You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/network-watcher/network-watcher-connectivity-overview.md
+51-15Lines changed: 51 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,30 +1,65 @@
1
1
---
2
-
title: Introduction to connection troubleshoot
2
+
title: Connection troubleshoot overview
3
3
titleSuffix: Azure Network Watcher
4
-
description: This page provides an overview of Azure Network Watcher connection troubleshoot capability.
4
+
description: Learn about Azure Network Watcher connection troubleshoot capability.
5
5
services: network-watcher
6
6
author: halkazwini
7
7
ms.service: network-watcher
8
8
ms.topic: conceptual
9
9
ms.workload: infrastructure-services
10
-
ms.date: 11/10/2022
10
+
ms.date: 02/15/2023
11
11
ms.author: halkazwini
12
+
ms.custom: template-concept, engagement-fy23
12
13
---
13
14
14
-
# Introduction to Azure Network Watcher connection troubleshoot in Azure Network Watcher
15
+
# Connection troubleshoot overview
15
16
16
-
The connection troubleshoot feature of Network Watcher provides the capability to check a direct TCP connection from a virtual machine to a virtual machine (VM), fully qualified domain name (FQDN), URI, or IPv4 address. Network scenarios are complex, they're implemented using network security groups, firewalls, user-defined routes, and resources provided by Azure. Complex configurations make troubleshooting connectivity issues challenging. Network Watcher helps reduce the amount of time to find and detect connectivity issues. The results returned can provide insights into whether a connectivity issue is due to a platform or a user configuration issue. Connectivity can be checked with [PowerShell](network-watcher-connectivity-powershell.md), [Azure CLI](network-watcher-connectivity-cli.md), and [REST API](network-watcher-connectivity-rest.md).
17
+
With the increase of sophisticated and high-performance workloads in Azure, there's a critical need for increased visibility and control over the operational state of complex networks running these workloads. Such complex networks are implemented using network security groups, firewalls, user-defined routes, and resources provided by Azure. Complex configurations make troubleshooting connectivity issues challenging.
17
18
18
-
> [!IMPORTANT]
19
-
> Connection troubleshoot requires that the VM you troubleshoot from has the `AzureNetworkWatcherExtension` VM extension installed. For installing the extension on a Windows VM visit [Azure Network Watcher Agent virtual machine extension for Windows](../virtual-machines/extensions/network-watcher-windows.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json) and for Linux VM visit [Azure Network Watcher Agent virtual machine extension for Linux](../virtual-machines/extensions/network-watcher-linux.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json). The extension is not required on the destination endpoint.
19
+
The connection troubleshoot feature of Azure Network Watcher helps reduce the amount of time to diagnose and troubleshoot network connectivity issues. The results returned can provide insights about the root cause of the connectivity problem and whether it's due to a platform or user configuration issue.
20
+
21
+
Connection troubleshoot reduces the Mean Time To Resolution (MTTR) by providing a comprehensive method of performing all connection major checks to detect issues pertaining to network security groups, user-defined routes, and blocked ports and . It provides the following results with actionable insights where a step-by-step guide or corresponding documentation is provided for faster resolution:
22
+
23
+
- Connectivity test with different destination types (VM, URI, FQDN, or IP Address).
24
+
- Configuration issues that impact reachability.
25
+
- All possible hop by hop paths from the source to destination.
26
+
- Hop by hop latency.
27
+
- Latency (minimum, maximum, and average between source and destination).
28
+
- Graphical topology view from source to destination.
29
+
- Number of probes failed during the connection troubleshoot check.
