1. Home
  2. Training Library
  3. Microsoft Azure
  4. Courses
  5. Managing Connectivity with Azure Network Watcher

VPN Troubleshoot

The course is part of these learning paths

AZ-103 Exam Preparation: Microsoft Azure Administrator
course-steps 15 certification 6 lab-steps 7


FREE1m 46s
Troubleshooting Connections
IP Flow Verify
FREE4m 29s
Next Hop
1m 56s
2m 31s
Start course
star star star star star-half




Learning Objectives

  • Use Network Watcher’s troubleshooting tools to diagnose Azure networking issues

Intended Audience

  • People who want to become Azure cloud architects
  • People who are preparing to take Microsoft’s AZ-101 or AZ-300 exam


  • Basic knowledge of Azure virtual networks




If the connection you're troubleshooting involves a virtual network gateway, then you can get more information by using the VPN troubleshoot tool. This is especially helpful if you're having problems with the VPN connection to an on-premises location. It's also possible to have a VPN connection between two virtual networks, though, and that's what I'm going to use in this example. It takes a long time to create virtual network gateways, so bare that in mind if you want to set up your own gateways and follow along with this demo. First, go to the VPN troubleshoot page. Now select the resource group that contains the connection you want to check. Then select the location. You also have to tell it where to store the data that it collects, so click on storage account. And then choose either an existing one or create a new one. I'll pick this one. Now you have to select a container. I have one called network watcher logs. It gives you a list of gateways and connections in this location. You'll notice that it says healthy next to GW1 and GW2. 

Those were the results when I ran a test on them before, but that doesn't necessarily mean that the gateways are still healthy. You have to run another test to find out. You can select as many of the items as you want and it will test them all at the same time. I'll just select GW1 and GW2. Then click start troubleshooting. It takes a long time to run, so I'll fast-forward. Okay, it's finished and it says that gateway one is unhealthy. It says that your VPN connectivity is impacted because the site to site VPN tunnels are disconnected. It also gives further details saying that the site to site VPN tunnels could not connect because of IKE or connectivity issues. IKE stands for internet key exchange. The reason it got this error is because I changed the shared key on the VNet1 to VNet2 connection, which caused the connection to fail. So it did a good job of diagnosing the problem. And that's it for the VPN troubleshoot tool.

About the Author

Learning paths21
