Route Table is not routing some IP addresses

Question

Route Table is not routing some IP addresses

Mark Wint 0

I've setup a lot of Route in my route table, so that certain remote subnets (e.g. 10.10.99.0/24) are routed via a Virtual Appliance. They all work except for 2 routes. I can't see why these 2 particular routes are not working but the rest are. I've checked for overlaps and they are known.

Shravan Addagatla 1,540 Reputation points Microsoft External Staff Moderator

2025-05-16T08:38:22.7466667+00:00

Hello Mark Wint

Did you had a chance to check my last response and please share me details to assist you further in troubleshooting this issue.
Mark Wint 0 Reputation points

2025-05-16T10:05:08.6166667+00:00

Hi,

I've been responding to the private messages I've been sent about this
Anonymous

2025-05-19T08:38:30.6733333+00:00

Hi @Mark Wint

The route is missing from the effective route table of the VM’s NIC. This might be due to the route table not being associated with the correct subnet, or it might be conflicting with or overridden by a broader prefix in the same UDR or by a system route.
Anonymous

2025-05-20T10:34:37.0633333+00:00

Hi @Mark Wint

Verify whether IP forwarding is enabled on both the NVA’s NIC and within the operating system.

For more details, follow: https://learn.microsoft.com/en-us/azure/virtual-network/diagnose-network-routing-problem#considerations.
KapilAnanth 49,876 Reputation points Moderator

2025-05-20T16:06:34.5366667+00:00
@Mark Wint ,

Greetings, I see you had an elaborate discussion with Shravan and Venkat.

To reiterate,

You have a Route Table attached to a Subnet.

This subnet has a couple of VMs

You are trying to add a UDR with nextHop as NVA, but this is not populating in the VM's effective routes.

Specifically, you mentioned there are 2 prefixes with which you face this issue

Other prefixes/routes in the same UDR are updated in the VM's NIC effective routes

Next steps,

Are you sure the issue is happening only with these 2 address prefixes?

i.e., the ones which are working - were they added recently or were they always present?

Can you create a new dummy route with a prefix other than the 2 you mentioned?

Is it also facing the same issue?

Can you attach this Route Table to a dummy subnet with a dummy VM

And check if this dummy VM's effective routes gets updated or not?

Meanwhile, I shall also do a Lab repro

Cheers,

Kapil

1 answer

Your answer

Shravan Addagatla 1,540 Reputation points Microsoft External Staff Moderator

2025-05-16T08:38:22.7466667+00:00

Hello Mark Wint

Did you had a chance to check my last response and please share me details to assist you further in troubleshooting this issue.
Mark Wint 0 Reputation points

2025-05-16T10:05:08.6166667+00:00

Hi,

I've been responding to the private messages I've been sent about this
Anonymous

2025-05-19T08:38:30.6733333+00:00

Hi @Mark Wint

The route is missing from the effective route table of the VM’s NIC. This might be due to the route table not being associated with the correct subnet, or it might be conflicting with or overridden by a broader prefix in the same UDR or by a system route.
Anonymous

2025-05-20T10:34:37.0633333+00:00

Hi @Mark Wint

Verify whether IP forwarding is enabled on both the NVA’s NIC and within the operating system.

For more details, follow: https://learn.microsoft.com/en-us/azure/virtual-network/diagnose-network-routing-problem#considerations.
KapilAnanth 49,876 Reputation points Moderator

2025-05-20T16:06:34.5366667+00:00

@Mark Wint ,

Greetings, I see you had an elaborate discussion with Shravan and Venkat.

To reiterate,

You have a Route Table attached to a Subnet.

This subnet has a couple of VMs

You are trying to add a UDR with nextHop as NVA, but this is not populating in the VM's effective routes.

Specifically, you mentioned there are 2 prefixes with which you face this issue

Other prefixes/routes in the same UDR are updated in the VM's NIC effective routes

Next steps,

Are you sure the issue is happening only with these 2 address prefixes?

i.e., the ones which are working - were they added recently or were they always present?

Can you create a new dummy route with a prefix other than the 2 you mentioned?

Is it also facing the same issue?

Can you attach this Route Table to a dummy subnet with a dummy VM

And check if this dummy VM's effective routes gets updated or not?

