Logs from a site to site connection in Azure

Question

I need help to diagnosticate the failure point in a site to site connection from Azure and a Cisco ASA VPN Device. The connection type is policy based. Where can I find the logs in Azure?

Solution

There is no way to view logs direct, but we can download the Diagnostic logs of the VPN Gateway. In order to store the logs, you should add storage account and storage Container in the same Resource Group of the VPN Gateway. Here an example (ARM) to use PowerShell to configure the Diagnostic Logs for VPN Gateway:

# VNET Resource Group and Name
$rgName = ‘your resource name’
$vnetGwName = "your GW name"
$timestamp = get-date -uFormat "%d%m%y@%H%M%S"

# Details of existing Storage Account that will be used to collect the logs
$storageAccountName = "storage account name"
$storageAccountKey = ‘storage account key’
$captureDuration = 60
$storageContainer = "vpnlogs"
$logDownloadPath = "D:\vpnlogs (create the folder first)"
$Logfilename = "VPNDiagLog_" + $vnetGwName + "_" + $timestamp + ".txt"

# Set Storage Context and VNET Gateway ID
$storageContext = New-AzureStorageContext -StorageAccountName $storageAccountName -StorageAccountKey $storageAccountKey

# NOTE: This is an Azure Service Manager cmdlet and so no AzureRM on this one.  AzureRM will not work as we don’t get the gatewayID with it.
$vnetGws = Get-AzureVirtualNetworkGateway

# Added check for only provisioned gateways as older deleted gateways of same name can also appear in results and capture will fail
$vnetGwId = ($vnetGws | ? GatewayName -eq $vnetGwName | ? state -EQ "provisioned").GatewayID

# Start Azure VNET Gateway logging
Start-AzureVirtualNetworkGatewayDiagnostics  `
    -GatewayId $vnetGwId `
    -CaptureDurationInSeconds $captureDuration `
    -StorageContext $storageContext `
    -ContainerName $storageContainer

# Optional – Test VNET gateway connection to another server across the tunnel 
# Only use this if you are connected to the local network you are connecting to FROM Azure. Otherwise create some traffic across the link from on prem.
# Test-NetConnection -ComputerName 10.0.0.4 -CommonTCPPort RDP

# Wait for diagnostics capturing to complete
Sleep -Seconds $captureDuration

# Step 6 – Download VNET gateway diagnostics log
$logUrl = ( Get-AzureVirtualNetworkGatewayDiagnostics -GatewayId $vnetGwId).DiagnosticsUrl
$logContent = (Invoke-WebRequest -Uri $logUrl).RawContent
$logContent | Out-File -FilePath $logDownloadPath\$Logfilename

This script need to be performed one by one.
More information about Diagnostic logs, refer to the link.

Comments

[Jason Ye]

Just checking in to see if the information provided was helpful. Please let me know if you would like further assistance.