azure-vpn-gateway

name	azure-vpn-gateway
description	Expert knowledge for Azure VPN Gateway development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring S2S/P2S tunnels, IPsec/IKE/BGP, Entra/RADIUS auth, active-active gateways, or S2S over ExpressRoute, and other Azure VPN Gateway related development tasks. Not for Azure ExpressRoute (use azure-expressroute), Azure Virtual WAN (use azure-virtual-wan), Azure Virtual Network (use azure-virtual-network), Azure Virtual Network Manager (use azure-virtual-network-manager).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-04-19","generator":"docs2skills/1.0.0"}

Azure VPN Gateway Skill

This skill provides expert guidance for Azure VPN Gateway. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L44	Diagnosing and fixing Azure VPN Gateway issues: S2S/P2S connection failures, certificate/auth errors, macOS IKEv2, throughput, health checks, resets, and packet-capture/log-based debugging
Best Practices	L45-L49	Guidance on using network virtual appliances (NVAs) in Azure as VPN endpoints for remote access, including design, routing, security, and integration with Azure VPN Gateway.
Decision Making	L50-L58	Guidance on choosing VPN Gateway SKUs, understanding SKU mappings, and planning/migrating VPN setups (P2S SSTP→IKEv2/OpenVPN, Classic→ARM, and remote work P2S strategies).
Architecture & Design Patterns	L59-L65	Design patterns and guidance for choosing VPN Gateway topologies, configuring active-active gateways, and building highly available, resilient site-to-site connectivity.
Limits & Quotas	L66-L71	VPN Gateway client version history, SKU comparisons, and FAQs about gateway limits, scale, performance, and connection behavior
Security	L72-L94	Securing Azure VPN Gateway: IPsec/IKE policies, forced tunneling, cert/RADIUS auth, Entra ID & MFA for P2S, client config (Win/macOS/Linux), access control, roles, and crypto best practices.
Configuration	L95-L151	Configuring Azure VPN Gateway and clients: P2S/S2S setup, auth (Entra, cert, RADIUS), BGP, IPsec/NAT, routing, monitoring, maintenance, and client configs for Windows, macOS, Linux, iOS.
Integrations & Coding Patterns	L152-L159	Configuring Azure VPN Gateway with on-prem devices and services: NPS/RADIUS VSAs for P2S, S2S over ExpressRoute, Cisco ASA samples, and BGP VPN connectivity with AWS.
Deployment	L160-L173	Deploying and migrating Azure VPN Gateways: create/upgrade gateways and SKUs, switch active/active modes, set up S2S VPNs, and manage client profiles and IP migrations via PowerShell/CLI.

Troubleshooting

Topic	URL
Run Azure VPN Client prerequisites check and fix issues	https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-prerequisites-check
Use packet capture on VPN Gateway for diagnostics	https://learn.microsoft.com/en-us/azure/vpn-gateway/packet-capture
Reset VPN Gateway or connection to restore IPsec tunnels	https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway
Verify Azure VPN Gateway connection health	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-verify-connection-resource-manager

Best Practices

Topic	URL
Use NVAs in Azure for remote access scenarios	https://learn.microsoft.com/en-us/azure/vpn-gateway/nva-work-remotely-support

Decision Making

Topic	URL
Select appropriate Azure VPN Gateway SKU	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus
Understand Azure VPN Gateway SKU consolidation and mappings	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation
Migrate P2S connections from SSTP to IKEv2/OpenVPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/ikev2-openvpn-from-sstp
Migrate VPN Gateways from Classic to Resource Manager	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-classic-resource-manager-migration
Plan remote work using P2S VPN Gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/work-remotely-support

Architecture & Design Patterns

Topic	URL
Design and configure active-active VPN Gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-active-active-gateways
Select Azure VPN Gateway topologies and designs	https://learn.microsoft.com/en-us/azure/vpn-gateway/design
Design highly available Azure VPN Gateway connectivity	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

Limits & Quotas

Topic	URL
Compare Azure VPN Gateway legacy SKUs and limits	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-skus-legacy
Azure VPN Gateway FAQ with limits and behaviors	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq

Security

Topic	URL
Implement forced tunneling for S2S VPN connections	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-site-to-site-tunneling
Configure custom IPsec/IKE policies in Azure portal	https://learn.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto
Enable multifactor authentication for P2S VPN users	https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
Configure P2S VPN with Entra ID and manual app registration	https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant
Configure P2S VPN with Microsoft Entra ID auth	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway
Migrate P2S Entra VPN from manual to Microsoft app ID	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway-update
Create or update custom Entra app ID for P2S VPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-register-custom-app
Configure P2S access control by Entra users and groups	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-users-access
Configure Linux Azure VPN Client for Entra ID P2S auth	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-linux
Configure macOS Azure VPN Client for Entra ID P2S auth	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-mac
Configure Device SSO with Azure VPN Client on Windows	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-windows-device-sso

Configuration

Topic	URL
Generate P2S VPN client profiles for Entra authentication	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-vpn-profile-download
Add or remove S2S connections on a VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/add-remove-site-to-site-connections
Configure optional Azure VPN Client settings for P2S	https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations
Configure BGP for VPN Gateway using Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-how-to-cli
Configure BGP for VPN Gateway using portal	https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto
Create custom IPsec policies for P2S VPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-custom-policies-p2s-ps
Configure custom traffic selectors for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/custom-traffic-selectors
Configure customer-controlled maintenance windows for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/customer-controlled-gateway-maintenance
Configure monitoring for Azure VPN Gateway with Azure Monitor	https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway
Reference for Azure VPN Gateway monitoring data	https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference
Configure NAT rules on Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/nat-howto

Integrations & Coding Patterns

Topic	URL
Configure NPS RADIUS VSAs for P2S user groups	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-radius
Configure S2S VPN over ExpressRoute private peering	https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering
Sample Cisco ASA configuration for Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-3rdparty-device-config-cisco-asa
Configure BGP VPN connection between Azure and AWS	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp

Deployment

Topic	URL
Plan migration from Basic to Standard public IP for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about
Execute Basic-to-Standard public IP migration for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto
Create a Basic SKU VPN Gateway via PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-gateway-basic-sku-powershell
Deploy a VPN Gateway using PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-gateway-powershell
Deploy a VPN Gateway using Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-cli
Deploy zone-redundant VPN and ExpressRoute gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway
Change Azure VPN Gateway between active and active-active	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-change-active-active
Upgrade Azure VPN Gateway SKU with minimal downtime	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade
Create S2S VPN with shared key using PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell
Create S2S VPN with shared key using Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-cli
Deploy Azure VPN client profiles using Intune