You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/network-watcher/network-watcher-troubleshoot-overview.md
+42-46Lines changed: 42 additions & 46 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,22 +1,40 @@
1
1
---
2
-
title: Introduction to VPN troubleshoot
2
+
title: VPN troubleshoot overview
3
3
titleSuffix: Azure Network Watcher
4
-
description: This page provides an overview of Azure Network Watcher VPN troubleshoot capability.
4
+
description: Learn about Azure Network Watcher VPN troubleshoot capability.
5
5
services: network-watcher
6
6
author: halkazwini
7
7
ms.service: network-watcher
8
8
ms.topic: conceptual
9
9
ms.workload: infrastructure-services
10
-
ms.date: 03/31/2022
10
+
ms.date: 02/15/2023
11
11
ms.author: halkazwini
12
-
ms.custom: engagement-fy23
12
+
ms.custom: template-concept, engagement-fy23
13
13
---
14
14
15
-
# Introduction to virtual network gateway troubleshooting in Azure Network Watcher
15
+
# VPN troubleshoot overview
16
16
17
-
Virtual network gateways provide connectivity between on-premises resources and other virtual networks within Azure. Monitoring gateways and their connections are critical to ensuring communication is not broken. Network Watcher provides the capability to troubleshoot gateways and connections. The capability can be called through the portal, PowerShell, Azure CLI, or REST API. When called, Network Watcher diagnoses the health of the gateway, or connection, and returns the appropriate results. The request is a long running transaction. The results are returned once the diagnosis is complete.
17
+
Virtual network gateways provide connectivity between on-premises resources and Azure Virtual Networks. Monitoring virtual network gateways and their connections are critical to ensure communication isn't broken. Azure Network Watcher provides the capability to troubleshoot virtual network gateways and their connections. The capability can be called through the Azure portal, Azure PowerShell, Azure CLI, or REST API. When called, Network Watcher diagnoses the health of the gateway, or connection, and returns the appropriate results. The request is a long running transaction. The results are returned once the diagnosis is complete.
18
18
19
-
![Screenshot shows Network Watcher V P N Diagnostics.][2]
19
+
:::image type="content" source="./media/network-watcher-troubleshoot-overview/vpn-troubleshoot-azure-portal.png" alt-text="Screenshot of Azure Network Watcher VPN troubleshoot in the Azure portal.":::
20
+
21
+
## Supported Gateway types
22
+
23
+
The following table lists which gateways and connections are supported with Network Watcher troubleshooting:
24
+
25
+
| Gateway or connection | Supported |
26
+
|---------|---------|
27
+
|**Gateway types**||
28
+
|VPN | Supported |
29
+
|ExpressRoute | Not Supported |
30
+
|**VPN types**||
31
+
|Route Based | Supported|
32
+
|Policy Based | Not Supported|
33
+
|**Connection types**||
34
+
|IPSec| Supported|
35
+
|VNet2VNet| Supported|
36
+
|ExpressRoute| Not Supported|
37
+
|VPNClient| Not Supported|
20
38
21
39
## Results
22
40
@@ -26,7 +44,7 @@ The following list is the values returned with the troubleshoot API:
26
44
27
45
***startTime** - This value is the time the troubleshoot API call started.
28
46
***endTime** - This value is the time when the troubleshooting ended.
29
-
***code** - This value is UnHealthy, if there is a single diagnosis failure.
47
+
***code** - This value is UnHealthy, if there's a single diagnosis failure.
30
48
***results** - Results is a collection of results returned on the Connection or the virtual network gateway.
31
49
***id** - This value is the fault type.
32
50
***summary** - This value is a summary of the fault.
@@ -36,70 +54,53 @@ The following list is the values returned with the troubleshoot API:
36
54
***actionUri** - This value provides the URI to documentation on how to act.
37
55
***actionUriText** - This value is a short description of the action text.
38
56
39
-
The following tables show the different fault types (id under results from the preceding list) that are available and if the fault creates logs.
