Troubleshooting SSH Connection Issues in Vagrant VM with Ansible through WSL

Use this when Ansible running through WSL cannot SSH into a Vagrant VM during provisioning.

Quick Read

Symptom: Use this when Ansible running through WSL cannot SSH into a Vagrant VM during provisioning.
Check first: Confirm OS build, domain or workgroup state, local admin rights, and whether the host is managed by GPO, Intune, or another baseline.
Risk: Review before running

Symptoms

Failed to connect to the host via SSH when configuring a Vagrant VM with Ansible through Windows Subsystem for Linux (WSL).

Environment

Windows 10/11 with WSL2, Vagrant, Ansible, and a Linux-based Vagrant box.

Most Likely Causes

This issue can arise due to several factors including incorrect SSH configuration, firewall settings, or issues with the Vagrant box itself.

What to Check First

Confirm OS build, domain or workgroup state, local admin rights, and whether the host is managed by GPO, Intune, or another baseline.
Collect the exact error code, Event Viewer entries, and the command or UI action that triggers the failure.
Check whether the issue follows the user profile, machine, network, or application package.

Fix Steps

Verify Vagrant Box Status
Ensure that the Vagrant box is up and running.
Example pattern only. Adjust for your environment before running.
```
vagrant status
```
Check SSH Configuration
Confirm that the SSH settings in the Vagrantfile are correctly configured.
Example pattern only. Adjust for your environment before running.
```
cat Vagrantfile
```
Test SSH Connection Manually
Attempt to SSH into the Vagrant box manually to check if the issue is with Ansible or SSH itself.
Safe to run: read-only
```
vagrant ssh
```
Update Vagrant and Plugins
Ensure that Vagrant and any related plugins are up to date.
Example pattern only. Adjust for your environment before running.
```
vagrant plugin update
vagrant --version
```
Check Firewall Settings
Verify that your firewall is not blocking SSH connections.
Safe to run: read-only
```
netsh advfirewall firewall show rule name=all | findstr /C:"SSH"
```
Review Ansible Inventory File
Make sure the Ansible inventory file is correctly pointing to the Vagrant box.
Example pattern only. Adjust for your environment before running.
```
cat /path/to/ansible/inventory
```
Increase SSH Timeout
Modify the SSH timeout settings in the Vagrantfile to allow more time for the connection.
Safe to run: read-only
```
echo 'config.ssh.timeout = 120' >> Vagrantfile
```
Reprovision the Vagrant Box
Reprovision the Vagrant box to apply any changes made.
Example pattern only. Adjust for your environment before running.
```
vagrant reload --provision
```

Validation

The failing Windows action completes after reboot or service restart if the remediation requires one.
Event Viewer stops logging the same error ID for the same component during a retest.
The fix works for the affected standard user context, not only for an elevated administrator session.

Logs to Check

Event Viewer: System, Application, Setup, WindowsUpdateClient, TerminalServices, or PowerShell logs as relevant.
CBS.log, DISM.log, or WindowsUpdate.log when servicing or feature installation is involved.
Security, RDP, or application-specific logs for authentication and session failures.

Rollback and Escalation

Record the original registry, service, feature, policy, or firewall value before changing it.
Undo temporary local policy, firewall, or service changes after validation.
Use a restore point, VM snapshot, or exported configuration when changing servicing, boot, or security settings.

Escalate When

Escalate if the same error persists after rollback and a clean retry from the original failing path.
Escalate if logs show authorization, data loss, certificate, replication, or production availability risk outside the local service owner scope.

Edge Cases

If using a custom SSH key, ensure that the key is correctly specified in the Vagrantfile.
Check if the WSL environment has the necessary permissions to access the Vagrant box.

Notes from the Field

If the machine is domain-managed, local fixes can be overwritten. Check the winning GPO or MDM policy before repeating the same change.
Prefer read-only collection first on Windows incidents because many repair commands change component store, services, or user profile state.