Merge branch 'main' into md-arm-deployment

Author: Manika Dhiman

AKS-Arc/TOC.yml

@@ -181,6 +181,8 @@
       href: check-vm-sku.md
     - name: Connectivity issues with MetalLB
       href: load-balancer-issues.md
+    - name: Troubleshoot general network validation errors
+      href: network-validation-errors.md
     - name: Network validation error due to .local domain
       href: network-validation-error-local.md
   - name: Reference

AKS-Arc/disable-windows-nodepool.md

@@ -90,7 +90,7 @@ az k8s-extension update --resource-group $resourceGroup --cluster-name $clusterN
 If for some reason you're not able to use Azure CloudShell or a machine with connectivity to Azure in order to disable Windows nodepool, you can disable Windows nodepool after connecting to any one of the Azure Local physical nodes with Remote Desktop. You must first sign in to Azure.
 
 ```powershell
-az login --use-device-code --tenant-id <Azure tenant ID>
+az login --use-device-code --tenant <Azure tenant ID>
  
 az account set -s <subscription ID>
  

AKS-Arc/network-validation-errors.md

@@ -0,0 +1,102 @@
+---
+title: Troubleshoot network validation errors
+description: Learn how to troubleshoot general network validation errors in AKS Arc.
+author: sethmanheim
+ms.author: sethm
+ms.topic: troubleshooting
+ms.date: 05/07/2025
+ms.reviewer: pradwivedi
+ms.lastreviewed: 05/06/2025
+
+---
+
+# Troubleshoot network validation errors
+
+This article describes how to identify and resolve various network validation errors you might encounter during cluster creation. The article emphasizes the importance of pre-checks for early issue detection. These errors are detected by pre-checks designed to highlight issues early, allowing for easier resolution before the cluster is created.
+
+The article summarizes error codes, their potential causes, and actionable mitigation steps to help you resolve issues effectively.
+
+## CloudAgentConnectivityError
+
+Error: Network validation failed during cluster creation.
+
+### Description
+
+Detailed message: `Not able to connect to http://cloudagent.contoso.local:50000. Error returned: action failed after 5 attempts: Get "http://cloudagent.contoso.local:50000": dial tcp: lookup http://cloudagent.contoso.local: Temporary failure in name resolution`
+
+The MOC cloud agent is created using one of the IP addresses from the [Management IP pool](/azure/azure-local/plan/cloud-deployment-network-considerations#management-ip-pool) on port 5500 and the control plane node VM is given IP addresses from the Arc VM logical network. This error occurs when the MOC cloud agent is not reachable from the control plane VM, or when the DNS servers specified in the Arc VM logical network are unable to resolve the MOC cloud agent FQDN.
+
+### Causes of failure
+
+Logical network IP addresses can't connect to management IP pool addresses, due to:
+
+- Incorrect DNS server resolution.
+- Firewall rules between the Arc VM logical network and the cloud agent endpoint.
+- The logical network is in a different VLAN than the management IP pool and there's no cross-VLAN connectivity.
+
+### Mitigation
+
+To resolve this error, you can take the following steps:
+
+- Make sure that the DNS servers specified in the Arc VM logical network can resolve the MOC cloud agent FQDN.
+- Make sure that the logical network IP addresses can connect to all the management IP pool addresses on the required ports. For a detailed list of ports that need to be opened, see [AKS network port and cross-VLAN requirements](aks-hci-network-system-requirements.md#network-port-and-cross-vlan-requirements).
+
+## InternetConnectivityError
+
+Error: Network validation failed during cluster creation.
+
+### Description
+
+Detailed message: `Not able to connect to https://mcr.microsoft.com. Error returned: action failed after 5 attempts: Get "https://mcr.microsoft.com": dial tcp: lookup mcr.microsoft.com on <>: read udp <>: i/o timeout`.
+
+This error indicates that the required URLs are not reachable from the AKS cluster control plane node VM.
+
+### Causes of failure
+
+- Control plane node VM has no outbound internet access.
+- Required URLs aren't allowed through the firewall.
+
+### Mitigation
+
+To resolve this error, ensure that the logical network IP addresses have outbound internet access. If there's a firewall, ensure that the [AKS required URLs](aks-hci-network-system-requirements.md#firewall-url-exceptions) are accessible from the Arc VM logical network.
+
+## VMNotReachableError
+
+Error: Network validation failed during cluster creation.
+
+### Description
+
+Detailed message: `VM IP : <> is not reachable from management cluster`.
+
+This error indicates that the AKS cluster control plane VM is not reachable from the Arc Resource Bridge (ARB).
+
+### Causes of failure
+
+The Arc VM logical network is not reachable from management IP pool addresses.
+
+### Mitigation
+
+To resolve this error, you can take the following steps:
+
+- Make sure that the management IP pool addresses can reach the logical network IP addresses.
+- For a detailed list of ports that need to be opened, see [AKS network port and cross-VLAN requirements](aks-hci-network-system-requirements.md#network-port-and-cross-vlan-requirements).
+
+## DNSResolutionError
+
+This error occurs when DNS servers specified in the Arc VM logical network can't resolve the MOC cloud FQDN or the required URLs.
+
+### Causes of failure
+
+DNS servers specified in a logical network can't resolve the MOC cloud FQDN or the required URLs.
+
+### Mitigation
+
+To resolve this error, check the DNS servers specified in the logical network so that they can resolve the MOC cloud FQDN or the required URLs.
+
+## Contact Microsoft Support
+
