Unable to connect VM using Bastion or RDP during Test Failover

Question

Unable to connect VM using Bastion or RDP during Test Failover

Sijin N P 0

Hi Team,

I have enabled the Azure Site Recovery and replicating it successfully. After the replication, i tried to do the Test Fail Over. But i am unable to connect the VM using Bastion or RDP. The error message says that NSG rule not allowing. But i did it properly.

Error message is following.

The target machine is unreachable. Please verify that your NSG rules allow traffic to ports 22 (SSH) and 3389 (RDP) from the private IP address

Thanks in advance.
Sijin NP
******@xtech.ae

Siva shunmugam Nadessin 3,025 Reputation points Microsoft External Staff Moderator

2025-10-31T15:51:58.5066667+00:00

Hello Sijin N P,

Kindly reply below questions for us to investigate further?

Have you verified the NSG settings to ensure the required ports are open?

Is the VM running and reachable from other resources in the same network?

Have you checked for any policies in the subscription that might affect VM creation or connectivity?

Did you make any changes to the VM settings before performing the Test Failover?
Sijin N P 0 Reputation points

2025-11-03T09:33:35.0933333+00:00

Hi Siva,

Thanks for the reply.

Yes i confirmed the NSG. With the port checking option available in the console, it is fine.

There are no policies blocking it. I have deleted and re created the NSG twice and tested.

No settings changes done on the VM.
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-11-03T11:17:33.42+00:00

Hello @Sijin N P,

Could you please check the private message and share us the requested details in the private message?
Sijin N P 0 Reputation points

2025-11-06T11:40:46.6333333+00:00

Hi Team,

I’ve identified the issue. The VM was created as Generation 2 in the on-premises environment, but during the Test Failover in Azure, it started as a Generation 1 VM. This mismatch is causing the problem.

However, I’m still unsure how to change or configure the VM to Generation 2 in Azure. If anyone has experience with this or knows the correct approach, your input would be greatly appreciated.

Thanks
Sijin NP

1 answer

Your answer

Siva shunmugam Nadessin 3,025 Reputation points Microsoft External Staff Moderator

2025-10-31T15:51:58.5066667+00:00

Hello Sijin N P,

Kindly reply below questions for us to investigate further?

Have you verified the NSG settings to ensure the required ports are open?

Is the VM running and reachable from other resources in the same network?

Have you checked for any policies in the subscription that might affect VM creation or connectivity?

Did you make any changes to the VM settings before performing the Test Failover?
Sijin N P 0 Reputation points

2025-11-03T09:33:35.0933333+00:00

Hi Siva,

Thanks for the reply.

Yes i confirmed the NSG. With the port checking option available in the console, it is fine.

There are no policies blocking it. I have deleted and re created the NSG twice and tested.

No settings changes done on the VM.
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-11-03T11:17:33.42+00:00

Hello @Sijin N P,

Could you please check the private message and share us the requested details in the private message?
Sijin N P 0 Reputation points

2025-11-06T11:40:46.6333333+00:00

Hi Team,

I’ve identified the issue. The VM was created as Generation 2 in the on-premises environment, but during the Test Failover in Azure, it started as a Generation 1 VM. This mismatch is causing the problem.

However, I’m still unsure how to change or configure the VM to Generation 2 in Azure. If anyone has experience with this or knows the correct approach, your input would be greatly appreciated.

Thanks
Sijin NP

Answer 1

Hello Sijin N P,

You are unable to connect to the Test Failover VM using Bastion or RDP/SSH after performing a Test Failover in Azure Site Recovery (ASR). The error indicates NSG rules are blocking ports 22 or 3389, but you have already verified NSG settings. Later, you identified the source VM is Generation 2 (UEFI), while the Test Failover VM appears as Generation 1, causing boot and connectivity issues which might be due to below reasons:

NSG/Bastion configuration – Bastion requires specific NSG rules to allow inbound traffic on TCP 3389 (RDP) or TCP 22 (SSH) from the Bastion subnet.
Guest OS preparation – The VM must have RDP/SSH enabled and firewall rules configured before failover.
Boot type mismatch – ASR supports UEFI/Gen2 for certain OS versions. If the target VM size or Compute & Network settings are incompatible, the VM may boot incorrectly and fail hydration.

As a resolution please try below workarounds:
Step 1: Validate NSG Rules for Bastion

On the Test Failover VM NIC:
- Add Allow inbound rule for:
  - TCP 3389 (Windows) or TCP 22 (Linux)
  - Source: AzureBastionSubnet CIDR or VirtualNetwork
  - Priority: Higher than any deny rule
If there is a DenyAllOutbound rule, add an Allow outbound to VirtualNetwork for ports 3389/22.

Reference: https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg

Step 2: Prepare Guest OS Before Failover:

Windows:
- Enable RDP and allow TCP+UDP 3389 in all firewall profiles.
- Remove persistent routes and WinHTTP proxy.
- Set SAN policy to OnlineAll.
Linux:
- Ensure SSH service starts on boot and firewall allows port 22.

Reference: https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-failover

Step 3: Address Generation 2 / UEFI Mismatch:

Confirm OS is supported for UEFI/Gen2 failover:
- Reference: https://learn.microsoft.com/en-us/azure/site-recovery/vmware-physical-azure-support-matrix
In Replicated Items → Properties → Compute and Network:
- Select a VM size compatible with Gen2/UEFI.
If the Test Failover VM boots incorrectly:
- Delete the Test Failover VM.
- Disable replication, correct settings, and re-enable replication.

Step 4: If RDP Still Fails:

Use VMAccess extension to reset RDP configuration:
- Portal → VM → Reset password → Reset configuration only.

If you have any other questions or need further support, please feel free to contact us.

Thanks,

Suchitra.

Share via

Unable to connect VM using Bastion or RDP during Test Failover

1 answer

Your answer