Troubleshoot Azure Tiered License Issues in Access Server⁠

If you purchased an Azure Tiered instance with more than two connections but Access Server allows only two, the server isn't successfully validating the Azure Tiered license.

When Access Server can't verify its license, it operates in demonstration mode, which limits the server to two concurrent connections.

Start by checking whether the VM reports the expected Azure Tiered Marketplace plan.

1. Connect to the Access Server VM with SSH and get root privileges.

2. Run the following to check communication with the Instance Metadata Service (IMDS):

   curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance/compute/plan?api-version=2025-04-07&format=json"

   1. 1

      The --noproxy "*" option ensures the request connects directly to IMDS instead of using a configured web proxy.

   2. 2

      169.254.169.254 is the Azure IMDS address. The request uses the 2025-04-07 API version used by Access Server.

3. Review the output. A healthy Azure Tiered instance returns a plan object similar to:

   {
     "name": "5-connections-arm64",
     "product": "openvpn-as-tiered",
     "publisher": "openvpn"
   }

   The name value varies by connection tier and architecture.

4. Continue based on the result:

   • If the output includes "product": "openvpn-as-tiered" and "publisher": "openvpn", but Access Server still allows only two connections, refer to Azure metadata errors appear in the Access Server log.

   • If the expected plan information isn't returned, refer to IMDS doesn't return the Azure Tiered plan.

If the IMDS query doesn't return the expected Azure Tiered plan information, check for something on the VM or in its Azure configuration that is preventing access to IMDS.

IMDS is available from inside the VM at:

http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07

To troubleshoot the connection:

1. Check proxy settings: Requests to 169.254.169.254 need to bypass any configured web proxy. The troubleshooting command uses --noproxy "*" for this reason.

2. Check routing: Run:

   ip route get 169.254.169.254

   Verify that the route uses the VM's primary network interface and primary IP address. If you've customized the VM's routes, ensure 169.254.169.254 is still routed through the primary interface.

3. Check local firewall rules: Review both iptables and nftables for rules that block outbound TCP port 80 to 169.254.169.254.

4. Check endpoint security or network inspection software: Ensure it isn't blocking or intercepting the IMDS request.

5. Check the Azure network security group (NSG): Standard NSG rules don't normally block IMDS. Check for any explicit deny rule that targets Azure IMDS traffic, such as the AzurePlatformIMDS service tag.

6. Run the IMDS query again:

   curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07" | jq .plan

7. When the expected Tiered plan information displays, restart Access Server:

   systemctl restart openvpnas

8. Sign in to the Admin Web UI and verify the connection limit.

If the IMDS query succeeds but Access Server still allows only two connections, continue with Azure metadata errors appear in the Access Server log.

Use Azure licensing debug logging when IMDS returns the expected Tiered plan but Access Server still doesn't recognize the license, or when you're investigating Azure-related errors in the Access Server log.

AZURE INFO STATUS 502
AZURE INFO CONTENT (b'{"reason": "Could not connect to Node"}',)

AZURE not detected (missing instance/attested)
AZURE INFO: consecutive failures = 1/4

Azure Tiered uses a fixed connection tier. If you need more flexibility to change the number of connections, migrate to Azure PAYG or an Access Server Subscription.

Refer to Migrate Azure Tiered.