+If problems persist, [collect AKS cluster logs](get-on-demand-logs.md) before you [create a support request](aks-troubleshoot.md#open-a-support-request).
+
+## Next steps
+
+[Troubleshoot issues in AKS enabled by Azure Arc](aks-troubleshoot.md)

azure-local/TOC.yml

@@ -35,15 +35,15 @@ items:
   - name: Virtual deployment
     href: deploy/deployment-virtual.md
   - name: Azure Local jumpstart
-    href: https://arcjumpstart.com/azure_jumpstart_hcibox/getting_started
+    href: https://jumpstart.azure.com/azure_jumpstart_localbox
 
 - name: Plan
   items:
   - name: Review requirements
     items:
     - name: System requirements
       href: concepts/system-requirements-23h2.md
-    - name: System requirements for Small Form Factor
+    - name: System requirements for low capacity class
       href: concepts/system-requirements-small-23h2.md
     - name: Physical network requirements
       href: concepts/physical-network-requirements.md
@@ -527,9 +527,9 @@ items:
   - name: Migrate using SCVMM
     items:
     - name: For Hyper-V VMs
-      href: /system-center/vmm/manage-azure-stack-hci?toc=/azure/azure-local/toc.json&bc=/azure/azure-local/breadcrumb/toc.json#migrate-vms-from-windows-server-to-azure-local-instance
+      href: /system-center/vmm/manage-azure-stack-hci#migrate-vms-from-windows-server-to-azure-local-instance
     - name: For VMware VMs
-      href: /system-center/vmm/vm-convert-vmware?toc=/azure/azure-local/toc.json&bc=/azure/azure-local/breadcrumb/toc.json
+      href: /system-center/vmm/vm-convert-vmware
   - name: Migrate manually (v22H2 only)
     items:
     - name: To same hardware
@@ -711,9 +711,9 @@ items:
   - name: Migrate using SCVMM
     items:
     - name: For Hyper-V VMs
-      href: /system-center/vmm/deploy-manage-azure-stack-hci?toc=/azure/azure-local/toc.json&bc=/azure/azure-local/breadcrumb/toc.json#step-8-migrate-vms-from-windows-server-to-azure-local-instance
+      href: /system-center/vmm/deploy-manage-azure-stack-hci#step-8-migrate-vms-from-windows-server-to-azure-local-instance
     - name: For VMware VMs
-      href: /system-center/vmm/deploy-manage-azure-stack-hci?toc=/azure/azure-local/toc.json&bc=/azure/azure-local/breadcrumb/toc.json#step-9-migrate-vmware-workloads-to-azure-local-instance-using-scvmm
+      href: /system-center/vmm/deploy-manage-azure-stack-hci#step-9-migrate-vmware-workloads-to-azure-local-instance-using-scvmm
   - name: Concepts
     items:
     - name: Storage and systems

azure-local/concepts/firewall-requirements.md

@@ -65,6 +65,11 @@ For a consolidated list of endpoints for Japan East that includes Azure Local, A
 For a consolidated list of endpoints for South Central US that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
 - [Required endpoints in South Central US for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md)
 
+## Required firewall URLs for Azure Local in Azure Government regions
+
+For a consolidated list of endpoints for US Gov Virginia that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
+- [Required endpoints in US Gov Virginia for Azure Local](https://github.com/CristianEdwards/AzureStack-Tools/blob/master/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md)
+
 ## Firewall requirements for OEMs
 
 Depending on the OEM you are using for Azure Local you may need to open additional endpoints in your firewall.

azure-local/concepts/software-defined-networking.md

@@ -5,7 +5,7 @@ author: AnirbanPaul
 ms.author: anpaul
 ms.topic: conceptual
 ms.service: azure-local
-ms.date: 04/17/2023
+ms.date: 05/06/2025
 ---
 
 # Software Defined Networking (SDN) in Azure Stack HCI and Windows Server
@@ -21,7 +21,7 @@ Virtual network elements such as [Hyper-V Virtual Switch](/windows-server/virtua
 There are three major SDN components, and you can choose which you want to deploy: Network Controller, Software Load Balancer, and Gateway.
 
    > [!NOTE]
-   > SDN is not supported on stretched (multi-site) clusters.
+   > SDN isn't supported on stretched (multi-site) clusters.
 
 ## Network Controller
 
@@ -45,7 +45,7 @@ You have the option to [deploy SDN Network Controller using SDN Express](../mana
 Gateways are used for routing network traffic between a virtual network and another network, either local or remote. Gateways can be used to:
 
 - Create secure site-to-site IPsec connections between SDN virtual networks and external customer networks over the internet.
-- Create Generic Routing Encapsulation (GRE) connections between SDN virtual networks and external networks. The difference between site-to-site connections and GRE connections is that the latter is not an encrypted connection. For more information about GRE connectivity scenarios, see [GRE Tunneling in Windows Server](/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server).
+- Create Generic Routing Encapsulation (GRE) connections between SDN virtual networks and external networks. The difference between site-to-site connections and GRE connections is that the latter isn't an encrypted connection. For more information about GRE connectivity scenarios, see [GRE Tunneling in Windows Server](/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server).
 - Create Layer 3 connections between SDN virtual networks and external networks. In this case, the SDN gateway simply acts as a router between your virtual network and the external network.
 
 Gateways use [Border Gateway Protocol](/windows-server/remote/remote-access/bgp/border-gateway-protocol-bgp) to advertise GRE endpoints and establish point-to-point connections. SDN deployment creates a default gateway pool that supports all connection types. Within this pool, you can specify how many gateways are reserved on standby in case an active gateway fails.