You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Troubleshoot issues with NAT Gateway.
3
+
titleSuffix: Azure NAT Gateway
4
+
description: Get started using this article to learn how to troubleshoot issues and errors with Azure NAT Gateway.
5
5
services: virtual-network
6
6
author: asudbring
7
7
ms.service: nat-gateway
8
8
ms.topic: troubleshooting
9
-
ms.date: 08/29/2022
9
+
ms.date: 02/14/2024
10
10
ms.author: allensu
11
11
---
12
12
@@ -30,26 +30,27 @@ Check the following configurations to ensure that NAT gateway can be used to dir
30
30
31
31
1. At least one public IP address or one public IP prefix is attached to NAT gateway. At least one public IP address must be associated with the NAT gateway for it to provide outbound connectivity.
32
32
33
-
2. At least one subnet is attached to a NAT gateway. You can attach multiple subnets to a NAT gateway for going outbound, but those subnets must exist within the same virtual network. NAT gateway can't span beyond a single virtual network.
33
+
1. At least one subnet is attached to a NAT gateway. You can attach multiple subnets to a NAT gateway for going outbound, but those subnets must exist within the same virtual network. NAT gateway can't span beyond a single virtual network.
34
34
35
-
3. No [NSG rules](../virtual-network/network-security-groups-overview.md#outbound) or UDRs are blocking NAT gateway from directing traffic outbound to the internet.
35
+
1. No [Network Security Group (NSG) rules](../virtual-network/network-security-groups-overview.md#outbound) or User Defined Routes (UDR) are blocking NAT gateway from directing traffic outbound to the internet.
36
36
37
37
### How to validate connectivity
38
38
39
-
[NAT gateway](./nat-overview.md#azure-nat-gateway-basics) supports IPv4 UDP and TCP protocols. ICMP isn't supported and is expected to fail.
39
+
[NAT gateway](./nat-overview.md#azure-nat-gateway-basics) supports IPv4 User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) protocols. Ping isn't supported and is expected to fail.
40
40
41
41
To validate end-to-end connectivity of NAT gateway, follow these steps:
42
+
42
43
1. Validate that your [NAT gateway public IP address is being used](./quickstart-create-nat-gateway-portal.md#test-nat-gateway).
43
44
44
-
2. Conduct TCP connection tests and UDP-specific application layer tests.
45
+
1. Conduct TCP connection tests and UDP-specific application layer tests.
45
46
46
-
3. Look at NSG flow logs to analyze outbound traffic flows from NAT gateway.
47
+
1. Look at NSG flow logs to analyze outbound traffic flows from NAT gateway.
47
48
48
-
Refer to the table below for which tools to use to validate NAT gateway connectivity.
49
+
Refer to the following table for tools to use to validate NAT gateway connectivity.
49
50
50
51
| Operating system | Generic TCP connection test | TCP application layer test | UDP |
51
52
|---|---|---|---|
52
-
| Linux |nc (generic connection test) | curl (TCP application layer test) | application specific |
53
+
| Linux |`nc` (generic connection test) |`curl` (TCP application layer test) | application specific |
53
54
| Windows |[PsPing](/sysinternals/downloads/psping)| PowerShell [Invoke-WebRequest](/powershell/module/microsoft.powershell.utility/invoke-webrequest)| application specific |
54
55
55
56
### How to analyze outbound connectivity
@@ -64,17 +65,17 @@ To analyze outbound traffic from NAT gateway, use NSG flow logs. NSG flow logs p
64
65
65
66
## NAT gateway in a failed state
66
67
67
-
You may experience outbound connectivity failure if your NAT gateway resource is in a failed state. To get your NAT gateway out of a failed state, follow these instructions:
68
+
You can experience outbound connectivity failure if your NAT gateway resource is in a failed state. To get your NAT gateway out of a failed state, follow these instructions:
68
69
69
-
1.Once you identify the resource that is in a failed state, go to [Azure Resource Explorer](https://resources.azure.com/) and identify the resource in this state.