30
+
31
+
32
+
## Supported source and destination types
20
33
21
-
## Supported source types
34
+
Connection troublehoot provides the capability to check TCP or ICMP connections from any of these Azure resources:
22
35
23
-
The following sources are supported by Network Watcher:
36
+
- Virtual machines
37
+
- Azure Bastion instances
38
+
- Application gateways (except v1)
24
39
25
-
- Virtual Machines
26
-
- Bastion
27
-
- Application Gateways (except v1)
40
+
Connection troubleshoot can test connections to any of these destinations:
41
+
42
+
- Virtual machines
43
+
- Fully qualified domain names (FQDNs)
44
+
- Uniform resource identifiers (URIs)
45
+
- IP addresses
46
+
47
+
Connection troubleshoot can detect the following types of issues that can impact connectivity:
- Network security group (NSG) rules that are blocking traffic
55
+
- Inability to open a socket at the specified source port
56
+
- Missing address resolution protocol entries for Azure ExpressRoute circuits
57
+
- Servers not listening on designated destination ports
58
+
59
+
> [!IMPORTANT]
60
+
> Connection troubleshoot requires that the virtual machine you troubleshoot from has the `AzureNetworkWatcherExtension` extension installed. The extension is not required on the destination virtual machine.
61
+
> - To install the extension on a Windows VM, see [Azure Network Watcher Agent virtual machine extension for Windows](../virtual-machines/extensions/network-watcher-windows.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json).
62
+
> - To install the extension on a Linux VM, see [Azure Network Watcher Agent virtual machine extension for Linux](../virtual-machines/extensions/network-watcher-linux.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json).
28
63
29
64
## Response
30
65
@@ -52,7 +87,7 @@ The following table shows the properties returned when connection troubleshoot h
52
87
|Hops[].Issues[].Context[].key |Key of the key value pair returned.|
53
88
|Hops[].Issues[].Context[].value |Value of the key value pair returned.|
54
89
55
-
The following is an example of an issue found on a hop.
90
+
The following is an example of an issue found on a Hop.
56
91
57
92
```json
58
93
"Issues": [
@@ -71,7 +106,7 @@ The following is an example of an issue found on a hop.
71
106
```
72
107
## Fault types
73
108
74
-
Connection troubleshoot returns fault types about the connection. The following table provides a list of the current fault types returned.
109
+
The Connection troubleshoot feature returns fault types about the connection. The following table lists the current fault types returned.
75
110
76
111
|**Type**|**Description**|
77
112
|---------|---------|
@@ -84,4 +119,5 @@ Connection troubleshoot returns fault types about the connection. The following
84
119
85
120
### Next steps
86
121
87
-
Learn how to troubleshoot connections using the [Azure portal](network-watcher-connectivity-portal.md), [PowerShell](network-watcher-connectivity-powershell.md), the [Azure CLI](network-watcher-connectivity-cli.md), or [REST API](network-watcher-connectivity-rest.md).
122
+
- Learn more about [Network Watcher](network-watcher-monitoring-overview.md)
123
+
- Learn how to use connection troubleshoot using the [Azure Portal](network-watcher-connectivity-portal.md), [PowerShell](network-watcher-connectivity-powershell.md), the [Azure CLI](network-watcher-connectivity-cli.md), or [REST API](network-watcher-connectivity-rest.md).
In this article, you learn how to use [Azure Network Watcher connection troubleshoot](network-watcher-connectivity-overview.md) to diagnose and troubleshoot connectivity issues.
21
18
22
-
Learn how to use connection troubleshoot to verify whether a direct TCP connection from a virtual machine to a given endpoint can be established.
19
+
## Prerequisites
23
20
24
-
## Before you begin
21
+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
22
+
- Two virtual machines in your subscription.
25
23
26
-
This article assumes you have the following resources:
24
+
> [!IMPORTANT]
25
+
> Connection troubleshoot requires that the virtual machine you troubleshoot from has the `AzureNetworkWatcherExtension` extension installed. The extension is not required on the destination virtual machine.
26
+
> - To install the extension on a Windows VM, see [Azure Network Watcher Agent virtual machine extension for Windows](../virtual-machines/extensions/network-watcher-windows.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json).
27
+
> - To install the extension on a Linux VM, see [Azure Network Watcher Agent virtual machine extension for Linux](../virtual-machines/extensions/network-watcher-linux.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json).
27
28
28
-
* An instance of Network Watcher in the region you want to troubleshoot a connection.
