VMs lose outbound connectivity after subsequent template deploy - azure

Question

I'm using an ARM template to deploy a virtual network, VPN gateway, and a number of virtual machines (I've tried a standalone VM, and a VMSS). I'm also deploying a PowerShell DSC module to each VM which copies over some code and installs it as a service.
There is a recurring issue where on subsequent deployments, probably half of the time, the deployment script fails because the deployment of the DSC extension fails due to lack of network connectivity and being unable to resolve the hostname of the storage account where the code is being offered.
When I connect to the vnet VPN and remote into the VM in question, there is always no outbound network activity. If I compare the /ipconfig all settings with the other VMs, the settings are identical (except with slightly different local IP). However one VM will be unable to ping any public IPs or resolve any hosts. Just trying to enter an nslookup session fails to connect to the DNS server itself immediately, even though other VMs are using that same DNS server just fine.
Usually just restarting the VM in question fixes the issue.
My vnet setup is pretty basic and I haven't specified my own DNS, so I'm just using "Azure DNS".
Currently my VMs in the template are configured as dependent on the virtual network. I'm not sure if I'm also supposed to make them dependent on the gateway as well.
Here's the config I'm using on the VMs:
"networkProfile": {
"networkInterfaceConfigurations": [
{
"name": "[concat(variables('scalesetName'), '-nic')]",
"properties": {
"primary": "true",
"ipConfigurations": [
{
"name": "[concat(variables('scalesetName'), '-ipconfig')]",
"properties": {
"subnet": {
"id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'), '/subnets/', variables('subnetName'))]"
}
}
}
]
}
}
]
},
And the configuration of the virtual network:
{
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[resourceGroup().location]",
"apiVersion": "[variables('networkApiVersion')]",
"tags": {
"displayName": "VirtualNetwork"
},
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix')]"
}
},
{
"name": "GatewaySubnet",
"properties": {
"addressPrefix": "[variables('gatewaySubnetPrefix')]"
}
}
]
}
},
{
"type": "Microsoft.Network/virtualNetworkGateways",
"name": "[variables('gatewayName')]",
"apiVersion": "[variables('networkApiVersion')]",
"location": "[resourceGroup().location]",
"tags": {
"displayName": "VpnGateway"
},
"dependsOn": [
"[concat('Microsoft.Network/publicIPAddresses/', variables('gatewayPublicIPName'))]",
"[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
],
"properties": {
"gatewayType": "Vpn",
"vpnType": "RouteBased",
"enableBgp": "false",
"sku": {
"name": "[variables('gatewaySku')]",
"tier": "[variables('gatewaySku')]"
},
"ipConfigurations": [
{
"name": "vnetGatewayConfig",
"properties": {
"privateIPAllocationMethod": "Dynamic",
"subnet": {
"id": "[concat(resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName')),'/subnets/', 'GatewaySubnet')]"
},
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('gatewayPublicIPName'))]"
}
}
}
],
"vpnClientConfiguration": {
"vpnClientAddressPool": {
"addressPrefixes": [
"[variables('vpnClientAddressPoolPrefix')]"
]
},
"vpnClientRootCertificates": [
{
"name": "RootCertificate",
"properties": {
"PublicCertData": "<snip>"
}
}
]
}
}
},
Any ideas why deploying is randomly breaking outbound VM traffic until I restart the VM?

Answer 1

Please note that azure blocks 'Ping' to/from the azure network.
Please answer the following:
a. Do you have any UDR rules on your subnet that force route your traffic to VPN gateway?
b. What is the storage account configuration for the VM. Is it using premium storage or standard storage.