Meanwhile, I shall also do a Lab repro

Cheers,

Kapil

Answer 1

Shravan Addagatla 1,540 Microsoft External Staff Moderator

Hello Mark Wint

I understand that you're facing a routing issue in your Azure route table. You've set up routes for various remote subnets (e.g. 10.10.99.0/24) but two specific routes aren't working while others are, here are a few things to check.

Ensure that the next hop IP (NVA) for these two routes is correctly set and matches the Virtual Appliance.

Even though you've checked for overlaps, please check no other user-defined route (UDR) takes precedence over the failing routes.

Please check the effective routes for the network interface of the virtual machine that is supposed to use these routes. This can help you see if your user-defined routes (UDRs) are taking effect or if they're being overridden by default routes.

Also, I would like to know if these two routes on the VM NIC effectives are showing user -defined or invalid route?

Do you see traffic on the NVA when pinging or psping the remote subnet IPs??

Use connection troubleshoot to see what is mis-configured on the route table and help to get some insights about the connectivity details.

Since you mentioned that next hop type shows as NONE instead of NVA then re-adding the route can help on this.

Refer this article: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#custom-routes

Please let me know if you have any further questions.

Anonymous

2025-05-19T05:20:44.62+00:00
@Mark Wint

The Next Hop tool in Azure Network Watcher helps confirm whether your VM’s traffic is being correctly routed via the intended next hop (e.g., a virtual appliance) and is essential to diagnose when UDRs seem to be ignored or traffic is silently dropped.
Make sure that IP forwarding is enabled in two places for your NVA (Network Virtual Appliance) to route traffic successfully. Follow the Enable IP forwarding in the operating system .

After that, you can verify the traffic flow by using the following command from a source VM.

tracert -d <destination-IP>
Mark Wint 0 Reputation points

2025-05-19T05:28:18.04+00:00

On Friday we found that the next hip was not being created. This was being escalated as it was an issue in Azure, after a chat on private messages
KapilAnanth 49,876 Reputation points Moderator

2025-05-22T17:05:08.08+00:00
@Mark Wint ,

Greetings. I did a Lab and here are my findings.

Environment:

Azure Firewall IP: 10.0.100.4

Non-existent IP: 10.0.100.5 (No NVA i.e., VM or Azure Firewall has this IP. In fact, this IP is unallocated)

A third party NVA VM: 10.0.0.4

My UDR:

My effective routes:

Observation:

When the IP specified in the Next Hop IP Address

is not reachable by the source VM (route not available either because this IP Address is not part of it's VNET or peered VNET)
or

is reachable but is not dedicated to an NVA

Then this is the expected behavior

Azure will mark the effective route as "None"

You can see routes with nextHop IP as "10.0.100.5" becoming None - because 10.0.100.5 is unallocated.

But routes with nextHop IP as "10.0.100.4" and "10.0.0.4" are working - because former is Azure Firewall and latter is allocated to VM.

You can see a similar thing happening when I specify nextHop as VNET Gateway in a VNET that does not have a VPN gateway.

Refer : User-defined routes

None: Specify when you want to drop traffic to an address prefix, rather than forwarding the traffic to a destination. Azure might show None for some of the optional system routes if a capability isn't configured. For example, if you see that Next hop IP address shows None and Next hop type shows Virtual network gateway or Virtual appliance, it might be because the device isn't running or isn't fully configured. Azure creates system default routes for reserved address prefixes with None as the next hop type.

So, this means, the next Hop IP Address you are configuring is

either not reachable from Azure VMs in the subnet (no route available)
or

is reachable but the IP is not allocated to a NVA VM/Nic

Hope this adds more clarity.

Cheers,

Kapil
KapilAnanth 49,876 Reputation points Moderator

2025-05-23T09:14:48.8033333+00:00
@Mark Wint ,

Thanks for the update over private messages that the issue has been now resolved.

You informed that there was a secondary NIC on the VM

Post removing this, you were successfully able to create a route with nextHop as NVA

Thanks for your continued contribution on Q&A and appreciate much for taking the time to share your feedback.

Please don’t forget to click Accept the answer and Up-Vote for the same, which might be beneficial to other community members reading this thread.

And, if you have any further query do let us know.

Thanks,

Kapil