Visitor III

Question

Site 2 Site VPN with Azure

Forum|Forum|3 years ago
October 6, 2022
9 replies
3590 views

Please help,
I can access On-Prem from Azure but I cannot access Azure from On-Prem from firewall level and LAN behind Firewall.

Azure
172.16.0.0/21 - Address space
172.16.1.0/24 - Subnet
172.16.0.0/24 - GW Subnet

NSG in Azure
ICMP and RDP are Any Any Any Allow

VM in Azure
All firewalls are disabled

On-Prem / Fortigate 60E v6.2.3 build1066 (GA)
PPPoE - WAN
192.168.1.0/24 - LAN

Thank you in advance

FortiGate

xshkurti

Staff

Hi

Please check mtu traffic size from On-prem to Azure.

You can try to lower TCP-MSS on policy that allows traffic to go to Azure

MackoyAuthor

Visitor III

Hi

Here is the result of my firewall MTU

the TCP-MSS on policy, what value should I input?
Thanks

MackoyAuthor

Visitor III

Additional info:

IPsec MonitorIPv4 PolicyPing from FirewallTracert from LAN (On-Prem)

baldchiapet75

New Member

What do your route-tables look like in both Azure and on the FTG?

MackoyAuthor

Visitor III

Here:

Fortinet routing table.

baldchiapet75

New Member

Please give us the output from the below command.

FW # get router info routing-table database

MackoyAuthor

Visitor III

Here:

baldchiapet75

New Member

Everything looks good on the Fortigate. If you can take a screen shot of the route-table(s) on the Azure side that would work. It could be your not propagating the routes to the vNET from the VNG. By default, the VNG will route RFC1918 back down the S-2-S tunnel so if there is no route for the destination subnet in the VNG route-table it will not reach any host that resides there.

MackoyAuthor

Visitor III

Thank you for confirming the setup from my Fortigate.

Here is the result of the query.

Sign up

Login with SSO

Login to the community

Login with SSO