Troubleshoot Azure Network Virtual Appliance routing and connectivity problems involving routes, NSGs, forwarding and appliance health.
Start with Confirm the intended traffic path and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Confirm the intended traffic path
Document the expected source, NVA interface and destination path before changing routing.
Check NSG access to the NVA
Use IP Flow Verify to determine whether an NSG blocks traffic reaching the NVA.
Check effective routes
Review effective routes on the source and NVA subnets and confirm the intended next hop.
Check IP forwarding
Verify the NVA NIC and appliance configuration support IP forwarding where required.
Check the appliance listener
Confirm the appliance is listening on the expected interface and port.
Run an end-to-end test
Run an end-to-end Network Watcher connectivity test after correcting the identified dependency.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
IP Flow Verify
az network watcher test-ip-flow --resource-group <resource-group> --vm <source-vm> --direction Outbound --protocol TCP --local <source-ip>:<port> --remote <nva-ip>:<port>NIC configuration
az network nic show --resource-group <resource-group> --name <nva-nic>Quick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Confirm the intended traffic path → Document the expected source, NVA interface and destination path before changing routing.
- Check NSG access to the NVA → Use IP Flow Verify to determine whether an NSG blocks traffic reaching the NVA.
- Check effective routes → Review effective routes on the source and NVA subnets and confirm the intended next hop.
- Check IP forwarding → Verify the NVA NIC and appliance configuration support IP forwarding where required.
- Check the appliance listener → Confirm the appliance is listening on the expected interface and port.
- Run an end-to-end test → Run an end-to-end Network Watcher connectivity test after correcting the identified dependency.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation