azurerm_virtual_network_gateway_connection fails when using ingress NAT rule

[alexander-vie]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

v1.6.6

AzureRM Provider Version

v3.112.0

Affected Resource(s)/Data Source(s)

azurerm_virtual_network_gateway_connection, azurerm_virtual_network_gateway_nat_rule

Terraform Configuration Files

# an ingress snat rule, a connection with both ingress and egress NAT
resource "azurerm_virtual_network_gateway_nat_rule" "partner-secondary-in" {
  for_each                   = toset([for value in var.vpn_ext_stages_ts : value if value != ""])
  name                       = "ts-apim-${each.key}-partner-secondary-in"
  resource_group_name        = "rg-shared-ts-${var.environment}"
  virtual_network_gateway_id = data.azurerm_virtual_network_gateway.vpn-gateway-ts[0].id
  mode                       = "IngressSnat"
  type                       = "Dynamic"
  ip_configuration_id        = data.azurerm_virtual_network_gateway.vpn-gateway-ts[0].ip_configuration[0].id

  external_mapping {
    address_space = var.vpn_ext_IngressSnatAPIMpartner[each.key]
  }
  internal_mapping {
    address_space = var.vpn_ext_IngressSnatAPIM[each.key]
  }
}

resource "azurerm_virtual_network_gateway_connection" "vpn-gateway-ts-to-partner-secondary" {
  count               = contains(["test", "prod"], var.environment) ? 1 : 0
  name                = "vpn-gateway-ts-to-partner-secondary"
  location            = data.azurerm_virtual_network_gateway.vpn-gateway-ts[0].location
  resource_group_name = data.azurerm_virtual_network_gateway.vpn-gateway-ts[0].resource_group_name
  tags                = var.default_tags_ts

  type                = "IPsec"
  connection_protocol = "IKEv2"
  enable_bgp          = true
  dpd_timeout_seconds = 45

  custom_bgp_addresses {
    primary = local.vpn_gateway_apipa_adresses[var.environment][0]
  }

  ipsec_policy {
    dh_group         = "DHGroup14"
    ike_encryption   = "AES256"
    ike_integrity    = "SHA256"
    ipsec_encryption = "AES256"
    ipsec_integrity  = "SHA256"
    pfs_group        = "None"
    sa_lifetime      = "3600"
  }

  virtual_network_gateway_id = data.azurerm_virtual_network_gateway.vpn-gateway-ts[0].id
  local_network_gateway_id   = azurerm_local_network_gateway.vpn-s2s-partner-secondary[0].id
  egress_nat_rule_ids        = [for nat_rule in azurerm_virtual_network_gateway_nat_rule.partner-secondary-out : nat_rule.id]
  ingress_nat_rule_ids       = [for nat_rule in azurerm_virtual_network_gateway_nat_rule.partner-secondary-in : nat_rule.id]

  lifecycle {
    ignore_changes = [shared_key]
  }
}

Debug Output/Panic Output

Terraform will perform the following actions:

  # azurerm_virtual_network_gateway_connection.vpn-gateway-ts-to-partner-secondary[0] will be updated in-place
  ~ resource "azurerm_virtual_network_gateway_connection" "vpn-gateway-ts-to-partner-secondary" {
        id                                 = "/subscriptions/xxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/connections/vpn-gateway-ts-to-partner-secondary"
      ~ ingress_nat_rule_ids               = [
          + "/subscriptions/xxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/virtualNetworkGateways/ts-vpngw-test/natRules/ts-apim-envinfraaz-partner-secondary-in",
          + "/subscriptions/xxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/virtualNetworkGateways/ts-vpngw-test/natRules/ts-apim-envtestaz-partner-secondary-in",
        ]
        name                               = "vpn-gateway-ts-to-partner-secondary"
        tags                               = {
            "environment" = "test"
            "managed_by"  = "terraform"
            "owner"       = "team infra"
            "project"     = "ts"
        }
        # (16 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

azurerm_virtual_network_gateway_connection.vpn-gateway-ts-to-partner-secondary[0]: Modifying... [id=/subscriptions/xxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/connections/vpn-g
ateway-ts-to-partner-secondary]
╷
│ Error: updating Connection (Subscription: "xxxxxx"
│ Resource Group Name: "rg-shared-ts-test"
│ Connection Name: "vpn-gateway-ts-to-partner-secondary"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: VpnConnectionNatAssociationWrongNatMode: The NAT rule /subscriptions/xxxxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/virtualNetworkGateways/ts-vpngw-test/natRules/ts-apim-envinfraaz-partner-secondary-in being associated with resource /subscriptions/xxxxxxxxx/resourceGroups/rg-shared-ts-test/providers/Microsoft.Network/connections/vpn-gateway-ts-to-partner-secondary is using the wrong NAT mode. EgressNatRules expects a NAT rule using EgressSnat mode.
│
│   with azurerm_virtual_network_gateway_connection.vpn-gateway-ts-to-partner-secondary[0],
│   on vpn-ts.tf line 242, in resource "azurerm_virtual_network_gateway_connection" "vpn-gateway-ts-to-partner-secondary":
│  242: resource "azurerm_virtual_network_gateway_connection" "vpn-gateway-ts-to-partner-secondary" {
│
╵

Expected Behaviour

An ingress NAT rule on a VPN connection should work as in the portal, allowing both ingress and egress NAT rules on a connection.

Actual Behaviour

Applying an ingress NAT rule on a VPN connection fails, while the very same NAT rule(s) can be applied in Azure portal. The error message indicates that the wrong NAT mode is used at the ARM api call - it seems to be always EgressSnat instead of IngressSnat. I don't know if a static NAT rule would make any difference, I used dynamic.

An egress NAT rule works as expected.

Steps to Reproduce

Define an ingress NAT rule and use it with a connection, and it will fail with the mentioned error.

Important Factoids

No response

References

No response

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.