Troubleshoot connections with Azure Network Watcher using the Azure REST API
Learn how to use connection troubleshoot to verify whether a direct TCP connection from a virtual machine to a given endpoint can be established.
Before you begin
This article assumes you have the following resources:
- An instance of Network Watcher in the region you want to troubleshoot a connection.
- Virtual machines to troubleshoot connections with.
Important
Connection troubleshoot requires that the VM you troubleshoot from has the AzureNetworkWatcherExtension VM extension installed. For installing the extension on a Windows VM visit Azure Network Watcher Agent virtual machine extension for Windows and for Linux VM visit Azure Network Watcher Agent virtual machine extension for Linux. The extension is not required on the destination endpoint.
Log in with ARMClient
Log in to armclient with your Azure credentials.
armclient login
Retrieve a virtual machine
Run the following script to return a virtual machine. This information is needed for running connectivity.
The following code needs values for the following variables:
- subscriptionId - The subscription ID to use.
- resourceGroupName - The name of a resource group that contains virtual machines.
$subscriptionId = '<subscription id>'
$resourceGroupName = '<resource group name>'
armclient get https://management.azure.com/subscriptions/${subscriptionId}/ResourceGroups/${resourceGroupName}/providers/Microsoft.Compute/virtualMachines?api-version=2015-05-01-preview
From the following output, the ID of the virtual machine is used in the following example:
...
,
"type": "Microsoft.Compute/virtualMachines",
"location": "westcentralus",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoExampleRG/providers/Microsoft.Compute
/virtualMachines/ContosoVM",
"name": "ContosoVM"
}
]
}
Check connectivity to a virtual machine
This example checks connectivity to a destination virtual machine over port 80.
Example
$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_westcentralus"
$sourceResourceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/MultiTierApp0"
$destinationResourceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/Database0"
$destinationPort = "0"
$requestBody = @"
{
'source': {
'resourceId': '${sourceResourceId}',
'port': 0
},
'destination': {
'resourceId': '${destinationResourceId}',
'port': ${destinationPort}
}
}
"@
$response = armclient post "https://management.azure.com/subscriptions/${subscriptionId}/ResourceGroups/${resourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/connectivityCheck?api-version=2017-03-01" $requestBody
Since this operation is long running, the URI for the result is returned in the response header as shown in the following response:
Important Values
- Location - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: f09b55fe-1d3a-4df7-817f-bceb8d2a94c8
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westcentralus/operationResults/f09b55fe-1d3a-4df7-817f-bceb8d2a94c8?api-version=2017-03-01
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: 367a91aa-7142-436a-867d-d3a36f80bc54
x-ms-routing-request-id: WESTUS2:20170602T202117Z:367a91aa-7142-436a-867d-d3a36f80bc54
Date: Fri, 02 Jun 2017 20:21:16 GMT
null
Response
The following response is from the previous example. In this response, the ConnectionStatus is Unreachable. You can see that all the probes sent failed. The connectivity failed at the virtual appliance due to a user-configured NetworkSecurityRule named UserRule_Port80, configured to block incoming traffic on port 80. This information can be used to research connection issues.
{
"hops": [
{
"type": "Source",
"id": "0cb75c91-7ebf-4df8-8424-15594d6fb51c",
"address": "10.1.1.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1",
"nextHopIds": [
"06dee00a-9c4a-4fb1-b2ea-fa0a539ca684"
],
"issues": []
},
{
"type": "VirtualAppliance",
"id": "06dee00a-9c4a-4fb1-b2ea-fa0a539ca684",
"address": "10.1.2.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/fwNic/ipConfigurations/ipconfig1",
"nextHopIds": [
"75e0cfa5-f9d2-48d8-b705-2c7016f81570"
],
"issues": []
},
{
"type": "VirtualAppliance",
"id": "75e0cfa5-f9d2-48d8-b705-2c7016f81570",
"address": "10.1.3.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/auNic/ipConfigurations/ipconfig1",
"nextHopIds": [
"86caf6aa-33b0-48a1-b4da-f3c9ce785072"
],
"issues": [
{
"origin": "Outbound",
"severity": "Error",
"type": "NetworkSecurityRule",
"context": [
{
"key": "RuleName",
"value": "UserRule_Port80"
}
]
}
]
},
{
"type": "VnetLocal",
"id": "86caf6aa-33b0-48a1-b4da-f3c9ce785072",
"address": "10.1.4.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/dbNic0/ipConfigurations/ipconfig1",
"nextHopIds": [],
"issues": []
}
],
"connectionStatus": "Unreachable",
"probesSent": 100,
"probesFailed": 100
}
Validate routing issues
The example checks connectivity between a virtual machine and a remote endpoint.
Example
$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_westcentralus"
$sourceResourceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/MultiTierApp0"
$destinationResourceId = "13.107.21.200"
$destinationPort = "80"
$requestBody = @"
{
'source': {
'resourceId': '${sourceResourceId}',
'port': 0
},
'destination': {
'address': '${destinationResourceId}',
'port': ${destinationPort}
}
}
"@
$response = armclient post "https://management.azure.com/subscriptions/${subscriptionId}/ResourceGroups/${resourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/connectivityCheck?api-version=2017-03-01" $requestBody
Since this operation is long running, the URI for the result is returned in the response header as shown in the following response:
Important Values
- Location - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: 15eeeb69-fcef-41db-bc4a-e2adcf2658e0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westcentralus/operationResults/15eeeb69-fcef-41db-bc4a-e2adcf2658e0?api-version=2017-03-01
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: 4370b798-cd8b-4d3e-ba28-22232bc81dc5
x-ms-routing-request-id: WESTUS:20170602T202606Z:4370b798-cd8b-4d3e-ba28-22232bc81dc5
Date: Fri, 02 Jun 2017 20:26:05 GMT
null
Response
In the following example, the connectionStatus is shown as Unreachable. In the hops details, you can see under issues that the traffic was blocked due to a UserDefinedRoute.
