Azure Troubleshooting

If you encounter any issues during or after the configuration of your site-to-site VPN connection between Microsoft Azure and MacStadium, check this list of common issues and troubleshooting instructions.

• Unrecognized interface during the Cisco ASA/ASAv configuration
• The tunnel is connected but there's no traffic between Azure and MacStadium
• There's traffic from Azure to MacStadium but you cannot access Azure from MacStadium
• Troubleshooting

Unrecognized interface during the Cisco ASA/ASAv configuration

Sometimes, the command line interface might return ERROR: unable to find interface “outside”. The command-line interface might be case-sensitive and you might need to preserve the capitalization of the MacStadium network configuration as provided in the IP Plan.

1. Clean up the ASA configuration.
   For more information, see Cleaning up the ASA/ASAv configuration.
2. Rename outside in your configuration to the precise name of the outside interface of your Cisco ASA/ASAv device. By default, this is the Outside network.
   For more information, see Azure VPN Config for Cisco ASA/ASAv.
3. Re-run the complete configuration in Cisco ASDM-IDM.
   For more information, see Site-to-Site VPN Config.

The tunnel is connected but there's no traffic between Azure and MacStadium

If Azure shows that the tunnel is Connected but there is no visibility and connectivity between the two clouds, it might be because of some common mistakes when preparing the configuration. Check for the following in the site-to-site VPN configuration. For more information, see Azure VPN Config for Cisco ASA/ASAv.

• Verify that your { shared_key } is correct. The { shared_key } in the configuration must match the key set for the VPN connection.
• Verify that you've replaced { macstadium_network_address } and { macstadium_network_mask } with the correct values for the internal, private network of your MacStadium private cloud. By default, this is the Private-1 network.
  You can find the networking information for this network in Appendix A of your IP Plan.
• Verify that you've configured the NAT exemption rule properly.
  • The host and subnet mask required for ONPREM-NET are the host and mask for the internal, private network of your MacStadium private cloud. By default, this is the Private-1 network. You can find the networking information for this network in Appendix A of your IP Plan.
  • The host and subnet mask required for AZURE-NET are the host and mask for your Azure virtual network. You need to convert the subnet mask bit notation to the correct subnet mask (e.g., the /16 notation converts to a 255.255.0.0 subnet mask).
  • The values in the brackets after nat must be the name of the internal, private network of your MacStadium private cloud, followed by the name of the outside interface of your Cisco ASA/ASAv device. By default, these are Private-1 and Outside, respectively.
    You can find the names of these networks in Appendix A of your IP Plan.

To resolve any of the listed common problems with the Cisco ASA/ASAv configuration, complete the following steps:

1. Clean up the firewall configuration.
   For more information, see Cleaning up the ASA/ASAv configuration.
2. Make the necessary changes to the configuration.
   For more information, see Azure VPN Config for Cisco ASA/ASAv.
3. Re-run the complete configuration in Cisco ASDM-IDM.
   For more information, see Site-to-Site VPN Config.

There's traffic from Azure to MacStadium but you cannot access Azure from MacStadium

Sometimes, you might be able to establish an SSH connection from Azure to MacStadium but you might not be able to see or access Azure from MacStadium.

This might be due to Azure being configured to stop inbound traffic.
For information about how to enable inbound traffic, see Azure Documentation: Filter inbound traffic with Azure Firewall DNAT using the Azure portal and Azure Documentation: Security groups

Troubleshooting

Cleaning up the ASA/ASAv configuration

Sometimes, you might need to clean up the Cisco ASA/ASAv configuration and start over.

1. Verify that you are connected via VPN to your MacStadium private cloud.
   For more information about how to connect to the VPN, see Connecting to Your Cloud (via VPN).
2. Run Cisco ASDM-IDM and log in.
   For more information about how to log in to your firewall, see Logging into Your Cisco Firewall.
3. In the Cisco ASDM-IDM application toolbar, select Tools > Command Line Interface....

4. Select Single Line.
5. Run the following commands one by one, clicking Send in between. Replace the placeholders with their respective values. Use Table 1: Placeholders for reference.

clear configure tunnel-group { azure_virtual_network_gateway_ip }
clear configure crypto map azure-crypto-map
clear configure crypto ipsec ikev1 transform-set azure-ipsec-proposal-set
no nat ({ macstadium_network_name },{ macstadium_outside_interface }) 1 source static ONPREM-NET ONPREM-NET destination static AZURE-NET AZURE-NET
clear configure access-list AZURE-VPN-ACL
no object-group network AZURE-NET
no object-group network ONPREM-NET

Table 1: Placeholders

Additional Troubleshooting Resources by Microsoft

For more detailed troubleshooting instructions, see Azure Documentation: Troubleshoot VPN Gateway.

Additional Troubleshooting Resources by Cisco

For more detailed troubleshooting instructions, see Cisco Documentation: IPsec Troubleshooting.