We currently have a fairly simple Azure VMSS environment with two CP gateways (these are VMSS and not clustered). Want to enable remote access VPN. There is a public IP for the external load-balancer (LB) and then two separate public IP's tied to each of the VMSS gateways. External traffic (non-vpn) to the LB public IP works. Have also reviewed a document titled "Quick Deployment Guide for Virtual Machine Scale Sets (VMSS) for Microsoft Azure with Remote Access VPN" that CP produced. Have opened a case with CP as we are not able to access either of the public IP's assigned to each GW. Here is the response from TAC:
I have consulted our team on your issue. The consensus is that a ticket needs to be opened with Azure to identify where the traffic from your endpoint client is currently being routed to or where it might be dropped.
- We have already confirmed that your configuration matches our R80.40 Remote Access VPN guide and it look okay.
- Based on our team suggestions, a load-balancer rule needs to be configured on the frontend-lb so that the client traffic is not blackholed and does not reach the gateway.
Hope this find you well. The next action plan would be to verify where the traffic from your client is being dropped, since we cannot identify this on the VMSS instance itself.
Not sure why CP would not provide better instructions to accomplish this. Does anyone have any knowledge of how you can enable access to the public ip's on each VMSS GW fro VPN access? Please note that the client does not want to deploy the Azure DNS application and according to CP this is not necessary. Appreciate any help.