Azure VPN Gateway Skill

This skill provides expert guidance for Azure VPN Gateway. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L43	Diagnosing and fixing Azure VPN Gateway issues: client prerequisites, packet captures, tunnel resets, connection health checks, and answers to common troubleshooting FAQs.
Best Practices	L44-L48	Guidance on using network virtual appliances (NVAs) in Azure as VPN endpoints for remote access, including design, routing, security, and integration with Azure VPN Gateway.
Decision Making	L49-L58	Guidance on choosing VPN Gateway SKUs and planning migrations: Linux VPN client, P2S protocols (SSTP to IKEv2/OpenVPN), client types, and Classic-to-Resource Manager gateways.
Architecture & Design Patterns	L59-L65	Designing Azure VPN Gateway architectures: choosing topologies, active-active setups, cross-region peering, and high-availability connectivity patterns.
Limits & Quotas	L66-L70	VPN Gateway client version history, SKU comparisons, and FAQs about gateway limits, scale, performance, and connection behavior
Security	L71-L88	Securing Azure VPN Gateway: IPsec/IKE crypto, forced tunneling, P2S auth (Entra ID, RADIUS, MFA, Device SSO), access control, cert migration, roles/permissions, and security best practices.
Configuration	L89-L137	Configuring Azure VPN Gateway and clients: P2S/S2S setup, auth (cert, Entra, RADIUS), routing/BGP, IPsec/NAT/traffic selectors, monitoring, and VNet/ExpressRoute connectivity.
Integrations & Coding Patterns	L138-L145	Configuring Azure VPN with external systems: NPS/RADIUS user groups, S2S certificate tunnels, VPN over ExpressRoute, Cisco ASA setups, and BGP connections with AWS.
Deployment	L146-L155	Deploying and upgrading Azure VPN Gateways (SKUs, zones, active/active), creating S2S VPNs via PowerShell/CLI, and distributing Azure VPN client profiles with Intune.

Troubleshooting

Topic	URL
Use packet capture on VPN Gateway for diagnostics	https://learn.microsoft.com/en-us/azure/vpn-gateway/packet-capture
Reset VPN Gateway or connection to restore IPsec tunnels	https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway
Verify Azure VPN Gateway connection health	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-verify-connection-resource-manager

Best Practices

Topic	URL
Use NVAs in Azure for remote access scenarios	https://learn.microsoft.com/en-us/azure/vpn-gateway/nva-work-remotely-support

Decision Making

Topic	URL
Select appropriate Azure VPN Gateway SKU	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus
Plan migration from Azure VPN Client for Linux	https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-linux-retirement
Map and migrate Azure VPN Gateway SKUs	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation
Migrate Azure P2S VPN from SSTP to IKEv2/OpenVPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/ikev2-openvpn-from-sstp
Migrate P2S VPN from manual to Microsoft-registered client	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway-update
Migrate VPN Gateways from Classic to Resource Manager	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-classic-resource-manager-migration

Architecture & Design Patterns

Topic	URL
Design and configure active-active Azure VPN gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-active-active-gateways
Use cross-region VPN/ExpressRoute gateways via peering	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-different-region
Design highly available Azure VPN Gateway connectivity	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

Limits & Quotas

Topic	URL
Compare Azure VPN Gateway legacy SKUs and limits	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-skus-legacy

Security

Topic	URL
Implement forced tunneling for S2S VPN connections	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-site-to-site-tunneling
Configure custom IPsec/IKE policies in Azure portal	https://learn.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto
Enable multifactor authentication for P2S VPN users	https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
Configure P2S VPN with Entra ID and manual client app	https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant
View and disconnect Azure P2S VPN sessions securely	https://learn.microsoft.com/en-us/azure/vpn-gateway/p2s-session-management
Manage VPN gateway root certificate migration for P2S	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about-gateway-certificate-migration
Create custom audience app ID for P2S Entra VPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-register-custom-app
Configure P2S access control by Entra users and groups	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-users-access
Enable Device SSO for Azure VPN Client with Entra ID	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-windows-device-sso
Set up P2S RADIUS VPN with PowerShell for Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-radius-ps
Understand roles and permissions for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/roles-permissions
Apply security best practices to Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/secure-vpn-gateway
Configure cryptographic settings for Azure VPN gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto
Integrate Azure P2S RADIUS with NPS for MFA	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-radius-mfa-nsp

