New VM-100 deployment, cannot ping or tracert to external websites

[rbottiglieri]

Just setup a new VM-100 device in Azure. SSL decryption and security policies are in place. My test client PC can browse the web, and all of the policies seem to work.

However, I cannot ping or tracert to any public website (e.g., www.apple.com). The DNS resolution works, I see that the ping traffic is allowed in the monitor tab, and I disabled SSL decryption as a test, but it still didn't work.

I'm sure that it's something simple, but anyone have any ideas?

Thanks!

Rich

[RamprakashRT]

Hi @rbottiglieri ,

Please make sure you have a PublicIP assigned to your untrust interface . In Azure Ping and traceroute will not work if you didnnt have a public IP in the untrust interface. Please try and let me know,

Thanks,

Ram

[rbottiglieri]

Hi @RamprakashRT, thanks for this.

I had actually just tried that before your post. I originally had a secondary IP address configured on the interface with a public IP address, but that didn't work. So, I scrapped that, and put the public IP address right on the interface. I can now ping, but tracert isn't working. Do I need to modify the NSG to allow all inbound internet traffic on the untrust interface?

Thanks.

Rich

[RamprakashRT]

Hi @rbottiglieri 

I suspect the security policy in the firewall. Just to isolate , is it possible to create a plain firewall rule for the test machine by allowing all the traffic in the firewall.  Also untrust interface outbound NSG 'allow all' and trust interface inbound NSG 'allow all'.

Thanks,

Ram

[rbottiglieri]

@RamprakashRT,

I did some digging, and I think the issue is that Azure does not permit you to ping the default gateway in an Azure VNET. Check out this doc:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq

Adding the public IP to the interface, I can now ping public internet addresses. However, traceroute does not work, and by the looks of things, it is not supposed to work.

Thanks for the help.

Rich