Unable to access Azure Storage Account from on-premises (network error) + need guidance on VPN Gateway logs and traceroute limitations

###########

Hi Shubhangi Nannware,
Thanks for reaching out in Microsoft Q&A forum,

It sounds like you're on-prem traffic isn’t making it all the way to the private endpoint on Azure—and you want to:

1. Prove traffic from a specific on-prem IP/subnet is hitting (or being dropped by) your VPN Gateway
2. Find an alternative to traceroute for a Storage private endpoint
3. Understand NSG + ICMP behavior
4. See if overlapping IP ranges on different tunnels could be at fault

Below are some things you can try and sample KQL for your Log Analytics workspace. I’ve also injected links to the Microsoft docs at the end.

–––

1. Verifying on-prem traffic in VPN Gateway diagnostics

Make sure you’ve enabled “GatewayDiagnosticLog” (includes TunnelDiagnosticLog, IKEEvent, IPSecDiagnostics) and sent it to Log Analytics. Then you can run queries like:

Sample KQL #1 – Which on-prem IPs hit the gateway and over which tunnel?

AzureDiagnostics
|where ResourceProvider == "MICROSOFT.NETWORK" and ResourceType == "VIRTUALNETWORKGATEWAYS" and Category == "GatewayDiagnosticLog" and OperationName == "TunnelDiagnosticLog"
|extend props = parse_json(Properties)
|extend srcIP = tostring(split(props.Source,":")[0]),dstIP = tostring(split(props.Destination,":")[0]),tunnel= tostring(props.ConnectionName)
|where srcIP == "<YOUR_ONPREM_IP_OR_SUBNET>"
|summarize hits = count() by srcIP, tunnel, bin(TimeGenerated, 5m)
|order by TimeGenerated desc

Sample KQL #2 – Check IKE phase successes/failures

AzureDiagnostics
|where ResourceProvider == "MICROSOFT.NETWORK" and Category == "GatewayDiagnosticLog" and OperationName startswith "IkeEvent"
|extend props=parse_json(Properties)
|project TimeGenerated, Phase = tostring(props.IkePhase),srcIP = tostring(props.Source), dstIP = tostring(props.Destination),status = tostring(props.Status), | where srcIP == "<YOUR_ONPREM_IP>"
| order by TimeGenerated desc

Extra: if you also have NSG flow logs enabled on the subnet hosting your private endpoint, you can run:

AzureDiagnostics

|where Category == "NetworkSecurityGroupFlowEvent"and src_ip_s == "<YOUR_ONPREM_IP>"|project TimeGenerated, flow_direction_s, dest_ip_s, dest_port_s, action_s, flow_state_s

2. Alternative to traceroute for private endpoint

• Traceroute relies on ICMP TTL-expired replies, but Azure Private Link endpoints (and many Azure routers) don’t respond to ICMP TTL expiry. This is expected.
• Instead use Azure Network Watcher: • Connection Monitor (portal or CLI) to test TCP reachability on port 443 to your storage account FQDN (it will do health checks from your VNet). • IP flow verify in Network Watcher to simulate a packet from your on-prem IP to the private endpoint IP on port 443 and see if it’s allowed. • Test-NetConnection -ComputerName <private-IP> -Port 443 -InformationLevel Detailed from a VM in that VNet.

3. NSG + ICMP behavior

• NSGs are stateful and additive. If you add an Allow ICMP rule on the private‐endpoint subnet, you will: • Permit ICMP echo / TTL messages • Not block or override existing rules for TCP 443 or SMB 445
• However, even with ICMP allowed, many Azure-managed endpoints will still drop ICMP TTL‐expired messages, so you probably still won’t get traceroute hops.

4. Overlapping IP space on multiple VPN tunnels

• If two tunnels (even to separate gateways) advertise overlapping on-prem address ranges into the same VNet or peered VNets, routing can pick the “wrong” tunnel or black‐hole traffic.
• Azure strongly recommends non-overlapping address spaces. Double-check your local networks and the AddressPrefixes advertised by each Local Network Gateway.

Reference list:

1. VPN Gateway logs in Log Analytics (GatewayDiagnosticLog, TunnelDiagnosticLog, IKEEvent) https://learn.microsoft.com/azure/network-watcher/vpn-troubleshoot-overview#log-files
2. Network Watcher Connection Monitor https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview
3. Network Watcher IP flow verify https://learn.microsoft.com/azure/network-watcher/network-watcher-ip-flow-verify-overview
4. Test-NetConnection cmdlet https://learn.microsoft.com/powershell/module/nettcpip/test-netconnection
5. NSG overview and stateful behavior https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview
6. Azure Private Link traceroute limitations https://learn.microsoft.com/azure/private-link/private-endpoint-overview#limitations

Hope this gives you a solid troubleshooting path! Let me know if you need any more details.

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Hi Venkatesan, Thank you so much for information and KQL queries but these queries are still not working in my portal "throwing different errors" so could you please help me with how to check these logs in storage account logs