Advanced · Hybrid · 6 of 32

New spoke can't reach on-premises

Problem

vm-spoke2 can't reach srv-onprem on 443.

Your job

Get vm-spoke2 reaching srv-onprem on 443

Without breaking

Keep vm-spoke1 reaching srv-onprem on 443broken

Background

vnet-spoke2 was just peered to the hub. vm-spoke2 needs srv-onprem on 443 over the hub's VPN gateway, vgw-hub, the way vm-spoke1 already does. Spoke2 was built from an old security template. Spoke1 must keep working.

How to work it

1See it fail
Prove the problem yourself before you change anything. Reports are often wrong.
VM commands forVMs
1. ssh vm-spoke2
  What's this?
  Opens a shell on vm-spoke2, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.
2. nc -zv 192.168.10.5 443
  What's this?
  netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.
  - -z only check whether the port answers. Send no data
  - -v print the result in words
  - 192.168.10.5 where to connect
  - 443 the port to try
Ticks off when the test runs on vm-spoke2.
2Find where it stops
3Name the cause
4Fix it and test again
5Explain it

Sources on Microsoft Learn (2)

Configure VPN gateway transit for virtual network peering How Azure selects a route

0/3 changes

Network map

Resource group, the outer dashed frame
Virtual network, with its address space top right
Subnet, with range and usable IPs (5 reserved)
Network security group. A small shield on a VM's NIC means the NIC has one too
Route table on the subnet
VM Appliance Private endpoint
Peering Connected Initiated or access off
Goal working Goal broken, X marks where it stops
Private DNS zone, dotted lines go to linked VNets
Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.

vm-spoke2 → srv-onprem:443should work: not working

Goals 0/3

Cloud Shell · bashVMsrg-lab · eastus2

cloudshell:~$