Skip to content

Commit 4a48350

Browse files
author
Jill Grant
authored
Merge pull request #259826 from halkazwini/nw-vpn
Rewrite article
2 parents 51b4041 + 52c33b4 commit 4a48350

File tree

1 file changed

+83
-46
lines changed

1 file changed

+83
-46
lines changed

‎articles/network-watcher/network-watcher-troubleshoot-manage-powershell.md

Lines changed: 83 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,89 +1,126 @@
11
---
2-
title: Troubleshoot Azure VNet gateway and connections - Azure PowerShell
2+
title: Troubleshoot VPN gateways and connections - PowerShell
33
titleSuffix: Azure Network Watcher
4-
description: This page explains how to use the Azure Network Watcher troubleshoot PowerShell.
5-
services: network-watcher
4+
description: Learn how to use Azure Network Watcher VPN troubleshoot capability to troubleshoot VPN virtual network gateways and their connections using PowerShell.
65
author: halkazwini
6+
ms.author: halkazwini
77
ms.service: network-watcher
88
ms.topic: how-to
9-
ms.workload: infrastructure-services
10-
ms.date: 11/22/2022
11-
ms.author: halkazwini
12-
ms.custom: devx-track-azurepowershell, engagement-fy23
9+
ms.date: 11/29/2023
10+
ms.custom: devx-track-azurepowershell
11+
12+
#CustomerIntent: As a network administrator, I want to determine why resources in a virtual network can't communicate with resources in a different virtual network over a VPN connection.
1313
---
1414

15-
# Troubleshoot virtual network gateway and connections with Azure Network Watcher using PowerShell
15+
# Troubleshoot VPN virtual network gateways and connections using PowerShell
1616

1717
> [!div class="op_single_selector"]
1818
> - [Portal](diagnose-communication-problem-between-networks.md)
1919
> - [PowerShell](network-watcher-troubleshoot-manage-powershell.md)
2020
> - [Azure CLI](network-watcher-troubleshoot-manage-cli.md)
21-
> - [REST API](network-watcher-troubleshoot-manage-rest.md)
2221
23-
Network Watcher provides various capabilities as it relates to understanding your network resources in Azure. One of these capabilities is resource troubleshooting. Resource troubleshooting can be called through the Azure portal, PowerShell, CLI, or REST API. When called, Network Watcher inspects the health of a Virtual Network Gateway or a Connection and returns its findings.
22+
In this article, you learn how to use Network Watcher VPN troubleshoot capability to diagnose and troubleshoot VPN virtual network gateways and their connections to solve connectivity issues between your virtual network and on-premises network. VPN troubleshoot requests are long running requests, which could take several minutes to return a result. The logs from troubleshooting are stored in a container on a storage account that is specified.
2423

24+
## Prerequisites
2525

26-
[!INCLUDE [updated-for-az](../../includes/updated-for-az.md)]
26+
- An Azure account with an active subscription. [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
2727

28-
## Prerequisites
28+
- A Network Watcher enabled in the region of the virtual network gateway. For more information, see [Enable or disable Azure Network Watcher](network-watcher-create.md?tabs=powershell).
2929

30-
- A [Network Watcher instance](network-watcher-create.md).
31-
- Ensure you're using a supported Gateway type. [Learn more](network-watcher-troubleshoot-overview.md#supported-gateway-types).
30+
- A virtual network gateway. For more information about supported gateway types, see [Supported Gateway types](network-watcher-troubleshoot-overview.md#supported-gateway-types).
3231

33-
## Overview
32+
- Azure Cloud Shell or Azure PowerShell.
3433

35-
Resource troubleshooting provides the ability to troubleshoot issues that arise with Virtual Network Gateways and Connections. When a request is made to resource troubleshooting, logs are being queried and inspected. When inspection is complete, the results are returned. Resource troubleshooting requests are long running requests, which could take multiple minutes to return a result. The logs from troubleshooting are stored in a container on a storage account that is specified.
34+
The steps in this article run the Azure PowerShell cmdlets interactively in [Azure Cloud Shell](/azure/cloud-shell/overview). To run the commands in the Cloud Shell, select **Open Cloudshell** at the upper-right corner of a code block. Select **Copy** to copy the code and then paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.
3635

