Azure / Azure/azure-powershell

Azure VPN client is routing too many IPs to Azure PPP

Open
#2,427 10 comments 0 reactions 1 assignee Assigned to @Am018 View on GitHub
act-quality-productivity-squad Network - VPN Gateway Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

Azure VPN client (both for classic VNets and ARM VNets) is adding two routes towards IP address provided by VPN. Only first one is needed.
1. single IP address routing (like 10.55.55.4/32 or 172.16.29.4/32)
2. entire class based route (like 10.0.0.0/8 or 172.16.0.0/16)
Second route can be deleted without impact on functionality. It can create problems if user has on network resources on impacted scopes. This is almost always true in large corporate networks.

Steps to reproduce:
1. Create VNet, configure point-to-site with client address space 10.55.55.0/24 or 172.16.29.0/24
2. Download, install and connect to VPN
3. Check IP address and routing table
4. PROBLEM: Try to connect to your local network resources impacted with class based route
5. Workaround: Delete second route using route /delete and confirm functionality both for Azure and local resources

Resolution:
In the advanced TCP/IP settings of a Windows VPN connection, select checkbox labeled "Disable class based route addition."

Explanation:
VPN client is also adding routes towards actual IP scope used by VNet (different than client address space), so there is no need for adding class based route.

Example IP details (A class):
Client address space: 10.55.55.0/24
Assigned address: 10.55.55.4
Route 1 (good one): 10.55.55.4 255.255.255.255 On-Link 10.55.55.4
Route 2 (bad one): 10.0.0.0 255.0.0.0 10.0.0.1 10.55.55.4
Impacted resource: 10.69.131.17

Example IP details (B class):
Client address space: 172.16.29.0/24
Assigned address: 172.16.29.4
Route 1 (good one): 172.16.29.4 255.255.255.255 On-Link 172.16.29.4
Route 2 (bad one): 172.16.0.0/16 255.255.0.0 172.16.0.1 172.16.29.4
Impacted resource: 172.16.15.33

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.