Skip to content

Commit cb9e9ed

Browse files
halkazwinihalkazwini
committed
add Test connectivity to a website section
1 parent 0667f00 commit cb9e9ed

File tree

1 file changed

+157
-3
lines changed

1 file changed

+157
-3
lines changed

‎articles/network-watcher/connection-troubleshoot-cli.md

Lines changed: 157 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,18 +40,18 @@ In this article, you learn how to use the connection troubleshoot feature of Azu
4040
> - To install the extension on a Linux virtual machine, see [Network Watcher agent VM extension for Linux](../virtual-machines/extensions/network-watcher-linux.md?toc=/azure/network-watcher/toc.json&bc=/azure/network-watcher/breadcrumb/toc.json).
4141
> - To update an already installed extension, see [Update Network Watcher agent VM extension to the latest version](../virtual-machines/extensions/network-watcher-update.md?toc=/azure/network-watcher/toc.json&bc=/azure/network-watcher/breadcrumb/toc.json).
4242
43-
## Check connectivity to a virtual machine
43+
## Test connectivity to a virtual machine
4444

4545
In this section, you test the remote desktop port (RDP) connectivity from one virtual machine to another virtual machine in the same virtual network.
4646

47-
Use [az network watcher test-connectivity](/cli/azure/network/watcher#az-network-watcher-test-connectivity) to run connection troubleshoot diagnostic tests to check the connectivity to a virtual machine over port 3389:
47+
Use [az network watcher test-connectivity](/cli/azure/network/watcher#az-network-watcher-test-connectivity) to run connection troubleshoot diagnostic tests to test the connectivity to a virtual machine over port 3389:
4848

4949
```azurecli-interactive
5050
# Test connectivity between two virtual machines that are in the same resource group over port 3389.
5151
az network watcher test-connectivity --resource-group 'myResourceGroup' --source-resource 'VM1' --dest-resource 'VM2' --protocol 'TCP' --dest-port '3389'
5252
```
5353

54-
If the virtual machines aren't in the same resource group, then use their resource IDs instead of the names:
54+
If the virtual machines aren't in the same resource group, use their resource IDs instead of their names:
5555

5656
```azurecli-interactive
5757
# Test connectivity between two virtual machines that are in two different resource groups over port 3389.
@@ -118,6 +118,7 @@ az network watcher test-connectivity --source-resource '/subscriptions/abcdef01-
118118
}
119119
```
120120

121+
121122
- Connection status is **Reachable** (destination virtual machine is reachable over port 3389).
122123
- 66 probes were successfully sent to the destination virtual machine.
123124
- There are two hopes in the path between the two virtual machines (no appliances or other resources in the path between the two VMs).
@@ -194,11 +195,14 @@ az network watcher test-connectivity --source-resource '/subscriptions/abcdef01-
194195
}
195196
```
196197

198+
197199
- Connection status is **Unreachable** (destination virtual machine is unreachable over port 3389).
198200
- 30 probes were sent and failed to reach the destination virtual machine.
199201
- There are two hopes in the path between the two virtual machines (no appliances or other resources in the path between the two VMs).
200202
- Inbound connectivity to the destination virtual machine is denied by the security rule `Deny3389Inbound` in the network security group `VM2-nsg`.
201203

204+
**Solution**: Update the network security group on the destination virtual machine to allow inbound RDP traffic.
205+
202206
- If the source virtual machine has a network security group that's denying RDP connections to the destination, you see the following results:
203207

204208
```json
@@ -272,11 +276,14 @@ az network watcher test-connectivity --source-resource '/subscriptions/abcdef01-
272276
}
273277
```
274278

279+
275280
- Connection status is **Unreachable** (destination virtual machine is unreachable over port 3389).
276281
- 30 probes were sent and failed to reach the destination virtual machine.
277282
- There are two hopes in the path between the two virtual machines (no appliances or other resources in the path between the two VMs).
278283
- Outbound connectivity from the source virtual machine is denied by the security rule `Deny3389Outbound` in the network security group `VM1-nsg`.
279284

285+
**Solution**: Update the network security group on the source virtual machine to allow outbound RDP traffic.
286+
280287
- If the operating system on the destination virtual machine doesn't accept incoming connections on port 3389, you see the following results:
281288

282289
```json
@@ -349,6 +356,153 @@ az network watcher test-connectivity --source-resource '/subscriptions/abcdef01-
349356
- There are two hopes in the path between the two virtual machines (no appliances or other resources in the path between the two VMs).
350357
- Port 3389 isn't reachable on the destination virtual machine. The output has `NoListenerOnDestination` and `GuestFirewall` errors on the destination virtual machine.
351358

