Hi,
Network Setup-
A simple Hub and Spoke model with the VPN Gateway configured with path based routing hosted in the hub network. A couple of spoke networks that are peered to the hub. P2S connections are established from a couple client machines to the Azure Network.
Address details-
Hub Vnet - 10.0.0.0/24
Spoke 1 Vnet - 10.1.0.0/24
Spoke 2 Vnet - 10.2.0.0/24
Address Pool assigned to the P2S connection clients - 172.16.50.0/24
A VM hosted in the Spoke 1 - 10.1.0.4
A similar setup is shown in the attached image.
Observation:
When I connect to the VPN from a windows machine, the client receives an address from the pool, say 172.16.50.130
When I do a basic ping test (after enabling ICMP) from the windows client to the VM in spoke 1, it works fine. This confirms the correctness of the setup.
When I check the routes in the windows client (using route print command),
IPv4 Route Table
===========================================================================
Active Routes:
NetworkDestination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.29.1 192.168.29.37 25
10.0.0.0 255.255.0.0 On-link 172.16.50.130 43
10.0.255.255 255.255.255.255 On-link 172.16.50.130 281
10.1.0.0 255.255.0.0 On-link 172.16.50.130 43
10.1.255.255 255.255.255.255 On-link 172.16.50.130 281
20.193.245.69 255.255.255.255 92.168.29.1 192.168.29.37 26
The Gateway in the route to the hub and the spoke networks from the windows client is marked as "On-Link".
Upon some reading from the following 2 articles, my understanding is that routes that don't need a gateway as the next hop will be marked as "On-Link"
https://superuser.com/questions/59996/what-does-on-link-mean-on-the-result-of-route-print-command
The important piece of the answers,
it’s just a route that's directly reachable the NIC is in direct contact with it; on the same subnet. To explain a little further though: by contrast, the routes that have a gateway IP listed must be contacted through that gateway.
Also doing a tracert to the VM from the windows client shows just 1 hop and that is to the VM directly
Tracing Route to 10.1.0.4 over a maximum of 30 hops
1 29ms 28ms 28ms 10.1.0.4
Trace complete
Question
I understand the basic working of a VPN. The client machine is allocated an IP from the VPN server's address range. This is like virtually connecting the laptop to the cloud network so that it receives an IP from the same network.
However, the client's IP address is in 172.16.50.0/24 range and the hub and spokes are in the 10.0.0.0/24 and 10.1.0.0/24 address ranges.
How is the direct connection to the VM in the spoke accomplished? The answers from the forum posts for "On-Link" state that it is as if the VM's NIC is in the same subnet as the network destination it is trying to reach.
Any help to understand this concept would be much appreciated.
Thanks,
Sriram