After connecting the Azure network to Acreto and sending all traffic through Acreto vGateway, Azure Active Directory Domain Services managed domain fails to synchronize with Microsoft Windows Active Directory servers.
In Azure, you can see an alert:
Name: The managed domain has not completed synchronization with Azure AD for a long time
Severity: Critical
ID: AADDS500
In Azure, you can see an alert:
Name: The managed domain is experiencing a network error
Severity: Critical
ID: AADDS104
Most likely, your Azure network’s routing table has a default route (0.0.0.0/0) defined that routes all traffic through Acreto vGateway.
It means that also communication required to synchronize with Azure AD DS is sent through Acreto, and is SNAT’ed (its source IP address is replaced) to Acreto Allocated IP address.
Microsoft detects that synchronization traffic goes from a different source IP address than expected, and blocks that traffic. This breaks synchronization between Azure AD DS and the target server.
See Azure virtual network design for details.
Create routing configuration that will route IP addresses from Azure service tags through standard Azure gateway, while keeping default route pointing to Acreto vGateway. You can download a list of Azure IP Ranges and Service Tags – Public Cloud.
See User-defined routes for more details.
Please refer to the following additional material: