Everything works great, connection is established. I can access my on-premise infrastructure from Azure VMs, but not vice-versa.
Cant access Azure in any way (ping, RDP etc.). What could be the cause of that?
Disabled firewall in Azure VM, opened all ports in Azure VM networking properties (NSG). Disabled onpremise (Mirotik’s) firewall. Still is not working.
Am I missing some step. Is there other options that should be first set up in Azure or Mikrotik (open traffic for Azure VPN public IP address? Set static routes? new to this). Azure firewall, route tables are not created, everything is default. All ports are open in default NSG, that came with the VM.
First srcnat rule that allows azure-onprem private ip networking was already there, however I can ping onprem network from azure even without that rule. Pings were not going at all before I created forward Filter rule where accept sourceaddress-azure-subnet, dst-address=onprem-subnet in order to get the traffic go through. And another filter rule with opposite settings to theoretically allow traffic back to the Azure which does not work.
Added TCP MSS clamp.
Did not add the last rule due router already being available in the Azure.
When pinging NAT rule does not show any activity, packets go thorugh only the Filer Rules. Azure onprem network does not “see” azures private network at all.
Connection still does not work. Tried turning off all drop rules but again with no luck.
I was digging and some people said that when creating those fw rules a flag before-fasttrack=0 (dont remember the exact value) has to be set, do you know anything about that?
First srcnat rule is not meant to allow Azure to On-Premise traffic, it is for On-Premise to Azure.
Basically with that srcnat, mangle rule and these default fw rules you should be able to access Azure from On-Premise and vice versa. I have many IPsec tunnels created from Mikrotik to Azure that way and everything works. Default firewall rules -
No, BGP should be configured only if you only really needs it. Also there’s no need for additional Routes from Azure side. With default NSG rules, Azure should allow IPsec traffic for both sides.
Today I found out that it was an ARP issue. Some time ago we set the ARP on all bridged ports to be proxy-arp, due to Apple devices dropping DHCP requests and not being able to connect. Turns out that setting fixes one thing and the breaks all the others (if you dont know how to use it properly).
Created a new interface for the local network that will be used for Azure and set the ARP to enabled. Traffic now fully goes to either of directions.