Troubleshooting Hybrid and Cloud Connectivity Issues
Hybrid connectivity troubleshooting centers on the path between on-premises and Azure: VPN Gateway (site-to-site, point-to-site), ExpressRoute circuits, Azure Virtual WAN hubs, and private endpoints. For each, know the building blocks: gateway subnet sizing, local network gateway address spaces, connection shared keys, BGP peering (ASN, APIPA 169.254.x.x peering addresses), IPsec/IKE parameters, and route tables.
Traps to watch: overlapping address spaces between on-premises and Azure VNets silently break routing; a gateway subnet with a misconfigured NSG or UDR blocks traffic; point-to-site failures often stem from certificate trust, client address pool overlap, or TLS/tunnel type mismatch; ExpressRoute issues frequently involve route filters, BGP community tags, or asymmetric routing where traffic returns via the internet instead of the circuit. Also remember that Azure DNS private zones need virtual network links, and private endpoints need matching private DNS records or name resolution fails even when the network path works.
A useful diagnostic order: (1) confirm the tunnel or circuit is connected and BGP routes are advertised; (2) verify effective routes on the VM NIC; (3) check NSGs on both gateway subnet and workload subnet; (4) test DNS resolution from inside the VNet; (5) validate on-premises firewall and NAT. Use Network Watcher connection troubleshoot and VPN Gateway diagnostics rather than guessing.
Worked example: a site-to-site VPN shows Connected, yet VMs cannot reach an on-premises server. Effective routes show the on-premises prefix learned via BGP, so the tunnel is healthy; the NSG on the GatewaySubnet denies inbound from the on-premises range, which is the fault. Fix the NSG rule, not the VPN.