Azure VPN Gateway BGP Down: az network vnet-gateway When On-Prem Prefixes Vanish

Azure · Techclick CLI troubleshooting lab

S2S tunnel is connected. On-prem prefixes disappeared from Azure. Static was working last month before you enabled BGP.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Azure for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Connected is IKE. BGP is a second session on the tunnel. If BGP is down, Azure has no prefixes unless you also have traffic selectors.

Why this ticket shows up

Teams enable BGP and delete traffic selectors. Then IKE stays up and routing dies.

Symptoms operators actually see

• Connection status Connected

• Effective routes missing on-prem

• BGP peer idle

• ASN mismatch

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

az network vnet-gateway list-bgp-peer-status -g rg1 -n vpngw1 -o table
az network vnet-gateway list-learned-routes -g rg1 -n vpngw1 -o table
az network nic show-effective-route-table --ids <nic> -o table
az network vpn-connection show -g rg1 -n conn1 --query connectionStatus

How to read that output

Peer status must be Connected and learned routes > 0. Connected IKE plus 0 learned routes is BGP, not IKE.

Triage order

1. Check BGP peer status

2. Match ASNs and peer IPs (APIPA 169.254.x.x often)

3. Confirm on-prem advertises the LAN

4. Look at effective routes on a NIC

5. Do not delete the connection yet

Classic traps

What you see	Real cause	Fix
Reset the whole gateway	ASN is wrong	Fix BGP
Add a UDR for every on-prem subnet	BGP should do that	Fix the session
Disable BGP and forget selectors	You will break it again	Pick one design

Proof the ticket is closed

• Learned routes include the LAN

• NIC effective route shows them

• VM pings on-prem

Say this in an interview

I split Azure VPN 'Connected' from BGP learned routes. They are different sessions.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/