# Test 3 — VPN #2 Ireland-to-Azure private ICMP path

**Result:** PASS

**Executed:** 5 August 2026, 11:26:17 SGT

**AWS account:** `427617722186`

**Source:** `eg334s-euw1a-web-node-1` / `10.1.1.119` / `eu-west-1a`

**Destination:** `eg334s-team2-azure-server` / `10.2.1.4` / Azure East Asia
**Encrypted path:** Ireland VPC route propagation → AWS VGW → VPN #2 → Azure VPN Gateway → workload subnet

## Preconditions

- Ireland Web Node 1 was running.
- The Ireland route to `10.2.0.0/16` was active through VGW propagation.
- VPN #2 (`vpn-0106da6f9a20b1302`) was available.
- Both AWS-managed VPN #2 endpoints, `52.51.60.239` and `52.211.121.132`, reported `UP` with one accepted route each.

## Retained command output

```text
SGT timestamp: 2026-08-05 11:26:17 +08
Source host: ip-10-1-1-119.eu-west-1.compute.internal
Source private IP: 10.1.1.119

PING 10.2.1.4 (10.2.1.4) 56(84) bytes of data.
64 bytes from 10.2.1.4: icmp_seq=1 ttl=64 time=213 ms
64 bytes from 10.2.1.4: icmp_seq=2 ttl=64 time=213 ms
64 bytes from 10.2.1.4: icmp_seq=3 ttl=64 time=213 ms
64 bytes from 10.2.1.4: icmp_seq=4 ttl=64 time=213 ms

--- 10.2.1.4 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 213.017/213.206/213.388/0.480 ms

HTTP 200 from 10.2.1.4 in 0.426943s
```

## Acceptance statement

Test 3 proves that the reverse VPN #2 data path works from Ireland to Azure. Four private-address ICMP probes returned with zero packet loss and an average RTT of `213.206 ms`. A supporting HTTP request also returned status `200` directly from the Azure workload private address, but the canonical Test 3 acceptance measure is ICMP.

This result is independent of Tests 4 and 5, which exercise Azure-to-Ireland ICMP and HTTP respectively. It does not imply Virginia-to-Azure transit through the Ireland VGW.