37-
## Retrieve Network Watcher
36+
You can also [install Azure PowerShell locally](/powershell/azure/install-azure-powershell) to run the cmdlets. If you run PowerShell locally, sign in to Azure using the [Connect-AzAccount](/powershell/module/az.accounts/connect-azaccount) cmdlet.
3837

39-
The first step is to retrieve the Network Watcher instance. The `$networkWatcher` variable is passed to the `Start-AzNetworkWatcherResourceTroubleshooting` cmdlet in step 4.
38+
## Troubleshoot using an existing storage account
4039

41-
```powershell
42-
$networkWatcher = Get-AzNetworkWatcher -Location "WestCentralUS"
43-
```
40+
In this section, you learn how to troubleshoot a VPN virtual network gateway or a VPN connection using an existing storage account.
41+
42+
# [**Gateway**](#tab/gateway)
4443

45-
## Retrieve a Virtual Network Gateway Connection
44+
Use [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) to start troubleshooting the VPN gateway.
4645

47-
In this example, resource troubleshooting is being ran on a Connection. You can also pass it a Virtual Network Gateway.
46+
```azurepowershell-interactive
47+
# Place the virtual network gateway configuration into a variable.
48+
$vng = Get-AzVirtualNetworkGateway -Name "myGateway" -ResourceGroupName "myResourceGroup"
4849
49-
```powershell
50-
$connection = Get-AzVirtualNetworkGatewayConnection -Name "2to3" -ResourceGroupName "testrg"
50+
# Place the storage account configuration into a variable.
51+
$sa = Get-AzStorageAccount -ResourceGroupName "myResourceGroup" -Name "mystorageaccount"
52+
53+
# Start VPN troubleshoot session.
54+
Start-AzNetworkWatcherResourceTroubleshooting -Location "eastus" -TargetResourceId $vng.Id -StorageId $sa.Id -StoragePath "https://mystorageaccount.blob.core.windows.net/{containerName}"
5155
```
5256

53-
## Create a storage account
57+
# [**Connection**](#tab/connection)
5458

55-
Resource troubleshooting returns data about the health of the resource, it also saves logs to a storage account to be reviewed. In this step, we create a storage account, if an existing storage account exists you can use it.
59+
Use [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) to start troubleshooting the VPN connection.
5660

57-
```powershell
58-
$sa = New-AzStorageAccount -Name "contosoexamplesa" -SKU "Standard_LRS" -ResourceGroupName "testrg" -Location "WestCentralUS"
59-
Set-AzCurrentStorageAccount -ResourceGroupName $sa.ResourceGroupName -Name $sa.StorageAccountName
60-
$sc = New-AzStorageContainer -Name logs
61+
```azurepowershell-interactive
62+
# Place the virtual network gateway configuration into a variable.
63+
$connection = Get-AzVirtualNetworkGatewayConnection -Name "myConnection" -ResourceGroupName "myResourceGroup"
64+
65+
# Place the storage account configuration into a variable.
66+
$sa = Get-AzStorageAccount -ResourceGroupName "myResourceGroup" -Name "mystorageaccount"
67+
68+
# Start VPN troubleshoot session.
69+
Start-AzNetworkWatcherResourceTroubleshooting -Location "eastus" -TargetResourceId $connection.Id -StorageId $sa.Id -StoragePath "https://mystorageaccount.blob.core.windows.net/{containerName}"
6170
```
6271

63-
## Run Network Watcher resource troubleshooting
72+
---
73+
74+
After the troubleshooting request is completed, ***healthy*** or ***unhealthy*** is returned. Detailed logs are stored in the storage account container you specified in the previous command. For more information, see [Log files](network-watcher-troubleshoot-overview.md#log-files). You can use Storage explorer or any other way you prefer to access and download the logs. For more information, see [Get started with Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md).
6475

65-
You can troubleshoot resources with the [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) cmdlet. We pass the cmdlet the Network Watcher object, the ID of the Connection or Virtual Network Gateway, the storage account ID, and the path to store the results.
76+
## Troubleshoot using a new storage account
6677

67-
> [!NOTE]
68-
> The [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) cmdlet is long running and may take a few minutes to complete.
78+
In this section, you learn how to troubleshoot a VPN virtual network gateway or a VPN connection using a new storage account.
6979

