troubleshoot routing issues in Azure

techhadoop azure

To troubleshoot routing issues in Azure, Network Watcher Next Hop calculates which route wins for a specific destination IP, while Effective Routes lists all active routes applied to a Virtual Machine’s Network Interface (NIC).

Prerequisites

  • Network Watcher must be enabled in the Azure region where your Virtual Machine (VM) resides.
  • You need Network Contributor or Reader permissions on the target VM and NIC.

1.Run Next Hop Diagnostics:Identify the Win Route.

First, check where a packet from your source VM will actually travel when attempting to reach the destination IP.

Option A: Via Azure Portal

  1. Search for Network Watcher in the top search bar.
  2. Under Network diagnostic tools, select Next hop.
  3. Choose your Subscription, Resource Group, Virtual Machine, and target Network Interface.
  4. Enter the Source IP address (the private IP of your VM NIC) and the Destination IP address you are trying to reach.
  5. Click Next hop.

Option B: Via Azure CLI

Bash

az network watcher show-next-hop \
  --resource-group myResourceGroup \
  --vm myVm \
  --nic myVmVMNic \
  --source-ip 10.0.0.4 \
  --dest-ip 10.1.0.5 \
  --out table

Verification: The tool will output the Next hop type, Next hop IP address, and Route Table ID.

  • VirtualAppliance: Traffic is correctly hitting an Azure Firewall or NVA.
  • VirtualNetwork: Traffic stays within local/peered VNet subnets.
  • Internet: Traffic bypasses local appliances and goes directly to the web.
  • None: Traffic is being intentionally dropped (blackholed) due to a missing route or misconfigured 0.0.0.0/0 UDR.

2.View Effective Routes for the NIC:Inspect Full Routing Table.

If Next Hop returns unexpected results (like None or Internet when you expected a firewall), inspect the underlying complete route table evaluation.

Option A: Via Azure Portal

  1. Navigate to your Virtual Machine and select Networking under Settings.
  2. Click on the attached Network Interface (NIC) name.
  3. Under Help or Settings, select Effective routes.

Option B: Via Azure CLI

Bash

az network nic show-effective-route-table \
  --resource-group myResourceGroup \
  --name myVmVMNic \
  --output table

Verification: Review the generated table. Look for:

  • Address Prefixes: Ensure your destination IP falls within an active prefix.
  • State: Verify routes show as Active. Invalid IP addresses or detached gateways will mark routes as Invalid.
  • Source: Identifies whether a rule originates from a Default system route, a User Defined Route (UDR), or a VirtualNetworkGateway (BGP).

3.Isolate and Fix the Misconfiguration:Resolution.

Compare the destination IP against the evaluated routes to correct the issue:

  • If Next Hop is None: A UDR with a destination prefix matching your traffic has Next Hop Type = None, or an RFC 1918 default blackhole route is active without a Gateway/UDR overriding it. Edit the associated Route Table to specify a valid Next Hop.
  • If Next Hop is Internet instead of NVA: The Route Table containing your 0.0.0.0/0 UDR is either not associated with the source VM’s subnet, or a more specific system/BGP route is taking precedence due to Longest Prefix Match.
  • If Next Hop is correct (VirtualAppliance) but traffic still fails: The routing layer is functioning properly. Switch to IP Flow Verify in Network Watcher to check if a Network Security Group (NSG) or Firewall policy is blocking the port/protocol.

Leave a Reply