Virtual Network Gateway no longer receiving ingress traffic

Question

Virtual Network Gateway no longer receiving ingress traffic

Cody Durand 40

We have a Virtual Network Gateway configured to connect our on-premise network to our Azure virtual network over an IKEv2 tunnel. This tunnel has been configured and working for years. As of a few days ago, we are no longer able to send traffic over the VPN tunnel into the Azure virtual network.

The tunnel shows as active/connected on both ends, and I do see that Azure reflects that traffic is flowing from Azure into our local network, just not the other way.

0 comments

2 answers

Your answer

Answer 1

Salamat Shah 750 MVP

Since the VPN tunnel is Connected but traffic works only Azure → on-premises, this most likely indicates an asymmetric routing, traffic-selector, firewall, or IPsec policy issue rather than tunnel establishment. Azure recommends checking VPN diagnostic/IKE logs for these scenarios.

Recommendation:

Since the VPN tunnel is Connected but traffic works only Azure → on-premises, this most likely indicates an asymmetric routing, traffic-selector, firewall, or IPsec policy issue rather than tunnel establishment. Azure recommends checking VPN diagnostic/IKE logs for these scenarios.

https://learn.microsoft.com/en-us/troubleshoot/azure/vpn-gateway/vpn-gateway-troubleshoot

Cody Durand 40 Reputation points

2026-09-29T23:03:14.1+00:00
Salamat,

Thank you for the suggestion. I did already verify the following suggestions before submitting the question.

Verify the VPN peer IPs

Check UDR and NSGs on the gateway subnet

Check the on-premises VPN device external interface address

Verify that the subnets match exactly (Azure policy-based gateways)

Verify the Azure gateway health probeStep 3: Verify the VPN peer IPs

Check UDR and NSGs on the gateway subnet

Check the on-premises VPN device external interface address

Verify that the subnets match exactly (Azure policy-based gateways)

Verify the Azure gateway health probe

I will note a few things:

This tunnel has been enabled and working for years, and there have been no recent changes to either network for months, so I am less incline to think its a policy or routing issue.

Our VNG is a Basic SKU and our External IP associated with the gateway is also a Basic SKU

I do know that Microsoft sent a notice that the Basic SKU IP address is being deprecated and wanted customers to migrate to the Standard SKU. However, there was a conflict that prevented the association of a Standard SKU IP address with a Basic SKU VNG.

There was a newly created migration button added to the VNG that was supposed to update the IP address to a Standard SKU version. We did attempt to implement this change and it completed successfully but I did not see any improvement to the issue

Answer 2

I did want to provide an update on my question. Oddly enough, the issue resolved itself over night. We had exhausted our troubleshooting steps during the day and none of the attempted fixes had resolved the issue. However, at the start of the next day traffic was flowing successfully. It is unknown if the IP sku issue I mentioned in a previous reply was the underlying issue and it simply took a bit of time for the migration to take effect, or if there was a very specific outage that was occurring that impacted my organization that we were unaware of. Either way, the issue has been resolved so I will mark this as closed.