{
"hops": [
{
"type": "Source",
"id": "5528055a-b393-4751-97bc-353d8c0aaeff",
"address": "10.1.1.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1",
"nextHopIds": [
"66eefa79-5bfe-48b2-b6ca-eec8247457a3"
],
"issues": [
{
"origin": "Outbound",
"severity": "Error",
"type": "UserDefinedRoute",
"context": [
{
"key": "RouteType",
"value": "User"
}
]
}
]
},
{
"type": "Destination",
"id": "66eefa79-5bfe-48b2-b6ca-eec8247457a3",
"address": "13.107.21.200",
"resourceId": "Unknown",
"nextHopIds": [],
"issues": []
}
],
"connectionStatus": "Unreachable",
"probesSent": 100,
"probesFailed": 100
}
Check website latency
The following example checks the connectivity to a website.
Example
$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_westcentralus"
$sourceResourceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/MultiTierApp0"
$destinationResourceId = "https://bing.com"
$destinationPort = "0"
$requestBody = @"
{
'source': {
'resourceId': '${sourceResourceId}',
'port': 0
},
'destination': {
'address': '${destinationResourceId}',
'port': ${destinationPort}
}
}
"@
$response = armclient post "https://management.azure.com/subscriptions/${subscriptionId}/ResourceGroups/${resourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/connectivityCheck?api-version=2017-03-01" $requestBody
Since this operation is long running, the URI for the result is returned in the response header as shown in the following response:
Important Values
- Location - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: e49b12c7-c232-472c-b6d2-6c257ce80fa5
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westcentralus/operationResults/e49b12c7-c232-472c-b6d2-6c257ce80fa5?api-version=2017-03-01
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: c3d9744f-5683-427d-bdd1-636b68ab01b6
x-ms-routing-request-id: WESTUS:20170602T203101Z:c3d9744f-5683-427d-bdd1-636b68ab01b6
Date: Fri, 02 Jun 2017 20:31:00 GMT
null
Response
In the following response, you can see the connectionStatus shows as Reachable. When a connection is successful, latency values are provided.
{
"hops": [
{
"type": "Source",
"id": "6adc0fe1-e384-4220-b1b1-f0d181220072",
"address": "10.1.1.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1",
"nextHopIds": [
"b50b7076-9ff2-4782-b40e-0b89cf758f74"
],
"issues": []
},
{
"type": "Internet",
"id": "b50b7076-9ff2-4782-b40e-0b89cf758f74",
"address": "204.79.197.200",
"resourceId": "Internet",
"nextHopIds": [],
"issues": []
}
],
"connectionStatus": "Reachable",
"avgLatencyInMs": 1,
"minLatencyInMs": 0,
"maxLatencyInMs": 7,
"probesSent": 100,
"probesFailed": 0
}
Check connectivity to a storage endpoint
The following example checks the connectivity from a virtual machine to a blog storage account.
Example
$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_westcentralus"
$sourceResourceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/MultiTierApp0"
$destinationResourceId = "https://build2017nwdiag360.blob.core.windows.net/"
$destinationPort = "0"
$requestBody = @"
{
'source': {
'resourceId': '${sourceResourceId}',
'port': 0
},
'destination': {
'address': '${destinationResourceId}',
'port': ${destinationPort}
}
}
"@
$response = armclient post "https://management.azure.com/subscriptions/${subscriptionId}/ResourceGroups/${resourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/connectivityCheck?api-version=2017-03-01" $requestBody
Since this operation is long running, the URI for the result is returned in the response header as shown in the following response:
Important Values
- Location - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: c4ed3806-61ea-4a6b-abc1-9d6f2afc79c2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westcentralus/operationResults/c4ed3806-61ea-4a6b-abc1-9d6f2afc79c2?api-version=2017-03-01
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: 93bf5af0-fef5-4b7a-bb9e-9976ba5cdb95
x-ms-routing-request-id: WESTUS2:20170602T200504Z:93bf5af0-fef5-4b7a-bb9e-9976ba5cdb95
Date: Fri, 02 Jun 2017 20:05:03 GMT
null
Response
The following example is the response from running the previous API call. As the check is successful, the connectionStatus property shows as Reachable. You are provided the details regarding the number of hops required to reach the storage blob and latency.
{
"hops": [
{
"type": "Source",
"id": "6adc0fe1-e384-4220-b1b1-f0d181220072",
"address": "10.1.1.4",
"resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1",
"nextHopIds": [
"b50b7076-9ff2-4782-b40e-0b89cf758f74"
],
"issues": []
},
{
"type": "Internet",
"id": "b50b7076-9ff2-4782-b40e-0b89cf758f74",
"address": "13.71.200.248",
"resourceId": "Internet",
"nextHopIds": [],
"issues": []
}
],
"connectionStatus": "Reachable",
"avgLatencyInMs": 1,
"minLatencyInMs": 0,
"maxLatencyInMs": 7,
"probesSent": 100,
"probesFailed": 0
}
Next steps
Learn how to automate packet captures with Virtual machine alerts by viewing Create an alert triggered packet capture.
Find if certain traffic is allowed in or out of your VM by visiting Check IP flow verify.
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for