Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
possible bug in the vpn gateway migration tool that was recently released to handle basic IP migration
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 44%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
David
0
Reputation points
Hello,
wondering if anyone in the north central US region has run into this issue at all.
we have 4 vpn gateways. 3 in north central US (NC-US), and 1 in central US (C-US). all are VpnGW1 skus (non-az).
ive run the new migration tool on 2 gateways in NC-US and the one we have in C-US. the remaining GW is in PROD, so we are pausing the migration for that one for the time being.
on all 3 gateways, the IP was successfully migrated from basic to standard sku. worked great.
however, according to the migration docs the tool would also migrate our vpn gateways from non-az skus to AZ skus (VpnGw1 -> VpnGw1AZ, etc..).
both of the NC-US gateways failed to migrate to an AZ sku during the migration process. i did see references to the AZ skus in the configure blade after running the migration tool, but before running the 'commit' process. since the gateway was still considered as 'in process of migration' i couldnt change it to the AZ sku at that point. after running the 'commit' phase, those AZ sku options disappeared from the NC-US gateways.
the vpn gateway in C-US though? successfully auto-migrated to the VpnGw1AZ sku.
could this be a bug in the migration tool deployed to vpn gateways hosted in the NC-US region?
all gateways are in /28 gateways subnets as well. so, technically the central US gateway should have failed to migrate to an AZ sku if a /28 gateway subnet is a show stopper.
anyone else seeing this behavior?
Azure VPN Gateway
{count} votes
-
Nandamuri Pranay Teja 4,445 Reputation points Microsoft External Staff Moderator2025-08-11T20:40:31.59+00:00 Hello David,
Thank you for posting the question!
To investigate further could you please confirm me the below details.
- Did you encounter any error messages during the migration attempts for the NC-US gateways? Are there any differences in your gateway configurations in terms of settings, routing, or associated resources between the NC-US and C-US regions?
Please be informed that migration functionality is rolling out to regions. If you don't see the Migrate Tab in the portal, it means that the migration process isn't available yet in your region. For more information: https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal
Your Central US region likely has availability zones enabled, which is why that gateway successfully migrated to VpnGw1AZ, while North Central US does not have availability zones yet, causing the migration tool to skip the AZ SKU upgrade for those gateways.
This appears to be expected behavior rather than a bug - the tool is working as designed based on actual regional availability zone support. You could manually upgrade the NC-US gateways to AZ SKUs after migration (they would just deploy as regional rather than zone-redundant) Wait for availability zones to be enabled in North Central US, at which point zone redundancy would automatically activate.
References:
https://learn.microsoft.com/en-us/azure/vpn-gateway/whats-new#upcoming-projected-changes
Let me know if you have any questions we are here to help.
Sign in to comment
Sign in to answer