How to Access Azure Public IP PII via MSFT-AzVPN-Manual but Not GSA

Select Language:

If you’re managing Azure virtual machines (VMs) in your organization and facing connectivity issues, you’re not alone. I had a similar problem with Linux VMs that are accessible via SSH but only when connected through a VPN. Here’s a simple, straightforward way I found to fix the issue without too much hassle.

First, I used public IP addresses for my VMs so they could be accessed externally. When connecting through the Microsoft Azure VPN (MSFT-AzVPN-Manual), everything worked fine. However, some VMs became unreachable when trying to connect using Global Secure Access (GSA) alone, even though they responded well when connected with the VPN.

To give you an example, one VM had no trouble connecting with either method, but another VM could only be reached via the VPN. This inconsistency was confusing, and I needed a solution.

After doing some research and testing, I found that the problem was related to how GSA handles traffic. The issue was that GSA wasn’t properly configured to allow public IP access to some of my VMs. I brought this up with the support team, but they told me they couldn’t help directly with this type of issue and to contact Azure Support instead.

I then collected logs from GSA to analyze what might be causing the problem, but the log file was too large for the support tool to handle. I attempted to submit a support request three times, but each time it was rejected, and I was redirected to this resource.

What finally worked was making sure that the network security groups (NSGs) and firewall rules for my Azure VMs allowed inbound traffic not just from the VPN but also from GSA. This involved verifying that the correct ports were open and that access rules were configured to permit traffic from the places GSA routes through.

In summary:

– Ensure your VM’s network security groups (NSGs) are set to allow inbound SSH traffic over the correct ports from GSA IP ranges.
– Check your firewall rules to make sure they are not blocking GSA traffic.
– Confirm that your public IP addresses are correctly assigned and that DNS settings point to the right VM.
– Test connectivity with both GSA and VPN to verify it’s working.

This approach helped me get my VMs reachable through GSA just as easily as through the VPN. If you’re experiencing similar issues, reviewing your NSG rules and firewall settings is a good first step. Adjust the rules if necessary, and then try connecting again.