57
+
The following tables show the different fault types (ID under results from the preceding list) that are available and if the fault creates logs.
40
58
41
59
### Gateway
42
60
43
61
| Fault Type | Reason | Log|
44
62
|---|---|---|
45
63
| NoFault | When no error is detected |Yes|
46
-
| GatewayNotFound |Cannot find gateway or gateway is not provisioned |No|
64
+
| GatewayNotFound |Can't find gateway or gateway isn't provisioned |No|
47
65
| PlannedMaintenance | Gateway instance is under maintenance |No|
48
66
| UserDrivenUpdate | This fault occurs when a user update is in progress. The update could be a resize operation. | No |
49
67
| VipUnResponsive | This fault occurs when the primary instance of the gateway can't be reached due to a health probe failure. | No |
50
-
| PlatformInActive | There is an issue with the platform. | No|
51
-
| ServiceNotRunning | The underlying service is not running. | No|
68
+
| PlatformInActive | There's an issue with the platform. | No|
69
+
| ServiceNotRunning | The underlying service isn't running. | No|
52
70
| NoConnectionsFoundForGateway | No connections exist on the gateway. This fault is only a warning.| No|
53
-
| ConnectionsNotConnected | Connections are not connected. This fault is only a warning.| Yes|
71
+
| ConnectionsNotConnected | Connections aren't connected. This fault is only a warning.| Yes|
54
72
| GatewayCPUUsageExceeded | The current gateway CPU usage is > 95%. | Yes |
55
73
56
74
### Connection
57
75
58
76
| Fault Type | Reason | Log|
59
77
|---|---|---|
60
78
| NoFault | When no error is detected |Yes|
61
-
| GatewayNotFound |Cannot find gateway or gateway is not provisioned |No|
79
+
| GatewayNotFound |Can't find gateway or gateway isn't provisioned |No|
62
80
| PlannedMaintenance | Gateway instance is under maintenance |No|
63
81
| UserDrivenUpdate | This fault occurs when a user update is in progress. The update could be a resize operation. | No |
64
82
| VipUnResponsive | This fault occurs when the primary instance of the gateway can't be reached due to a health probe failure. | No |
65
83
| ConnectionEntityNotFound | Connection configuration is missing | No |
66
84
| ConnectionIsMarkedDisconnected | The connection is marked "disconnected" |No|
67
-
| ConnectionNotConfiguredOnGateway | The underlying service does not have the connection configured. | Yes |
85
+
| ConnectionNotConfiguredOnGateway | The underlying service doesn't have the connection configured. | Yes |
68
86
| ConnectionMarkedStandby | The underlying service is marked as standby.| Yes|
69
87
| Authentication | Preshared key mismatch | Yes|
70
-
| PeerReachability | The peer gateway is not reachable. | Yes|
71
-
| IkePolicyMismatch | The peer gateway has IKE policies that are not supported by Azure. | Yes|
88
+
| PeerReachability | The peer gateway isn't reachable. | Yes|
89
+
| IkePolicyMismatch | The peer gateway has IKE policies that aren't supported by Azure. | Yes|
72
90
| WfpParse Error | An error occurred parsing the WFP log. |Yes|
73
91
74
-
## Supported Gateway types
75
-
76
-
The following table lists which gateways and connections are supported with Network Watcher troubleshooting:
77
-
78
-
| Gateway or connection | Supported |
79
-
|---------|---------|
80
-
|**Gateway types**||
81
-
|VPN | Supported |
82
-
|ExpressRoute | Not Supported |
83
-
|**VPN types**||
84
-
|Route Based | Supported|
85
-
|Policy Based | Not Supported|
86
-
|**Connection types**||
87
-
|IPSec| Supported|
88
-
|VNet2Vnet| Supported|
89
-
|ExpressRoute| Not Supported|
90
-
|VPNClient| Not Supported|
91
92
92
93
## Log files
93
94
94
95
The resource troubleshooting log files are stored in a storage account after resource troubleshooting is finished. The following image shows the example contents of a call that resulted in an error.