359+
**Solution**: Configure the operating system on the destination virtual machine to accept inbound RDP traffic.
360+
361+
## Test connectivity to a website
362+
363+
In this section, you test connectivity between a virtual machine and a website.
364+
365+
Use [az network watcher test-connectivity](/cli/azure/network/watcher#az-network-watcher-test-connectivity) to run connection troubleshoot to test the connectivity to `www.bing.com`:
366+
367+
```azurecli-interactive
368+
# Test connectivity between two virtual machines that are in the same resource group over port 3389.
369+
az network watcher test-connectivity --resource-group 'myResourceGroup' --source-resource 'VM1' --dest-address 'www.bing.com' --protocol 'TCP' --dest-port '443'
370+
```
371+
372+
- If `www.bing.com` is reachable from the source virtual machine, you see the following results:
373+
374+
```json
375+
{
376+
"avgLatencyInMs": 9,
377+
"connectionStatus": "Reachable",
378+
"hops": [
379+
{
380+
"address": "10.0.0.4",
381+
"id": "00000000-0000-0000-0000-000000000000",
382+
"issues": [],
383+
"links": [
384+
{
385+
"context": {},
386+
"issues": [],
387+
"linkType": "Internet",
388+
"nextHopId": "11111111-1111-1111-1111-111111111111",
389+
"resourceId": "",
390+
"roundTripTimeAvg": 9,
391+
"roundTripTimeMax": 9,
392+
"roundTripTimeMin": 9
393+
}
394+
],
395+
"nextHopIds": [
396+
"11111111-1111-1111-1111-111111111111"
397+
],
398+
"previousHopIds": [],
399+
"previousLinks": [],
400+
"resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1",
401+
"type": "Source"
402+
},
403+
{
404+
"address": "104.117.244.81",
405+
"id": "11111111-1111-1111-1111-111111111111",
406+
"issues": [],
407+
"links": [],
408+
"nextHopIds": [],
409+
"previousHopIds": [
410+
"00000000-0000-0000-0000-000000000000"
411+
],
412+
"previousLinks": [
413+
{
414+
"context": {},
415+
"issues": [],
416+
"linkType": "Internet",
417+
"nextHopId": "00000000-0000-0000-0000-000000000000",
418+
"resourceId": ""
419+
}
420+
],
421+
"type": "Internet"
422+
}
423+
],
424+
"maxLatencyInMs": 13,
425+
"minLatencyInMs": 7,
426+
"probesFailed": 0,
427+
"probesSent": 66
428+
}
429+
```
430+
431+
432+
- 66 probes were successfully sent to `www.bing.com` with average latency of 9 ms.
433+
- Next hop type is `Internet`.
434+
435+
- If `www.bing.com` is unreachable from the source virtual machine due to a security rule, you see the following results:
436+
437+
```json
438+
{
439+
"connectionStatus": "Unreachable",
440+
"hops": [
441+
{
442+
"address": "10.0.0.4",
443+
"id": "425bc206-b4d8-4c4e-8ea6-5175211cb858",
444+
"issues": [
445+
{
446+
"context": [
447+
{
448+
"key": "RuleName",
449+
"value": "/subscriptions/793c74bb-7f49-419b-a8a0-f3c66c48050b/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM1-nsg/SecurityRules/DenyInternetOutbound"
450+
}
451+
],
452+
"origin": "Outbound",
453+
"severity": "Error",
454+
"type": "NetworkSecurityRule"
455+
}
456+
],
457+
"links": [
458+
{
459+
"context": {},
460+
"issues": [],
461+
"linkType": "Internet",
462+
"nextHopId": "5a5adacb-80f3-4e00-ae0e-927ece6e3c61",
463+
"resourceId": ""
464+
}
465+
],
466+
"nextHopIds": [
467+
"5a5adacb-80f3-4e00-ae0e-927ece6e3c61"
468+
],
469+
"previousHopIds": [],
470+
"previousLinks": [],
471+
"resourceId": "/subscriptions/793c74bb-7f49-419b-a8a0-f3c66c48050b/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1",
472+
"type": "Source"
473+
},
474+
{
475+
"address": "23.198.7.184",
476+
"id": "5a5adacb-80f3-4e00-ae0e-927ece6e3c61",
477+
"issues": [],
478+
"links": [],
479+
"nextHopIds": [],
480+
"previousHopIds": [
481+
"425bc206-b4d8-4c4e-8ea6-5175211cb858"
482+
],
483+
"previousLinks": [
484+
{
485+
"context": {},
486+
"issues": [],
487+
"linkType": "Internet",
488+
"nextHopId": "425bc206-b4d8-4c4e-8ea6-5175211cb858",
489+
"resourceId": ""
490+
}
491+
],
492+
"type": "Internet"
493+
}
494+
],
495+
"probesFailed": 30,
496+
"probesSent": 30
497+
}
498+
```
499+
500+
501+
- 30 probes were sent and failed to reach `www.bing.com`.
502+
- Outbound connectivity from the source virtual machine is denied by the security rule `DenyInternetOutbound` in the network security group `VM1-nsg`.
503+
- Next hop type is `Internet`.
504+
505+
**Solution**: Update the network security group on the source virtual machine to allow outbound traffic to `www.bing.com`.
352506

353507
## Validate routing issues
354508

0 commit comments

Comments
 (0)