Resetting local Network Gateway site-to-site connections to allow traffic to pass

dev eloper 20

Hi everyone,

I have set up a site-to-site connection between Azure and an on-premises environment to provide access to applications that are otherwise closed to the outside. What I can't understand is why the connection often stops working (usually after a few days). I have to reset the local network gateway, and then it starts working again.

I have checked the IKE settings multiple times, and they are the same on both the on-prem device and Azure. My only concern is that Azure does not allow configuring the Phase 2 SA lifetime parameter, so we have set the same time for both phases.

Could you please provide support and help me with this issue?

Thank you.

KapilAnanth-MSFT 37,646 Reputation points Microsoft Employee

2024-05-20T05:44:52.25+00:00
@dev eloper ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I see you have mentioned, "reset the local network gateway"

Can you be more specific?

Are you talking about the Azure resource "Local Network Gateway/LNG" or your actual Local Network in OnPrem?

Because, I am not clear as how you can "Reset" the LNG in Azure?

Do you mean you are deleting and re-creating the LNG?

Did you check the logs during the actual time when the connection went down?

Especially IKEDiagnosticLog and TunnelDiagnosticLog

You have to check these logs while the connection is down and see why the tunnel is not coming up.

Also, I see you have mentioned "Azure does not allow configuring the Phase 2 SA lifetime parameter",

This is incorrect.

IKE Main Mode (Phase1) SA lifetime is fixed at 28,800 seconds.

QM SA (Phase2) Lifetime can range between 300 to 27000 seconds.

See : Custom Policy cryptographic requirements

Cheers,

Kapil
dev eloper 20 Reputation points

2024-05-20T08:23:41.5233333+00:00

Hi,

Thanks for your response. Let me address your points.

I have set up a virtual network gateway and attached two connections (local network gateways) to it on Azure. The entire configuration was followed step-by-step, and all settings are correct between the two gateways.

The problem is that the connection often drops, meaning the on-premises devices can no longer reach the private addresses on Azure. To resolve this issue, I have to go to Azure, click on reset for the local network gateway, and then the connection starts working again.

Regarding the Phase 2 SA lifetime parameter, I’ve attached a screenshot below showing that from the configuration, I can only set Phase 1.

if you can think of anything to help me, I'm available, as I'm at my wits' end.

Best regards,
KapilAnanth-MSFT 37,646 Reputation points Microsoft Employee

2024-05-20T09:52:04.4366667+00:00
@dev eloper ,

Thanks for sharing the details.

In Azure VPN Gateway,

I think you are resetting the VPN Gateway (and not local network gateway)

or You are resetting the Connection

As next steps,

Please Set up logging at the VPN Gateway

And check the IKEDiagnosticLog and TunnelDiagnosticLog

This will give us an idea as to what is the problem

From your screenshot, we can see Phase2 settings as well,

IPSEC is phase 2

Cheers,

Kapil
dev eloper 20 Reputation points

2024-05-20T13:42:55.1566667+00:00

I'm clicking the reset button on the local network gateway, so I believe I'm refreshing the local network gateway. In the screen you sent, I can only specify a lifetime value. However, on the on-premises device, there are two phases that I need to specify.
KapilAnanth-MSFT 37,646 Reputation points Microsoft Employee

2024-05-20T14:27:17.3+00:00

@dev eloper ,

I am not aware of the OnPrem device configuration settings.

However, IPSEC offers two SA Lifetimes - one in size and one in time and both of them are present at the screenshot.

Can you please share the logs as requested?

Cheers,

Kapil

Share via

Resetting local Network Gateway site-to-site connections to allow traffic to pass