70
+
1.Identify the resource that is in a failed state. Go to [Azure Resource Explorer](https://resources.azure.com/) and identify the resource in this state.
70
71
71
-
2. Update the toggle on the right-hand top corner to Read/Write.
72
+
1. Update the toggle on the right-hand top corner to Read/Write.
72
73
73
-
3. Select on Edit for the resource in failed state.
74
+
1. Select on Edit for the resource in failed state.
74
75
75
-
4. Select on PUT followed by GET to ensure the provisioning state was updated to Succeeded.
76
+
1. Select on PUT followed by GET to ensure the provisioning state was updated to Succeeded.
76
77
77
-
5. You can then proceed with other actions as the resource is out of failed state.
78
+
1. You can then proceed with other actions as the resource is out of failed state.
78
79
79
80
## Add or remove NAT gateway
80
81
@@ -88,65 +89,65 @@ NAT gateway must be detached from all subnets within a virtual network before th
88
89
89
90
A subnet within a virtual network can't have more than one NAT gateway attached to it for connecting outbound to the internet. An individual NAT gateway resource can be associated to multiple subnets within the same virtual network. NAT gateway can't span beyond a single virtual network.
90
91
91
-
### Basic SKU resources can't exist in the same subnet as NAT gateway
92
+
### Basic resources can't exist in the same subnet as NAT gateway
92
93
93
94
NAT gateway isn't compatible with basic resources, such as Basic Load Balancer or Basic Public IP. Basic resources must be placed on a subnet not associated with a NAT Gateway. Basic Load Balancer and Basic Public IP can be upgraded to standard to work with NAT gateway.
94
95
95
96
* To upgrade a basic load balancer to standard, see [upgrade from basic public to standard public load balancer](../load-balancer/upgrade-basic-standard.md).
96
97
97
98
* To upgrade a basic public IP to standard, see [upgrade from basic public to standard public IP](../virtual-network/ip-services/public-ip-upgrade-portal.md).
98
99
99
-
* To upgrade a basic public IP with an attached VM to standard, see [upgrade a basic public IP with an attached VM](/azure/virtual-network/ip-services/public-ip-upgrade-vm).
100
+
* To upgrade a basic public IP with an attached virtual machine to standard, see [upgrade a basic public IP with an attached virtual machine](/azure/virtual-network/ip-services/public-ip-upgrade-virtual machine).
100
101
101
102
### NAT gateway can't be attached to a gateway subnet
102
103
103
104
NAT gateway can't be deployed in a gateway subnet. A gateway subnet is used by a VPN gateway for sending encrypted traffic between an Azure virtual network and on-premises location. See [VPN gateway overview](../vpn-gateway/vpn-gateway-about-vpngateways.md) to learn more about how gateway subnets are used by VPN gateway.
104
105
105
-
### Can't attach NAT gateway to a subnet that contains a virtual machine NIC in a failed state
106
+
### Can't attach NAT gateway to a subnet that contains a virtual machine network interface in a failed state
106
107
107
-
When associating a NAT gateway to a subnet that contains a virtual machine network interface (NIC) in a failed state, you receive an error message indicating that this action can't be performed. You must first resolve the VM NIC failed state before you can attach a NAT gateway to the subnet.
108
+
When associating a NAT gateway to a subnet that contains a virtual machine network interface (network interface) in a failed state, you receive an error message indicating that this action can't be performed. You must first resolve the virtual machine network interface failed state before you can attach a NAT gateway to the subnet.
108
109
109
-
To get your virtual machine NIC out of a failed state, you can use one of the two following methods.
110
+
To get your virtual machine network interface out of a failed state, you can use one of the two following methods.
