Azure / Azure/azure-powershell
Azure VPN client is routing too many IPs to Azure PPP
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
Azure VPN client (both for classic VNets and ARM VNets) is adding two routes towards IP address provided by VPN. Only first one is needed.
1. single IP address routing (like 10.55.55.4/32 or 172.16.29.4/32)
2. entire class based route (like 10.0.0.0/8 or 172.16.0.0/16)
Second route can be deleted without impact on functionality. It can create problems if user has on network resources on impacted scopes. This is almost always true in large corporate networks.
Steps to reproduce:
1. Create VNet, configure point-to-site with client address space 10.55.55.0/24 or 172.16.29.0/24
2. Download, install and connect to VPN
3. Check IP address and routing table
4. PROBLEM: Try to connect to your local network resources impacted with class based route
5. Workaround: Delete second route using route /delete and confirm functionality both for Azure and local resources
Resolution:
In the advanced TCP/IP settings of a Windows VPN connection, select checkbox labeled "Disable class based route addition."
Explanation:
VPN client is also adding routes towards actual IP scope used by VNet (different than client address space), so there is no need for adding class based route.
Example IP details (A class):
Client address space: 10.55.55.0/24
Assigned address: 10.55.55.4
Route 1 (good one): 10.55.55.4 255.255.255.255 On-Link 10.55.55.4
Route 2 (bad one): 10.0.0.0 255.0.0.0 10.0.0.1 10.55.55.4
Impacted resource: 10.69.131.17
Example IP details (B class):
Client address space: 172.16.29.0/24
Assigned address: 172.16.29.4
Route 1 (good one): 172.16.29.4 255.255.255.255 On-Link 172.16.29.4
Route 2 (bad one): 172.16.0.0/16 255.255.0.0 172.16.0.1 172.16.29.4
Impacted resource: 172.16.15.33
Contributor guide
Assessment
This issue has not been assessed yet.