29
-
* Virtual machines to troubleshoot connections with.
29
+
## Test connectivity between two connected virtual machines
30
30
31
-
> [!IMPORTANT]
32
-
> Connection troubleshoot requires that the VM you troubleshoot from has the `AzureNetworkWatcherExtension` VM extension installed. For installing the extension on a Windows VM visit [Azure Network Watcher Agent virtual machine extension for Windows](../virtual-machines/extensions/network-watcher-windows.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json) and for Linux VM visit [Azure Network Watcher Agent virtual machine extension for Linux](../virtual-machines/extensions/network-watcher-linux.md?toc=%2fazure%2fnetwork-watcher%2ftoc.json). The extension is not required on the destination endpoint.
31
+
In this section, you test connectivity between two connected virtual machines.
33
32
34
-
## Check connectivity to a virtual machine
33
+
1. Sign in to the [Azure portal](https://portal.azure.com).
35
34
36
-
This example checks connectivity to a destination virtual machine over port 80.
35
+
1. In the search box at the top of the portal, enter *network watcher*. Select **Network Watcher** in the search results.
37
36
38
-
Navigate to your Network Watcher and click**Connection troubleshoot**. Select the virtual machine to check connectivity from. In the **Destination** section choose **Select a virtual machine** and choose the correct virtual machine and port to test.
37
+
1. Under **Network diagnostic tools**, select**Connection troubleshoot**. Enter or select the following information:
39
38
40
-
Once you click **Check**, connectivity between the virtual machines on the port specified is checked. In the example, the destination VM is unreachable, a listing of hops are shown.
39
+
| Setting | Value |
40
+
| ------- | ------ |
41
+
|**Source**||
42
+
| Subscription | Select your Azure subscription. |
43
+
| Resource group | Select **myResourceGroup**. |
44
+
| Source type | Select **Virtual machine**. |
45
+
| Virtual machine | Select **VM1**. |
46
+
|**Destination**||
47
+
| Destination type | Select **Select a virtual machine**. |
48
+
| Resource group | Select **myResourceGroup**. |
49
+
| Virtual machine | Select **VM2**. |
50
+
|**Probe Settings**||
51
+
| Preferred IP version | Select **IPv4**. |
52
+
| Protocol | Select **TCP**. |
53
+
| Destination port | Enter *80*. |
54
+
|**Connection Diagnostics**||
55
+
| Diagnostics tests | Select **Select all**. |
41
56
42
-
![Check connectivity results for a virtual machine][1]
57
+
:::image type="content" source="./media/network-watcher-connectivity-portal/test-virtual-machines-connected.png" alt-text="Screenshot of Network Watcher connection troubleshoot in Azure portal to test the connection between two connected virtual machines.":::
43
58
44
-
## Check remote endpoint connectivity
59
+
1. Select **Test connection**.
45
60
46
-
To check the connectivity and latency to a remote endpoint, choose the **Specify manually** radio button in the **Destination** section, input the url and the port and click **Check**. This is used for remote endpoints like websites and storage endpoints.
61
+
The test results show that the two virtual machines are communicating with no issues:
47
62
48
-
![Check connectivity results for a web site][2]
63
+
- Network security group rules allow traffic between the two virtual machines.
64
+
- The two virtual machines are directly connected (VM2 is the next hop of VM1).
65
+
- Azure default system route is used to route traffic between the two virtual machines (Route table Id: System route).
66
+
- 66 probes were successfully sent with average latency of 2 ms.
49
67
50
-
## Next steps
68
+
:::image type="content" source="./media/network-watcher-connectivity-portal/virtual-machine-connected-test-result.png" alt-text="Screenshot of connection troubleshoot results after testing the connection between two connected virtual machines.":::
69
+
70
+
## Troubleshoot connectivity issue between two virtual machines
71
+
72
+
In this section, you test connectivity between two virtual machines that have connectivity issue.
73
+
74
+
1. Sign in to the [Azure portal](https://portal.azure.com).
75
+
76
+
1. In the search box at the top of the portal, enter *network watcher*. Select **Network Watcher** in the search results.