110
111
111
-
#### Use PowerShell to get your virtual machine NIC out of a failed state
112
+
#### Use PowerShell to get your virtual machine network interface out of a failed state
112
113
113
-
1. Determine the provisioning state of your NICs using the [Get-AzNetworkInterface PowerShell command](/powershell/module/az.network/get-aznetworkinterface#example-2-get-all-network-interfaces-with-a-specific-provisioning-state) and setting the value of the "provisioningState" to "Succeeded".
114
+
1. Determine the provisioning state of your network interfaces using the [Get-AzNetworkInterface PowerShell command](/powershell/module/az.network/get-aznetworkinterface#example-2-get-all-network-interfaces-with-a-specific-provisioning-state) and setting the value of the "provisioningState" to "Succeeded."
114
115
115
-
2. Perform [GET/SET PowerShell commands](/powershell/module/az.network/set-aznetworkinterface#example-1-configure-a-network-interface) on the network interface to update the provisioning state.
116
+
1. Perform [GET/SET PowerShell commands](/powershell/module/az.network/set-aznetworkinterface#example-1-configure-a-network-interface) on the network interface. The PowerShell commands update the provisioning state.
116
117
117
-
3. Check the results of this operation by checking the provisioning state of your NICs again (follow commands from step 1).
118
+
1. Check the results of this operation by checking the provisioning state of your network interfaces again (follow commands from step 1).
118
119
119
-
#### Use Azure Resource Explorer to get your virtual machine NIC out of a failed state
120
+
#### Use Azure Resource Explorer to get your virtual machine network interface out of a failed state
120
121
121
122
1. Go to [Azure Resource Explorer](https://resources.azure.com/) (recommended to use Microsoft Edge browser)
122
123
123
-
2. Expand Subscriptions (takes a few seconds for it to appear on the left)
124
+
1. Expand Subscriptions (takes a few seconds for it to appear).
124
125
125
-
3. Expand your subscription that contains the VM NIC in the failed state
126
+
1. Expand your subscription that contains the virtual machine network interface in the failed state.
126
127
127
-
4. Expand resourceGroups
128
+
1. Expand resourceGroups.
128
129
129
-
5. Expand the correct resource group that contains the VM NIC in the failed state
130
+
1. Expand the correct resource group that contains the virtual machine network interface in the failed state.
130
131
131
-
6. Expand providers
132
+
1. Expand providers.
132
133
133
-
7. Expand Microsoft.Network
134
+
1. Expand Microsoft.Network.
134
135
135
-
8. Expand networkInterfaces
136
+
1. Expand networkInterfaces.
136
137
137
-
9. Select on the NIC that is in the failed provisioning state
138
+
1. Select on the network interface that is in the failed provisioning state.
138
139
139
-
10. Select the Read/Write button at the top
140
+
1. Select the Read/Write button at the top.
140
141
141
-
11. Select the green GET button
142
+
1. Select the green GET button.
142
143
143
-
12. Select the blue EDIT button
144
+
1. Select the blue EDIT button.
144
145
145
-
13. Select the green PUT button
146
+
1. Select the green PUT button.
146
147
147
-
14. Select Read Only button at the top
148
+
1. Select Read Only button at the top.
148
149
149
-
15. The VM NIC should now be in a succeeded provisioning state, you can close your browser
150
+
1. The virtual machine network interface should now be in a succeeded provisioning state. You can close your browser.
150
151
151
152
## Add or remove public IP addresses
152
153
@@ -166,15 +167,15 @@ The following IP prefix sizes can be used with NAT gateway:
166
167
167
168
### IPv6 coexistence
168
169
169
-
[NAT gateway](nat-overview.md) supports IPv4 UDP and TCP protocols. NAT gateway can't be associated to an IPv6 Public IP address or IPv6 Public IP Prefix. NAT gateway can be deployed on a dual stack subnet, but only uses IPv4 Public IP addresses for directing outbound traffic. Deploy NAT gateway on a dual stack subnet when you need IPv6 resources to exist in the same subnet as IPv4 resources. See [Configure dual stack outbound connectivity with NAT gateway and public Load balancer](/azure/virtual-network/nat-gateway/tutorial-dual-stack-outbound-nat-load-balancer?tabs=dual-stack-outbound-portal) to learn how to provide IPv4 and IPv6 outbound connectivity from your dual stack subnet.
