Site-to-Site VPN not working with same settings after redeploying from template from subscription to subscription

Question

Site-to-Site VPN not working with same settings after redeploying from template from subscription to subscription

Jesse Page 25

One of our subscriptions was orphaned because the admin was a Classic Owner instead of an RBAC owner, and when the admin left, the subscription was not transferred to a current admin.

My team and I were unable to use the Move function for a resource group containing a webapp and the associated virtual network and site-to-site VPN.

I was able to create a template of the resource group, and redeployed to the new subscription based on this template. Everything seemed to deploy fine.

However, the VPN tunnel was originally complaining that the subnet was already in use, so I increased the second octet by one and created a new subnet for the VPN, and then updated the associated Virtual Network Integrations in the AppServices to point to the new subnet and gateway.

Now, the virtual network is not passing any traffic. Is there something I need to update to have the webapp AppServices retry the VPN site-to-site connection?

UJTyagi-MSFT 930 Reputation points Microsoft Employee

2025-04-24T04:56:05.06+00:00
Hi @Jesse Page ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Thanks for explaining your issue in detail. Kindly refer the below point:

Regarding the error - "the VPN tunnel was originally complaining that the subnet was already in use" -This could be due to the subnet is being used by another service, Gateway subnets are only reserved for VPN Gateways and should not be used for another service.

I assume you have deleted the previous tunnel configuration which was established to another locked subscription.

You mentioned to create a new subnet but was it a Gateway Subnet? as only Gateway subnets are used for creating the S2S VPN connectivity and you cannot have 2 Gateway Subnet within a Virtual Network.

I assume the new subnet was indeed the Gateway subnet type and you used a new subnet within the virtual network for Web app integration. Kindly check the following -

Ensure that the VPN configuration on both ends (Azure and on-premises) is correct and that there are no overlapping IP address ranges. Overlapping ranges can cause routing issues.

Check the status of the S2S VPN tunnel if it is established. http://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference#metrics

You can also run the KQL to check the tunnel diagnostics logs
AzureDiagnostics | where ResourceType == "VIRTUALNETWORKGATEWAYS" and Category == "TunnelDiagnosticLog" | project TimeGenerated, Resource, OperationName, ResultDescription | sort by TimeGenerated desc

If tunnel itself is not established, you will not see the traffic passing through.

Check the NSG and route table if any enforced which is either causing misrouting or blocking the traffic.

If the VPN connection was established before the subnet change, it might be necessary to restart the VPN gateway or re-establish the VPN connection to ensure it recognizes the new subnet configuration

Kindly revert back with your findings if you still need help after following the above points.

Regards

Ujjawal Tyagi
Jesse Page 25 Reputation points

2025-04-24T20:10:22.36+00:00

Thank you @UJTyagi-MSFT and @G Sree Vidya for your answers: my team and I were able to identify that while the Virtual Network settings were correct, the Application Services Network Integration was incorrectly configured.
Once this was corrected the Application Service was able to reintegrate to the new VNet and associated subnets and gateway and started passing traffic.
This issue has been resolved. Cheers!
G Sree Vidya 825 Reputation points Microsoft External Staff

2025-04-25T01:20:07.8433333+00:00

Hi Jesse Page

Thank you for your update. I'm glad to know that the issue was fixed.

Please click "Accept the posted Answer" on this post to let us know.

We're here to help, so if you have any further questions, don't hesitate to ask.

Thank you:)

Accepted answer

0 additional answers

Your answer

Jesse Page 25 Reputation points

2025-04-24T20:10:22.36+00:00

Thank you @UJTyagi-MSFT and @G Sree Vidya for your answers: my team and I were able to identify that while the Virtual Network settings were correct, the Application Services Network Integration was incorrectly configured.
Once this was corrected the Application Service was able to reintegrate to the new VNet and associated subnets and gateway and started passing traffic.
This issue has been resolved. Cheers!
G Sree Vidya 825 Reputation points Microsoft External Staff

2025-04-25T01:20:07.8433333+00:00

Hi Jesse Page

Thank you for your update. I'm glad to know that the issue was fixed.

Please click "Accept the posted Answer" on this post to let us know.

We're here to help, so if you have any further questions, don't hesitate to ask.

Thank you:)

Answer 1

Hi @Jesse Page

We understand that you are experiencing site-to-site VPN connectivity issues after redeployment and changes. We request you to validate the following details:

Verify VPN Gateway Configuration Settings:
- Ensure that the VPN gateway in the new virtual network is correctly configured with the same settings as the original (e.g., gateway type, VPN type, public IP, local network gateway, and connection settings).
- Confirm that the local network gateway (representing the on-premises network) has the correct IP address ranges and VPN device public IP. If these differ from the original setup, update them.
- In the Azure portal, navigate to the VPN gateway > Connections, and check if the site-to-site connection is in a "Connected" state. If not, troubleshoot using Azure's diagnostic tools or logs.http://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics
- Check the subnet address space of the virtual network and the new subnet to ensure they are correctly configured.
- Confirm that the routing configuration between your on-premises network and Azure is still correct, especially if you've made changes during the redeployment.
- Verify that the pre-shared key for the VPN connection matches on both the Azure VPN gateway and the on-premises VPN device.
Validate Virtual Network Integration:
- Since you have already integrated the VNet, ensure the integration is active and pointing to the correct subnet in the new virtual network.
- If you updated the subnet, restart the App Service to ensure the integration takes effect. Refer to the following documentation for more details: http://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

For further troubleshooting, you can refer to the following guides:

Refer: http://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect

http://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-disconnected-intermittently

After validating the above points, we suggest resetting the VPN gateway:

In the portal, go to the virtual network gateway that you want to reset.
On the Virtual Network Gateway page, in the left pane, scroll and locate Help -> Reset.
On the Reset page, select Reset. After the command is issued, the current active instance of the Azure VPN gateway will reboot immediately.

Please let me know if the above steps are helpful. If not, kindly provide the error details along with a screenshot for further investigation. We will be happy to assist you.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered.

Thank you for helping to improve Microsoft Q&A!

User's image

G Sree Vidya 825 Reputation points Microsoft External Staff

2025-04-28T14:35:40.8866667+00:00

Hello Jesse Page

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Share via

Site-to-Site VPN not working with same settings after redeploying from template from subscription to subscription

0 additional answers

Your answer