Service explained in plain language
A site-to-site VPN links network environments through an encrypted tunnel. Both peers need a compatible supported configuration, and application traffic still needs correct addressing, routes and policy. A tunnel's connection status and an application's usable communication path should be tested separately.
Setup prerequisites and starting sequence
- Document Azure and remote network ranges, gateway/public peer details and the required business traffic. Resolve overlapping-address and routing assumptions before provisioning.
- Review the gateway and remote-device support requirements and compatible connection settings. Protect shared authentication material through the approved process.
- Configure appropriate diagnostics and an operator contact at each site. Rehearse authorized application tests and a supported recovery sequence.
Start in non-production with the approved account/subscription, region and owner. Follow the linked service instructions for exact console/API options; provisioned resources may incur charges.
Example operational issue
A tunnel fails after a remote firewall change. The Azure operator sees a disconnected state, while the remote team has changed a peer parameter or routing rule. Troubleshooting only the Azure dashboard cannot establish what the other gateway is accepting.
This is an illustrative operational example. Capture the exact error and time before making changes.
Troubleshooting: evidence before changes
| Observation | First check | Why it matters |
|---|---|---|
| Tunnel negotiation does not establish | Compare current peer identity and supported connection configuration at both sites | One-sided settings and recent changes need to be reconciled with the remote owner. |
| Tunnel is connected but application fails | Trace source/destination ranges, routing and traffic policy | Encrypted connectivity does not automatically authorize every business path. |
| Behavior changes with traffic or time | Correlate gateway/device evidence and the actual failed application operation | Repeated resets can hide a capacity, timing or path-specific symptom. |
Begin with status and scoped diagnostics. Sanitize shared evidence and escalate any check beyond your approved access.
Corrective action and change boundary
Apply the narrow supported correction with both gateway owners and preserve prior settings. Coordinate any reconnecting or disruptive action with the application owner. Do not distribute shared keys in tickets or broadly weaken traffic policy simply to obtain one successful test.
Verification: what proves recovery
Verify connection status and actual approved business traffic from the relevant clients in both environments. Confirm expected return routing and name resolution. Observe the connection through the agreed period and document any remaining intermittent or size-dependent failure.
Monitoring, SLI, SLO and SLA
Monitor tunnel state and application transaction success separately. An internal objective can measure the proportion of required cross-site transactions completed within the expected time, plus a recovery objective for lost connectivity.
SLI means the measured result; SLO means an agreed internal target. SLA means a contractual commitment with its own scope and remedy. The training targets here are examples, not vendor commitments; verify current service terms before promising an SLA.
A sample support target is acknowledgment within ten minutes of a confirmed critical cross-site application outage during the agreed coverage window.
SOP and escalation handover
The network incident owner coordinates with the remote peer owner and application support. Retain sanitized configuration differences, connection evidence and acceptance results. Escalate before a shared gateway change affects other connections using the same infrastructure.
SOP means standard operating procedure. Retain owner, evidence, approved change, reversal conditions and acceptance. Escalate with sanitized errors and resource identifiers.
Beginner glossary
Peer: the gateway at the other end. Tunnel: the encrypted network connection. Return route: the path used by the response back to its initiating system.
Clouvenix can help scope setup, management and operational support around a documented environment and agreed acceptance criteria.
Technical reference
Official Azure service guidance. Validate resource-specific prerequisites and supported behavior against the deployed version. This walkthrough defines an investigation and operating contract; it does not authorize changes to someone else's environment.