Problem with Azure-VyOS tunnel

Hello everyone, I setup a VPN (IPsec) tunnel between Azure and VyOS, everything working fine but I don’t have ping of some Azure VM’s ranges!
for example I can ping from everything but I cant do same from !
do I need to add something in BGP?

admin@FW:~$ show ip bgp neighbors advertised-routes
BGP table version is 9, local router ID is x.x.x.x, vrf id 0
Default local pref 100, local AS 65537
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop’s vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 0 65512 i
*> 0 65512 i
*> 0 65512 i
*> 0 65512 i

Try to check if echo requests are coming to the virtual machine?
If echo responses come out from vm?
Also, check please Azure routing tables. Maybe some wrong routing.

1 Like

Thanks @Viacheslav, I checked routing table, it was fine !
how can I check echo requests ?

also, can I add to the bgp neighbors advertised-routes? included in more big prefix

Do you check routing tables on Azure portal? Check on the Azure portal network interface “Ip Forwarding” option “Enabled” and in/out Network security groups.

1 Like

Thanks @Viacheslav, I checked it and enabled IP forwarding (it was disabled on fine VM too) for it but I don’t have anything on network security group and it’s none !

I also do something else:
when I pinging from VM (inside azure) and monitor IP) from VyOS I got this:

admin@FW0:~$ monitor traffic interface eth0 filter “host”
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:47:52.466629 IP > ICMP echo request, id 1, seq 210, length 40
19:47:52.466795 IP > ICMP echo reply, id 1, seq 210, length 40
19:47:57.483748 IP > ICMP echo request, id 1, seq 211, length 40
19:47:57.483935 IP > ICMP echo reply, id 1, seq 211, length 40
19:48:02.475238 IP > ICMP echo request, id 1, seq 212, length 40

Hi @Viacheslav,
I checked everything inside Azure and now in/out in enabled in NSG, I have ping reply’s on the eth0 interface, but I won’t see them on the vti1 interface for the VPN. Where for the host, no reply’s get back through the vti1 interface.

That’s the main crux of the issue - traffic can hit the eth0 interface, but it won’t come back out the vti1 interface. This is what leads me to believe there is either some routing rule or filter which is stopped the traffic going back over the vti1 VPN interface.


Do you use VyOS on Azure from the marketplace?

No I have VyOS on my VCenter and we have a VPN tunnel between them.