77
+
78
+
1. Under **Network diagnostic tools**, select **Connection troubleshoot**. Enter or select the following information:
79
+
80
+
| Setting | Value |
81
+
| ------- | ------ |
82
+
|**Source**||
83
+
| Subscription | Select your Azure subscription. |
84
+
| Resource group | Select **myResourceGroup**. |
85
+
| Source type | Select **Virtual machine**. |
86
+
| Virtual machine | Select **VM1**. |
87
+
|**Destination**||
88
+
| Destination type | Select **Select a virtual machine**. |
89
+
| Resource group | Select **myResourceGroup**. |
90
+
| Virtual machine | Select **VM3**. |
91
+
|**Probe Settings**||
92
+
| Preferred IP version | Select **IPv4**. |
93
+
| Protocol | Select **TCP**. |
94
+
| Destination port | Enter *80*. |
95
+
|**Connection Diagnostics**||
96
+
| Diagnostics tests | Select **Select all**. |
97
+
98
+
:::image type="content" source="./media/network-watcher-connectivity-portal/test-two-virtual-machines.png" alt-text="Screenshot of Network Watcher connection troubleshoot in Azure portal to test the connection between two virtual machines.":::
99
+
100
+
1. Select **Test connection**.
101
+
102
+
The test results show that the two virtual machines are not communicating:
51
103
52
-
Learn how to automate packet captures with Virtual machine alerts by viewing [Create an alert triggered packet capture](network-watcher-alert-triggered-packet-capture.md)
104
+
- The two virtual machines are not connected (no probes were sent from VM1 to VM3).
105
+
- There is no route between the two virtual machines (Next hop type: None).
106
+
- Azure default system route is the route table used (Route table Id: System route).
107
+
- Network security group rules allow traffic between the two virtual machines.
53
108
54
-
Find if certain traffic is allowed in or out of your VM by visiting [Check IP flow verify](diagnose-vm-network-traffic-filtering-problem.md)
109
+
:::image type="content" source="./media/network-watcher-connectivity-portal/virtual-machines-test-result.png" alt-text="Screenshot of connection troubleshoot results after testing the connection between two virtual machines that are not communicating.":::
110
+
111
+
## Test connectivity with `www.bing.com`
112
+
113
+
In this section, you test connectivity between a virtual machines and `www.bing.com`.
114
+
115
+
1. Sign in to the [Azure portal](https://portal.azure.com).
116
+
117
+
1. In the search box at the top of the portal, enter *network watcher*. Select **Network Watcher** in the search results.
118
+
119
+
1. Under **Network diagnostic tools**, select **Connection troubleshoot**. Enter or select the following information:
120
+
121
+
| Setting | Value |
122
+
| ------- | ------ |
123
+
|**Source**||
124
+
| Subscription | Select your Azure subscription. |
125
+
| Resource group | Select **myResourceGroup**. |
126
+
| Source type | Select **Virtual machine**. |
127
+
| Virtual machine | Select **VM1**. |
128
+
|**Destination**||
129
+
| Destination type | Select **Specify manually**. |
130
+
| Resource group | Enter *www.bing.com*.|
131
+
|**Probe Settings**||
132
+
| Preferred IP version | Select **IPv4**. |
133
+
| Protocol | Select **TCP**. |
134
+
| Destination port | Enter *443*. |
135
+
|**Connection Diagnostics**||
136
+
| Diagnostics tests | Select **Connectivity**. |
137
+
138
+
:::image type="content" source="./media/network-watcher-connectivity-portal/test-bing.png" alt-text="Screenshot of Network Watcher connection troubleshoot in Azure portal to test the connection between a virtual machines and Microsoft Bing search engine.":::
139
+
140
+
1. Select **Test connection**.
141
+
142
+
The test results show that `www.bing.com` is reachable from **VM1** virtual machine:
143
+
144
+
- Connectivity test is successful with 66 probes sent with an average latency of 3 ms.
0 commit comments