70-
```powershell
71-
Start-AzNetworkWatcherResourceTroubleshooting -NetworkWatcher $networkWatcher -TargetResourceId $connection.Id -StorageId $sa.Id -StoragePath "$($sa.PrimaryEndpoints.Blob)$($sc.name)"
80+
# [**Gateway**](#tab/gateway)
81+
82+
Use [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount) and [New-AzStorageContainer](/powershell/module/az.storage/new-azstoragecontainer) to create a new storage account and a container. Then, use [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) to start troubleshooting the VPN gateway.
83+
84+
```azurepowershell-interactive
85+
# Place the virtual network gateway configuration into a variable.
86+
$vng = Get-AzVirtualNetworkGateway -Name "myGateway" -ResourceGroupName "myResourceGroup"
87+
88+
# Create a new storage account.
89+
$sa = New-AzStorageAccount -Name "mystorageaccount" -SKU "Standard_LRS" -ResourceGroupName "myResourceGroup" -Location "eastus"
90+
91+
# Create a container.
92+
Set-AzCurrentStorageAccount -ResourceGroupName $sa.ResourceGroupName -Name $sa.StorageAccountName
93+
$sc = New-AzStorageContainer -Name "vpn"
94+
95+
# Start VPN troubleshoot session.
96+
Start-AzNetworkWatcherResourceTroubleshooting -Location "eastus" -TargetResourceId $vng.Id -StorageId $sa.Id -StoragePath "https://mystorageaccount.blob.core.windows.net/{containerName}"
7297
```
7398

74-
Once you run the cmdlet, Network Watcher reviews the resource to verify its health. It returns the results to the shell and stores logs of the results in the storage account specified.
99+
# [**Connection**](#tab/connection)
75100

76-
## Understanding the results
101+
Use [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount) and [New-AzStorageContainer](/powershell/module/az.storage/new-azstoragecontainer) to create a new storage account and a container. Then, use [Start-AzNetworkWatcherResourceTroubleshooting](/powershell/module/az.network/start-aznetworkwatcherresourcetroubleshooting) to start troubleshooting the VPN gateway.
77102

78-
The action text provides general guidance on how to resolve the issue.
103+
```azurepowershell-interactive
104+
# Place the virtual network gateway configuration into a variable.
105+
$connection = Get-AzVirtualNetworkGatewayConnection -Name "myConnection" -ResourceGroupName "myResourceGroup"
79106
80-
- If an action can be taken for the issue, a link is provided with additional guidance.
81-
- If there's no guidance provided, the response provides the URL to open a support case.
107+
# Create a new storage account.
108+
$sa = New-AzStorageAccount -Name "mystorageaccount" -SKU "Standard_LRS" -ResourceGroupName "myResourceGroup" -Location "eastus"
109+
110+
# Create a container.
111+
Set-AzCurrentStorageAccount -ResourceGroupName $sa.ResourceGroupName -Name $sa.StorageAccountName
112+
$sc = New-AzStorageContainer -Name "vpn"
113+
114+
# Start VPN troubleshoot session.
115+
Start-AzNetworkWatcherResourceTroubleshooting -Location "eastus" -TargetResourceId $connection.Id -StorageId $sa.Id -StoragePath "https://mystorageaccount.blob.core.windows.net/{containerName}"
116+
```
117+
118+
---
82119

83-
For more information about the properties of the response and what is included, see [Network Watcher Troubleshoot overview](network-watcher-troubleshoot-overview.md).
120+
After the troubleshooting request is completed, ***healthy*** or ***unhealthy*** is returned. Detailed logs are stored in the storage account container you specified in the previous command. For more information, see [Log files](network-watcher-troubleshoot-overview.md#log-files). You can use Storage explorer or any other way you prefer to access and download the logs. For more information, see [Get started with Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md).
84121

85-
For instructions on downloading files from Azure storage accounts, refer to [Get started with Azure Blob storage using .NET](../storage/blobs/storage-quickstart-blobs-dotnet.md). Another tool that can be used is Storage Explorer. For more information, see [Storage Explorer](https://storageexplorer.com/).
122+
## Related content
86123

87-
## Next steps
124+
- [Tutorial: Diagnose a communication problem between virtual networks using the Azure portal](diagnose-communication-problem-between-networks.md).
88125

89-
If VPN connectivity has been stopped due to a change in settings, see [Manage Network Security Groups](../virtual-network/manage-network-security-group.md) to track down the network security group and security rules that may be in question.
126+
- [VPN troubleshoot overview](network-watcher-troubleshoot-overview.md).

0 commit comments

Comments
 (0)