95
96
96
-
![zip file][1]
97
+
:::image type="content" source="./media/network-watcher-troubleshoot-overview/gateway-tenant-worker-logs-new.png" alt-text="Screenshot shows the content of the downloaded zipped log files.":::
97
98
98
99
> [!NOTE]
99
100
> 1. In some cases, only a subset of the logs files is written to storage.
100
-
> 2. For newer Gateway versions, the IkeErrors.txt, Scrubbed-wfpdiag.txt and wfpdiag.txt.sum have been replaced by an IkeLogs.txt file that contains the whole IKE activity (not just errors).
101
+
> 2. For newer gateway versions, the IkeErrors.txt, Scrubbed-wfpdiag.txt and wfpdiag.txt.sum have been replaced by an IkeLogs.txt file that contains the whole IKE activity (not just errors).
101
102
102
-
For instructions on downloading files from Azure storage accounts, refer to [Get started with Azure Blob storage using .NET](../storage/blobs/storage-quickstart-blobs-dotnet.md). Another tool that can be used is Storage Explorer. More information about Storage Explorer can be found here at the following link: [Storage Explorer](https://storageexplorer.com/)
103
+
For instructions on downloading files from Azure storage accounts, see [Download a block blob](../storage/blobs/storage-quickstart-blobs-portal.md#download-a-block-blob). Another tool that can be used is Storage Explorer. For information about Azure Storage Explorer, see [Use Azure Storage Explorer to download blobs](../storage/blobs/quickstart-storage-explorer.md#download-blobs)
103
104
104
105
### ConnectionStats.txt
105
106
@@ -158,7 +159,7 @@ Error: On-prem device sent invalid payload.
158
159
159
160
The **Scrubbed-wfpdiag.txt** log file contains the wfp log. This log contains logging of packet drop and IKE/AuthIP failures.
160
161
161
-
The following example shows the contents of the Scrubbed-wfpdiag.txt file. In this example, the shared key of a Connection was not correct as can be seen from the third line from the bottom. The following example is just a snippet of the entire log, as the log can be lengthy depending on the issue.
162
+
The following example shows the contents of the Scrubbed-wfpdiag.txt file. In this example, the pre-shared key of a Connection wasn't correct as can be seen from the third line from the bottom. The following example is just a snippet of the entire log, as the log can be lengthy depending on the issue.
162
163
163
164
```
164
165
...
@@ -218,14 +219,9 @@ Elapsed Time 330 sec
218
219
```
219
220
220
221
## Considerations
221
-
* Only one troubleshoot operation can be run at a time per subscription. To run another troubleshoot operation, wait for the previous one to complete. Triggering more operations while a previous one hasn't completed will cause subsequent operations to fail.
222
-
* CLI Bug: If you are using Azure CLI to run the command, the VPN Gateway and the Storage account need to be in same resource group. Customers with the resources in different resource groups can use PowerShell or the Azure portal instead.
223
-
222
+
* Only one VPN troubleshoot operation can be run at a time per subscription. To run another VPN troubleshoot operation, wait for the previous one to complete. Triggering a new operation while a previous one hasn't completed causes the subsequent operations to fail.
223
+
* CLI Bug: If you're using Azure CLI to run the command, the VPN Gateway and the Storage account need to be in same resource group. Customers with the resources in different resource groups can use PowerShell or the Azure portal instead.
224
224
225
225
## Next steps
226
226
227
-
To learn how to diagnose a problem with a gateway or gateway connection, see [Diagnose communication problems between networks](diagnose-communication-problem-between-networks.md).
To learn how to diagnose a problem with a virtual network gateway or gateway connection, see [Diagnose communication problems between networks](diagnose-communication-problem-between-networks.md).
0 commit comments