criticalAdvancedSymptom-first#route-table#subnet#routing#networking#nva

Route table misconfiguration isolating a subnet

VMs in a subnet cannot reach the internet or other subnets

Likely source:connectivityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • VMs in a subnet cannot reach the internet or other subnets
  • az network route-table route list shows a default route pointing to a non-existent next-hop
  • Network Watcher IP flow verify shows traffic dropped by a custom route

Route tables override the default Azure routing. A misconfigured 0.0.0.0/0 route is the most common cause of total subnet isolation.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Route table associated with the subnet

    az network vnet subnet show --resource-group <RG> --vnet-name <VNET> --name <SUBNET> --query routeTable.id -o tsv

  • Routes in the table

    az network route-table route list --resource-group <RG> --route-table-name <RT-NAME> --query "[].{name:name,addressPrefix:addressPrefix,nextHop:nextHopType,nextHopIP:nextHopIpAddress}" -o table

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Route 0.0.0.0/0 has nextHopType = VirtualAppliance with no IP
  • The NVA VM was deleted or deallocated

Confirm before fixing

az network route-table route show --resource-group <RG> --route-table-name <RT-NAME> --name <ROUTE-NAME> --query "{nextHop:nextHopType,nextHopIP:nextHopIpAddress}" -o json
READ

Check the default route's next hop

Fix

az network route-table route update --resource-group <RG> --route-table-name <RT-NAME> --name <ROUTE-NAME> --next-hop-type Internet
CHANGE

Point the default route to Internet

Expected: Route updated.

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az network route-table route list --resource-group <RG> --route-table-name <RT-NAME> --query "[].{name:name,addressPrefix:addressPrefix,nextHop:nextHopType}" -o table
READ

List all routes

2
az network nic list-effective-route --resource-group <RG> --name <NIC-NAME> --query "[].{name:name,addressPrefix:addressPrefix,nextHop:nextHopType}" -o table
READ

Check effective routes on the NIC

3
az network route-table route update --resource-group <RG> --route-table-name <RT-NAME> --name <ROUTE-NAME> --next-hop-type Internet
CHANGE

Fix the default route if NVA is down

Prevention

  • Use Network Watcher IP flow verify to test routes before applying to production subnets.
  • Document route table topology and next-hop dependencies.
  • Set up alerts on route table changes via Azure Monitor activity log.
  • Use Azure Virtual WAN for managed routing instead of custom route tables where possible.

Related runbooks

Same stack, same failure family — worth a skim.

VNet peering traffic blocked — non-overlapping CIDR or gateway requiredhigh

VMs in peered VNets cannot reach each other

AzureIntermediate3 causes
Open runbook
Private DNS zone not resolving — VNet link missing or brokenhigh

nslookup for a private endpoint FQDN returns NXDOMAIN from a VM in the VNet

AzureIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.