1:443should work: not workingsrv-onprem → vm-spoke1:22should stay blocked: blocked
Goals 0/2
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$