AZ-700 Question 96
Select 2You have configured a site-to-site VPN connection from your on-premises network to an Azure Virtual Network using a virtual network gateway. The Azure portal shows the connection as 'Connected,' but on-premises users are unable to reach any of the Azure VMs over the VPN tunnel. After reviewing your setup, you suspect a mismatch in address space or a configuration issue. Which two actions should you take to troubleshoot and resolve this connectivity problem?
- A
Ensure that the address space defined in the local network gateway in Azure exactly matches the on-premises network range.
- B
Disable BGP routing on the Azure Virtual Network Gateway to force static routes for the on-premises network.
- C
Reboot your on-premises VPN device to refresh all routing and IP configurations.
- D
Verify that the shared key (PSK) on the Azure Virtual Network Gateway matches the key configured on the on-premises VPN device.
Show answer and explanation
Correct answers: A, D
Explanation
In Azure site-to-site VPN troubleshooting, two of the most common issues are mismatched address spaces and incorrect shared keys. Ensuring that the local network gateway range in Azure matches the on-premises IP subnet is essential for proper routing. Similarly, the shared key (PSK) on the Azure side must be identical to the one configured on your on-premises VPN device. For more information, see the official Microsoft documentation on troubleshooting VPN gateways: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect.
- A. Correct.
Correct. A common cause of connectivity failure is a mismatch between the IP prefixes defined on the local network gateway in Azure and the actual on-premises network range. If the ranges do not match exactly, traffic will not be routed correctly. Ensuring these match is a critical troubleshooting step.
- B. Incorrect.
Incorrect. Disabling BGP may not resolve a typical address space mismatch issue and is not recommended unless you have a very specific BGP troubleshooting scenario. If you were using BGP, you would typically examine route advertisements rather than disabling it outright.
- C. Incorrect.
Incorrect. While rebooting on-premises hardware can sometimes clear transient issues, it does not address potential configuration mismatches. It might momentarily seem like a fix if a temporary glitch existed, but it does not solve the root cause of misconfiguration.
- D. Correct.
Correct. The shared key (PSK) must match on both sides of the VPN tunnel. If there is a mismatch, the connection might appear up in Azure, but no traffic will flow. Verifying this key is often one of the first steps in troubleshooting connectivity problems.