Configuration

Topic	URL
Generate P2S VPN client profiles for Entra authentication	https://learn.microsoft.com/en-us/azure/vpn-gateway/about-vpn-profile-download
Add or remove S2S connections on a VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/add-remove-site-to-site-connections
Configure optional Azure VPN Client settings for P2S	https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations
Configure BGP settings for Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/configure-bgp
Create custom IPsec policies for P2S VPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-custom-policies-p2s-ps
Configure custom traffic selectors for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/custom-traffic-selectors
Configure customer-controlled maintenance windows for VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/customer-controlled-gateway-maintenance
Reconfigure Azure VPN gateways for active-active mode	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-change-active-active
Configure monitoring for Azure VPN Gateway with Azure Monitor	https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway
Reference monitoring metrics for Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference
Configure NAT rules on Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/nat-howto
Configure P2S certificate authentication on VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificate-gateway
Generate P2S VPN certificates on Linux with OpenSSL	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificates-linux-openssl
Configure P2S VPN gateway with Entra ID client	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway
Configure Azure VPN Client with Entra ID for P2S	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client
Install client certificates for Azure P2S VPN	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert
Configure Azure VPN Gateway for P2S RADIUS auth	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-radius-gateway
Configure P2S VPN user groups and IP pools	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-about
Configure P2S VPN user IP pools with Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-cli
Generate and update P2S VPN client profiles in Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-vpn-profile-update
Configure P2S VPN clients with certificate auth	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-certificate
Configure VPN clients for P2S RADIUS authentication	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-radius
Configure certificate-authenticated site-to-site VPN gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway
Configure high-bandwidth S2S tunnels via ExpressRoute	https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-high-bandwidth-tunnel
Configure forced tunneling for S2S VPN in Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-tunneling
Understand Point-to-Site VPN routing behavior in Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing
Supported VPN devices and IPsec parameters for Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices
Azure VPN Gateway resource and connection settings	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings
Generate P2S VPN certificates using Windows PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
Generate P2S VPN certificates on Linux strongSwan	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site-linux
Generate P2S VPN certificates using MakeCert	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site-makecert
Connect classic VNets to ARM VNets via VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-different-deployment-models-portal
Connect classic VNets to ARM VNets with PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-different-deployment-models-powershell
Configure route-based VPN to multiple policy-based devices	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
Set up Always-On device VPN tunnel to Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel
Configure macOS Always-On VPN device tunnel to Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel-macos
Configure Always-On user VPN tunnel for Azure	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-user-tunnel
Configure certificate-based Point-to-Site VPN with PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps
Configure VNet-to-VNet VPN connections using Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-cli
Configure VNet-to-VNet VPN connection in portal	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal
Configure custom IPsec/IKE policies with PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell
Advertise custom routes to P2S VPN clients	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes
Create VNet-to-VNet VPN connections with PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vnet-vnet-rm-ps
Configure and troubleshoot Azure VPN Gateway connections	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq
Create Intune custom profile for Azure VPN client	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-profile-intune

Integrations & Coding Patterns

Topic	URL
Configure NPS RADIUS VSAs for P2S user groups	https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-radius
Configure S2S VPN over ExpressRoute private peering	https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering
Sample Cisco ASA configuration for Azure VPN Gateway	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-3rdparty-device-config-cisco-asa
Configure BGP VPN connection between Azure and AWS	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp

Deployment

Topic	URL
Migrate VPN Gateway Basic public IP to Standard	https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about
Migrate VPN Gateway public IP from Basic to Standard	https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto
Create a Basic SKU VPN Gateway via PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-gateway-basic-sku-powershell
Deploy zone-redundant VPN and ExpressRoute gateways	https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway
Upgrade Azure VPN Gateway SKU with minimal downtime	https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade
Create S2S VPN with shared key using PowerShell	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell
Create S2S VPN with shared key using Azure CLI	https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-cli

azure-vpn-gateway