Network Watcher: IP flow verify and Next hop

Keep everything running for both breaks.

1Break it: a rule change on the wrong port

Someone moves the app rule to 8443 for a “TLS project”, but the app still listens on 8080:

az network nsg rule update --resource-group rg-saat-l62 --nsg-name nsg-b --name allow-app --destination-port-ranges 8443 -o none
az network watcher test-connectivity --resource-group rg-saat-l62 --source-resource vm-a --dest-address 10.62.2.4 --dest-port 8080 --protocol Tcp --query "{status:connectionStatus, sent:probesSent, failed:probesFailed, issues:hops[].issues[].type}" -o json
az network watcher test-ip-flow --resource-group rg-saat-l62 --vm vm-b --direction Inbound --protocol TCP --local 10.62.2.4:8080 --remote 10.62.1.4:50000 -o table

You should see something like this:

{
  "failed": 66,
  "issues": [
    "NetworkSecurityRule"
  ],
  "sent": 66,
  "status": "Unreachable"
}
Access    RuleName
--------  ----------------------
Deny      securityRules/deny-vnet

Connection troubleshoot says the issue type is an NSG rule, and IP flow verify names it: deny-vnet catches 8080 now that allow-app covers 8443. After 10 to 20 minutes the same story is in Traffic Analytics:

$ws = az monitor log-analytics workspace show --resource-group rg-saat-core --workspace-name law-saat --query customerId -o tsv
az monitor log-analytics query --workspace $ws --analytics-query "NTANetAnalytics | where TimeGenerated > ago(1h) and SubType =~ 'FlowLog' and DestIp == '10.62.2.4' | summarize flows = count() by FlowStatus, DestPort, AclRule" -o table

You should see something like this:

AclRule                FlowStatus    DestPort    Flows
---------------------  ------------  ----------  -------
UserRule_allow-app     Allowed       8080        4
UserRule_deny-vnet     Denied        8080        3

Fix it: put the port back (or add 8443 alongside 8080), and test:

az network nsg rule update --resource-group rg-saat-l62 --nsg-name nsg-b --name allow-app --destination-port-ranges 8080 -o none
az network watcher test-connectivity --resource-group rg-saat-l62 --source-resource vm-a --dest-address 10.62.2.4 --dest-port 8080 --protocol Tcp --query "{status:connectionStatus, sent:probesSent, failed:probesFailed, issues:hops[].issues[].type}" -o json

status is Reachable again.

2Break it: a route that goes nowhere

A route table meant for another network is attached to snet-a, with a route that drops traffic to snet-b:

az network route-table create --resource-group rg-saat-l62 --name rt-l62 -o none
az network route-table route create --resource-group rg-saat-l62 --route-table-name rt-l62 --name to-b --address-prefix 10.62.2.0/24 --next-hop-type None -o none
az network vnet subnet update --resource-group rg-saat-l62 --vnet-name vnet-l62 --name snet-a --route-table rt-l62 -o none
az network watcher test-connectivity --resource-group rg-saat-l62 --source-resource vm-a --dest-address 10.62.2.4 --dest-port 8080 --protocol Tcp --query "{status:connectionStatus, sent:probesSent, failed:probesFailed, issues:hops[].issues[].type}" -o json
az network watcher show-next-hop --resource-group rg-saat-l62 --vm vm-a --source-ip 10.62.1.4 --dest-ip 10.62.2.4 -o table
az network watcher test-ip-flow --resource-group rg-saat-l62 --vm vm-b --direction Inbound --protocol TCP --local 10.62.2.4:8080 --remote 10.62.1.4:50000 -o table

You should see something like this:

{
  "failed": 66,
  "issues": [
    "UserDefinedRoute"
  ],
  "sent": 66,
  "status": "Unreachable"
}
NextHopType    RouteTableId
-------------  ----------------------------------------------
None           /subscriptions/.../routeTables/rt-l62
Access    RuleName
--------  ----------------------
Allow     securityRules/allow-app

Here IP flow verify says Allow, because the NSG is fine. Only next hop and connection troubleshoot show that the packet is dropped by a user route before it ever reaches the NSG. If you had checked NSGs alone, you’d have closed this ticket as “network OK”.

Fix it: detach the route table from the subnet, and test again:

az network vnet subnet update --resource-group rg-saat-l62 --vnet-name vnet-l62 --name snet-a --remove routeTable -o none
az network watcher show-next-hop --resource-group rg-saat-l62 --vm vm-a --source-ip 10.62.1.4 --dest-ip 10.62.2.4 -o table
az network watcher test-connectivity --resource-group rg-saat-l62 --source-resource vm-a --dest-address 10.62.2.4 --dest-port 8080 --protocol Tcp --query "{status:connectionStatus, sent:probesSent, failed:probesFailed, issues:hops[].issues[].type}" -o json

Next hop is VnetLocal and the status is Reachable.

3Clean up

Delete the flow log, then the resource group:

az network watcher flow-log delete --location centralindia --name fl-vnet-l62
az group delete --name rg-saat-l62 --yes

✅ Checkpoint: You found an NSG problem and a routing problem with the right tool for each, confirmed one with flow logs, and cleaned up.