170
+
[NAT gateway](nat-overview.md) supports IPv4 UDP and TCP protocols. NAT gateway can't be associated to an IPv6 Public IP address or IPv6 Public IP Prefix. NAT gateway can be deployed on a dual stack subnet, but only uses IPv4 Public IP addresses for directing outbound traffic. Deploy NAT gateway on a dual stack subnet when you need IPv6 resources to exist in the same subnet as IPv4 resources. For more information about how to provide IPv4 and IPv6 outbound connectivity from your dual stack subnet, see [Dual stack outbound connectivity with NAT gateway and public Load balancer](/azure/virtual-network/nat-gateway/tutorial-dual-stack-outbound-nat-load-balancer?tabs=dual-stack-outbound-portal).
170
171
171
-
### Can't use basic SKU public IPs with NAT gateway
172
+
### Can't use basic public IPs with NAT gateway
172
173
173
-
NAT gateway is a standard SKU resource and can't be used with basic SKU resources, including basic public IP addresses. You can upgrade your basic SKU public IP address in order to use with your NAT gateway using the following guidance: [Upgrade a public IP address](../virtual-network/ip-services/public-ip-upgrade-portal.md)
174
+
NAT gateway is a standard resource and can't be used with basic resources, including basic public IP addresses. You can upgrade your basic public IP address in order to use with your NAT gateway using the following guidance: [Upgrade a public IP address.](../virtual-network/ip-services/public-ip-upgrade-portal.md)
174
175
175
176
### Can't mismatch zones of public IP addresses and NAT gateway
176
177
177
-
NAT gateway is a [zonal resource](./nat-availability-zones.md) and can either be designated to a specific zone or to ‘no zone’. When NAT gateway is placed in ‘no zone’, Azure places the NAT gateway into a zone for you, but you don't have visibility into which zone the NAT gateway is located.
178
+
NAT gateway is a [zonal resource](./nat-availability-zones.md) and can either be designated to a specific zone or to "no zone." When NAT gateway is placed in "no zone," Azure places the NAT gateway into a zone for you, but you don't have visibility into which zone the NAT gateway is located.
178
179
179
180
NAT gateway can be used with public IP addresses designated to a specific zone, no zone, all zones (zone-redundant) depending on its own availability zone configuration.
180
181
@@ -189,19 +190,21 @@ NAT gateway can be used with public IP addresses designated to a specific zone,
189
190
## More troubleshooting guidance
190
191
191
192
If the issue you're experiencing isn't covered by this article, refer to the other NAT gateway troubleshooting articles:
192
-
*[Troubleshoot outbound connectivity with NAT Gateway](/azure/nat-gateway/troubleshoot-nat-connectivity)
193
-
*[Troubleshoot outbound connectivity with NAT Gateway and other Azure services](/azure/nat-gateway/troubleshoot-nat-and-azure-services)
193
+
194
+
*[Troubleshoot outbound connectivity with NAT Gateway](/azure/nat-gateway/troubleshoot-nat-connectivity).
195
+
196
+
*[Troubleshoot outbound connectivity with NAT Gateway and other Azure services](/azure/nat-gateway/troubleshoot-nat-and-azure-services).
194
197
195
198
## Next steps
196
199
197
-
We're always looking to improve the experience of our customers. If you're experiencing issues with NAT gateway that aren't listed or resolved by this article, submit feedback through GitHub via the bottom of this page. We'll address your feedback as soon as possible.
200
+
If you're experiencing issues with NAT gateway not listed or resolved by this article, submit feedback through GitHub via the bottom of this page. We address your feedback as soon as possible to improve the experience of our customers.
0 commit comments