Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
430 questions
Express Route issue to connect to hosts via specific host.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 87%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAJ%3C/text%3E%3C/svg%3E)
Armando J. Garcia
0
Reputation points
We've encountered an issue with our Express Route connections. Specifically, our hosts are failing to connect to certain ports on other Hosts (on-prem and VNETs), causing disruptions in our network operations.
We have allowed the trust with the NSG and there are no firewall rules between Azure and the Express Route circuit.
Azure ExpressRoute
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 81%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Sai Prasanna Sinde 5,395 Reputation points Microsoft External Staff2025-04-15T06:09:11.2+00:00 Could you please provide the following details to help us better understand the issue:
- The exact error message you are encountering, and if possible, a screenshot.
- The network diagram or topology of your setup.
-
Armando J. Garcia 0 Reputation points
2025-04-15T21:14:10.84+00:00 Hello @Sai Prasanna Sinde :
Please see the screenshot. Again, ping is successful, but just not able to via the remote port. You can see successful ping on screenshot and failure to port connect.
To note: Traffic connects while on Secondary link, error with Express Route.
-
Armando J. Garcia 0 Reputation points
2025-04-15T21:16:49.22+00:00 Hello @Sai Prasanna Sinde :
Please see the screenshot. Again, ping is successful, but just not able to via the remote port. You can see successful ping on screenshot and failure to port connect.
To note: Traffic connects while on Secondary link, error with Express Route.
Screenshot: Error/Failed
Topology:
Thank you in advance!
-
Sai Prasanna Sinde 5,395 Reputation points Microsoft External Staff
2025-04-16T03:52:31.25+00:00 Could you please resend the error screenshot and Topology diagram? It appears that there is an issue with the images you provided in the previous response.
-
Sai Prasanna Sinde 5,395 Reputation points Microsoft External Staff
2025-04-18T01:02:07.73+00:00 Log in to the destination host that the source host is trying to reach on port 60010 and use tools like netstat (Windows/Linux) to confirm that a process is actually listening on the target TCP port: Windows: netstat -ano | findstr ":60010"Check the firewall software running directly on both the source machine and the destination machine. This is often Windows Defender Firewall.
Since ExpressRoute connects to your on-premises network, please verify any virtual firewall appliances sitting between your on-premises network edge and the destination on-premises host and review the firewall rulesets on these devices. Look for rules that might be blocking TCP traffic on the specific port between the Azure VNet IP ranges and the on-premises host IP ranges. Check firewall logs for denied packets.
Even though you mentioned allowing the trust with NSG but re-verify the rule again carefully: verify the Route Tables associated with the subnets involved, are there any UDRs that might be forcing traffic destined for the remote network through a NVA instead of directly to the ExpressRoute Gateway? If traffic is intentionally routed via an NVA, check the firewall rules on that NVA.
Check the "Effective Routes" for the NIC of the Azure VM experiencing the issue and does the NIC have a route for the destination IP address/prefix pointing towards the VirtualNetworkGateway as the next hop type? Are the routes learned via BGP from on-premises showing up correctly?
Kindly let us know if the above helps or you need further assistance on this issue.
-
Armando J. Garcia 0 Reputation points
2025-04-23T17:09:34.6+00:00 Hello Sai -
Was on PTO. So, I do not have access to the destined host, BUT currently not using the express route circuit (using the backup VPN S2S) link and we are able to connect to the host and via port 60010. This secondary circuit is accessing the same VNET.
No UDR config and no appliance/firewall between Azure and on-prem.
Any helps would be appreciated.
Thank you
-
Armando J. Garcia 0 Reputation points
2025-04-23T17:29:31.9733333+00:00 Hello Sai -
Was on PTO. So, I do not have access to the destined host, BUT currently not using the express route circuit (using the backup VPN S2S) link and we are able to connect to the host and via port 60010. This secondary circuit is accessing the same VNET.
No UDR config and no appliance/firewall between Azure and on-prem.
Any helps would be appreciated.
Thank you
-
Sai Prasanna Sinde 5,395 Reputation points Microsoft External Staff
2025-04-24T05:35:09.1833333+00:00 - You'll need to check with your on-premises network team once and they should check the routing table on the destination host and more importantly, on the on-premises routers. Specifically, they need to confirm that the route for the Azure VNet IP range points back towards the ExpressRoute connection when the ExpressRoute circuit is the intended primary path.
- You can also run Network Watcher Diagnostics using IP Flow Verify to check if NSG rules allow traffic to port 60010 and Next Hop to verify the routing path from an Azure VM to the destination IP.
- Verify the routes being advertised from on-premises to Azure over ExpressRoute. Are the correct on-premises prefixes advertised? Use the Azure Portal/CLI/PowerShell commands to check the routes learned by the ExpressRoute Gateway. Compare these with routes potentially learned via the S2S VPN Gateway.
- Try to re-verify the health of the ExpressRoute Gateway and the Circuit itself in the Azure portal. Check the BGP peering- status should be established.
Sign in to comment
Sign in to answer