Check next-hop selection before troubleshooting the appliance application path

Source facts

Microsoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. Microsoft Learn.

Applicability

Apply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.

DSE recommendation

DSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.

Verification

Run next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.

Official references

Microsoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal.