IPSEC Tunnels to Azure vWAN sometimes stop passing traffic

To troubleshoot IPsec VPN issues with Azure Virtual WAN, you can utilize various diagnostic logs available in Azure. Specifically, the TunnelDiagnosticLog can help you inspect the historical connectivity statuses of the tunnel. This log provides insights into events such as tunnel connections and disconnections, which can be useful in identifying patterns or issues that may cause the tunnel to stop passing traffic.

You can query the TunnelDiagnosticLog to see events related to your VPN connection. Here’s a sample query you might use:

AzureDiagnostics
| where Category == "TunnelDiagnosticLog"
| project TimeGenerated, OperationName, remoteIP_s, instance_s, Resource, ResourceGroup
| sort by TimeGenerated asc

This will allow you to see the timestamps of events, operation names (like TunnelConnected or TunnelDisconnected), and other relevant information.

Additionally, for real-time monitoring of Azure services, you can check the Azure Status page, which indicates any ongoing issues by region, including US West 1. This can help you determine if there are any broader issues affecting your VPN connection.

References:

• Troubleshoot Azure VPN Gateway using diagnostic logs
• Troubleshooting: Azure Site-to-Site VPN disconnects intermittently

Hi Andy P,

Thanks for reaching out, Microsoft Q&A.

According to this MS-Document,

Azure Virtual WAN does provide logs, but they must be explicitly enabled. These logs help you troubleshoot tunnel outages, renegotiations, SA resets, dropped packets, etc.

Key Log Categories:

• TunnelDiagnosticLog: Tracks tunnel state changes (e.g., disconnects or unresponsiveness). Query for events like "TunnelDisconnected" to identify timestamps of issues.
• IKEDiagnosticLog: Verbose IKE/IPsec debug info for negotiation failures. Useful for parsing SA_INIT messages during retries.
• RouteDiagnosticLog: BGP events (e.g., "BgpDisconnectedEvent") that could cause routing blackholes.

You can enable the logs through Azure portal.

• Portal → Virtual WAN → Hubs → (Your Hub) → VPN gateways → Diagnostic settings

You can stream logs to:

• Log Analytics Workspace
• Storage Account
• Event Hub

Is there an Azure portal that indicates recent "issues" by zone, e.g. US West 1?

Yes, Azure has a service health dashboard that shows issues per region (not per zone).

• Azure Portal → Monitor → Service Health

Reference:

• Azure Service Health Portal - Azure Service Health | Microsoft Learn
• Monitor Azure Virtual WAN | Microsoft Learn

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.