Sebou Textile: the Kénitra factory can no longer reach the ERP in Azure, the VPN tunnel stays “NotConnected”

Sebou Textile, a workwear manufacturer located in the Kénitra industrial zone, hosts its ERP (manufacturing orders, stock, shipments) in Azure (rg-sebou-reseau, region francecentral). The factory is connected by a site-to-site VPN (connection conn-usine-kenitra) to the gateway vgw-sebou-prod; the Casablanca sales branch uses the same gateway (connection conn-agence-casa).

Yesterday at 17:50, as part of a “cryptographic hardening” requested by the auditor, an administrator modified the factory connection from the portal. The factory firewall, however, was not touched: its contractor will not come in until next week.

The night shift could not print the manufacturing orders; the morning shift (220 operators) arrives at 07:30. You are on your workstation with the Azure CLI signed in. The contractor sent you the factory firewall's IPsec configuration: ~/INC-3115/pare-feu-usine.txt.