Troubleshoot connectivity between Azure virtual machines by checking NICs, NSGs, routes, guest firewalls and listening services.
Start with Test the destination port and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Test the destination port
Use a TCP test to confirm whether the affected destination port is reachable instead of relying only on ICMP.
Check NIC configuration
Verify the affected NIC, private IP, subnet and effective network configuration.
Check NSGs
Review subnet and NIC-level NSGs for conflicting or missing rules.
Check effective routes
Inspect effective routes for unexpected user-defined routes or network virtual appliances.
Check the guest firewall
Confirm the Windows or Linux guest firewall allows the required application port.
Verify the destination service
Verify the destination application is running and listening on the expected port.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
Port test
Test-NetConnection <destination-vm> -Port <port>Route table
Get-AzEffectiveRouteTable -NetworkInterfaceName <nic-name> -ResourceGroupName <resource-group>Quick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Test the destination port → Use a TCP test to confirm whether the affected destination port is reachable instead of relying only on ICMP.
- Check NIC configuration → Verify the affected NIC, private IP, subnet and effective network configuration.
- Check NSGs → Review subnet and NIC-level NSGs for conflicting or missing rules.
- Check effective routes → Inspect effective routes for unexpected user-defined routes or network virtual appliances.
- Check the guest firewall → Confirm the Windows or Linux guest firewall allows the required application port.
- Verify the destination service → Verify the destination application is running and listening on the expected port.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation