Clarification on VPN Gateways and Expiry of Basic Public IP Addresses

Question

Clarification on VPN Gateways and Expiry of Basic Public IP Addresses

Muhammad Yousuf 0

Dear Support,

I hope this message finds you well.

We currently have three VPN gateways deployed, each using a different SKU: Basic, Standard, and VpnGw1. We recently received a notification from Azure stating that Basic Public IP addresses will expire on 30th September 2025.

Could you please confirm whether this deadline also applies to the VPN gateways using Basic, Standard and VpnGw1 SKUs? If so, we would appreciate it if you could share any relevant documentation or guidance on the required steps to convert or migrate these VPN gateways accordingly.

Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-24T09:12:24.9+00:00
Hi Muhammad Yousuf,

Thank you for following up and sharing your concern!

About the new retirement date:

Azure has extended the retirement date for Basic SKU public IP addresses used by VPN Gateways to 31 January 2026 (instead of September 30, 2025 for other resources). This gives you more time to plan your migration and avoid disruption for VPN Gateways configured with Basic SKU public IPs. You can refer to your official notification and documentation for confirmation:

https://free.blessedness.top/en-us/azure/vpn-gateway/whats-new#upcoming-projected-changes

If your Standard or VpnGw1 VPN Gateway is using a Basic SKU Public IP:

If your VPN gateways (even if SKU is Standard or VpnGw1) have a Basic SKU public IP attached, those public IPs are subject to retirement and will need to be migrated to Standard SKU public IPs before the new deadline (January 31, 2026). The migration will require you to use the Azure portal's migration feature or follow a manual process.

During migration, your gateway IP address typically stays the same if you use the Microsoft migration feature. Up to 10 minutes of downtime may occur during the upgrade. useful Microsoft document:

https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

Also see: https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-about

Useful microsoft documentation:

https://free.blessedness.top/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#how-does-the-retirement-of-basic-sku-public-ip-addresses-affect-my-vpn-gateways

https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance

Hope this helps clear things up! Please let us know if you have any other questions.

Thanks,

Pranitha
Muhammad Yousuf 0 Reputation points

2025-09-24T11:21:09.9333333+00:00

Hi Pranitha Maddi,

Thank you for clarification. Another query is how can i migrate these VPN to Standard Public IP because i am trying to migrate it but it gives me an error (Failed to prepare for migration) on preparation step. So please also guide here. Thanks.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-24T12:00:25.18+00:00
Hi Muhammad Yousuf,

Thank you for your follow-up question.

The "Failed to prepare for migration" error during the migration of a Basic SKU public IP to Standard SKU on your VPN Gateway usually means one or more prerequisites are not met.

Here are the exact steps to resolve:

1.Gateway Subnet Size:

Ensure your VPN Gateway subnet contains at least 3 available IP addresses in its current address prefix.

If your subnet mask is /28 or smaller, increase it to /27 or larger by adding prefixes in your virtual network so there are enough free IPs to handle migration resources. Reference: https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

2.Static Public IP:

Verify your Basic SKU public IP is set to static before the migration attempt.

Although Microsoft states IP doesn't change during migration, dynamic IPs may cause failures or issues.

Reference: https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance

3.No Active Linked Resources:

Confirm that no linked ExpressRoute circuits or other network associations blocking migration exist.

Also, ensure there are no manual custom policies applied to the VPN Gateway that could cause preparation failure.

4.Regional Availability:

Migration is still rolling out by region. Check if the migration feature is enabled in your Azure region. Lack of migration option visibility could cause errors.

5.Use Migration Tab in Portal:

In the Azure portal, navigate to your VPN Gateway → Configuration → select Migrate tab.

Click Prepare and wait until preparation succeeds. If the error happens here, most likely one of the above preconditions is not met.

6.Downtime:

Prepare for up to 5-10 minutes of gateway downtime during migration.

Useful Microsoft documents:

https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance

https://free.blessedness.top/en-us/azure/vpn-gateway/vpn-gateway-vpn-faqWhen all prerequisites are met, preparation succeeds, then migration can proceed smoothly.

The migration wizard will create a new Standard SKU public IP resource while keeping the IP address same and then upgrade the gateway SKU accordingly.

Thanks!
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-25T13:59:08.6233333+00:00

Hi Muhammad Yousuf,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

Thanks!
Muhammad Yousuf 0 Reputation points

2025-09-25T15:24:14.71+00:00

Hi Pranitha,
Yes, I have checked and confirmed that our Public IP address is currently set to dynamic. Is there any way to change it to a static IP? I’ve tried but haven’t had any success. Could you please confirm if Microsoft Azure has plans to introduce a feature that allows converting a dynamic IP to static without having to recreate the VPN gateway? Recreating the VPN would involve a significant amount of work on our side.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-25T15:34:20.27+00:00
Hi Muhammad Yousuf,

Thank you for your question.

Currently, Azure does not support converting an existing dynamic public IP address on a VPN Gateway to a static public IP address without recreating the VPN Gateway. The IP configuration is attached at gateway creation and cannot be changed in-place.

Key points based on Microsoft documentation:

Dynamic public IPs assigned to VPN Gateways remain static during the lifetime of the gateway but cannot be switched to static allocation without replacing the public IP resource.

To move from a dynamic Basic SKU public IP to a static Standard SKU public IP, you typically need to create a new Standard SKU public IP resource and then associate it with a new VPN Gateway instance. This recreates the gateway and can cause downtime.

Microsoft is aware of this limitation and offers a migration path, but there is no feature to convert dynamic to static IP allocation on live gateways without redeployment.

The Basic SKU public IPs (which commonly use dynamic allocation) will be retired on September 30, 2025, and it’s recommended to migrate to Standard SKU.

Recommended approach:

Plan a maintenance window to mitigate downtime.

Create a new Standard SKU public IP resource (with static allocation).

Create a new VPN Gateway with the Standard SKU and associate the new static public IP.

Reconfigure your VPN clients or networks to point to the new public IP.

Test the new setup before decommissioning the old gateway.

Use Microsoft documents:

https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

https://free.blessedness.top/en-us/azure/virtual-network/ip-services/configure-public-ip-vpn-gateway

I hope this clarifies the situation

Thank you.
Muhammad Yousuf 0 Reputation points

2025-09-25T15:52:02.2866667+00:00

Thanks for Recommendation :)
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-26T16:22:12.4933333+00:00

Hi Muhammad Yousuf,

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thankyou!
Muhammad Yousuf 0 Reputation points

2025-09-26T18:17:33.5533333+00:00

Hi, we have some concerns will update you on Monday.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-29T17:51:35.22+00:00

Hi Muhammad Yousuf,

Hope you're doing well.

Just checking in to see if there's any update or detail, you’d like to share regarding the concerns you mentioned

Thanks!
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-30T13:31:46.35+00:00

Hi Muhammad Yousuf,

Hope you're doing well.

Following up to see if there's any update or detail, you’d like to share regarding the concerns you mentioned

Thanks!
Muhammad Yousuf 0 Reputation points

2025-10-01T16:06:21.7933333+00:00

Hi Pranitha,

Recreating all Site-to-Site VPN links is not feasible, as many of our applications rely heavily on these connections. We would appreciate guidance on a seamless migration strategy that ensures continuity and minimizes disruption.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-10-03T16:10:28.8466667+00:00

Hi Muhammad Yousuf,

Greetings!

Hope you're doing well.

Microsoft recommends using ExpressRoute or VPN Gateway as part of your migration strategy to Azure. You do not need to recreate all Site-to-Site VPN links if you plan your migration carefully.

Here's the official guidance:

"Use ExpressRoute when you have it. ExpressRoute gives you a private, dedicated connection to Azure that's faster and more secure than internet connections. If you already have ExpressRoute or plan to get it, use this method for all your workloads. Keep in mind that ExpressRoute requires setup time and has data transfer costs. Use VPN if ExpressRoute isn't available. Choose a VPN when you need secure data transfer but don't have ExpressRoute. A VPN creates an encrypted tunnel over the internet to Azure, though it's typically slower than ExpressRoute. Make sure you have a VPN Gateway configured in Azure before starting."

Reference: Plan your migration - Cloud Adoption Framework | Microsoft Learn

This approach ensures continuity of your network connections and minimizes disruption during migration.

Thanks!
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-10-09T08:10:49.6566667+00:00

Hi Muhammad Yousuf,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

Thanks!

3 answers

Your answer

Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-24T09:12:24.9+00:00

Hi Muhammad Yousuf,

Thank you for following up and sharing your concern!

About the new retirement date:

Azure has extended the retirement date for Basic SKU public IP addresses used by VPN Gateways to 31 January 2026 (instead of September 30, 2025 for other resources). This gives you more time to plan your migration and avoid disruption for VPN Gateways configured with Basic SKU public IPs. You can refer to your official notification and documentation for confirmation:

https://free.blessedness.top/en-us/azure/vpn-gateway/whats-new#upcoming-projected-changes

If your Standard or VpnGw1 VPN Gateway is using a Basic SKU Public IP:

If your VPN gateways (even if SKU is Standard or VpnGw1) have a Basic SKU public IP attached, those public IPs are subject to retirement and will need to be migrated to Standard SKU public IPs before the new deadline (January 31, 2026). The migration will require you to use the Azure portal's migration feature or follow a manual process.

During migration, your gateway IP address typically stays the same if you use the Microsoft migration feature. Up to 10 minutes of downtime may occur during the upgrade. useful Microsoft document:

https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

Also see: https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-about

Useful microsoft documentation:

https://free.blessedness.top/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#how-does-the-retirement-of-basic-sku-public-ip-addresses-affect-my-vpn-gateways

https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance

Hope this helps clear things up! Please let us know if you have any other questions.

Thanks,

Pranitha
Muhammad Yousuf 0 Reputation points

2025-09-24T11:21:09.9333333+00:00

Hi Pranitha Maddi,

Thank you for clarification. Another query is how can i migrate these VPN to Standard Public IP because i am trying to migrate it but it gives me an error (Failed to prepare for migration) on preparation step. So please also guide here. Thanks.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-25T13:59:08.6233333+00:00

Hi Muhammad Yousuf,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

Thanks!
Muhammad Yousuf 0 Reputation points

2025-09-25T15:24:14.71+00:00

Hi Pranitha,
Yes, I have checked and confirmed that our Public IP address is currently set to dynamic. Is there any way to change it to a static IP? I’ve tried but haven’t had any success. Could you please confirm if Microsoft Azure has plans to introduce a feature that allows converting a dynamic IP to static without having to recreate the VPN gateway? Recreating the VPN would involve a significant amount of work on our side.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-25T15:34:20.27+00:00

Hi Muhammad Yousuf,

Thank you for your question.

Currently, Azure does not support converting an existing dynamic public IP address on a VPN Gateway to a static public IP address without recreating the VPN Gateway. The IP configuration is attached at gateway creation and cannot be changed in-place.

Key points based on Microsoft documentation:

Dynamic public IPs assigned to VPN Gateways remain static during the lifetime of the gateway but cannot be switched to static allocation without replacing the public IP resource.

To move from a dynamic Basic SKU public IP to a static Standard SKU public IP, you typically need to create a new Standard SKU public IP resource and then associate it with a new VPN Gateway instance. This recreates the gateway and can cause downtime.

Microsoft is aware of this limitation and offers a migration path, but there is no feature to convert dynamic to static IP allocation on live gateways without redeployment.

The Basic SKU public IPs (which commonly use dynamic allocation) will be retired on September 30, 2025, and it’s recommended to migrate to Standard SKU.

Recommended approach:

Plan a maintenance window to mitigate downtime.

Create a new Standard SKU public IP resource (with static allocation).

Create a new VPN Gateway with the Standard SKU and associate the new static public IP.

Reconfigure your VPN clients or networks to point to the new public IP.

Test the new setup before decommissioning the old gateway.

Use Microsoft documents:

https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal

https://free.blessedness.top/en-us/azure/virtual-network/ip-services/configure-public-ip-vpn-gateway

I hope this clarifies the situation

Thank you.
Muhammad Yousuf 0 Reputation points

2025-09-25T15:52:02.2866667+00:00

Thanks for Recommendation :)
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-26T16:22:12.4933333+00:00

Hi Muhammad Yousuf,

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thankyou!
Muhammad Yousuf 0 Reputation points

2025-09-26T18:17:33.5533333+00:00

Hi, we have some concerns will update you on Monday.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-29T17:51:35.22+00:00

Hi Muhammad Yousuf,

Hope you're doing well.

Just checking in to see if there's any update or detail, you’d like to share regarding the concerns you mentioned

Thanks!
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-09-30T13:31:46.35+00:00

Hi Muhammad Yousuf,

Hope you're doing well.

Following up to see if there's any update or detail, you’d like to share regarding the concerns you mentioned

Thanks!
Muhammad Yousuf 0 Reputation points

2025-10-01T16:06:21.7933333+00:00

Hi Pranitha,

Recreating all Site-to-Site VPN links is not feasible, as many of our applications rely heavily on these connections. We would appreciate guidance on a seamless migration strategy that ensures continuity and minimizes disruption.
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-10-03T16:10:28.8466667+00:00

Hi Muhammad Yousuf,

Greetings!

Hope you're doing well.

Microsoft recommends using ExpressRoute or VPN Gateway as part of your migration strategy to Azure. You do not need to recreate all Site-to-Site VPN links if you plan your migration carefully.

Here's the official guidance:

"Use ExpressRoute when you have it. ExpressRoute gives you a private, dedicated connection to Azure that's faster and more secure than internet connections. If you already have ExpressRoute or plan to get it, use this method for all your workloads. Keep in mind that ExpressRoute requires setup time and has data transfer costs. Use VPN if ExpressRoute isn't available. Choose a VPN when you need secure data transfer but don't have ExpressRoute. A VPN creates an encrypted tunnel over the internet to Azure, though it's typically slower than ExpressRoute. Make sure you have a VPN Gateway configured in Azure before starting."

Reference: Plan your migration - Cloud Adoption Framework | Microsoft Learn

This approach ensures continuity of your network connections and minimizes disruption during migration.

Thanks!
Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator

2025-10-09T08:10:49.6566667+00:00

Hi Muhammad Yousuf,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

Thanks!

Answer 1

Hi Muhammad Yousuf,

Thanks for your question on the Microsoft Q&A portal!

As azure is retiring Basic SKU Public IP addresses on September 30, 2025. This means after this date, you will no longer be able to use these Basic IP addresses for new deployments or upgrades.

Your VPN gateways with Basic SKU public IPs are affected by this retirement deadline.
VPN gateways using Standard and VpnGw1 SKUs use Standard SKU public IPs, so they are not affected by this retirement and will continue to work normally.
For VPN gateways with Basic SKU public IPs, Microsoft has extended the retirement timeline to January 31, 2026 to allow you more time to migrate.
Microsoft will provide an automated capability around September/October 2025 to assist in removing Basic public IPs from VPN gateways.
You should plan to migrate any Basic SKU public IPs to Standard SKU public IPs before the retirement to avoid disruptions.

Please refer to these official documents for detailed guidance:

Upgrade Basic Public IP addresses to Standard SKU:https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance
Retirement timeline and migration for Basic VPN Gateway public IPs: https://free.blessedness.top/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal
FAQs about Basic SKU public IP retirement impact on VPN gateways: https://free.blessedness.top/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#how-does-the-retirement-of-basic-sku-public-ip-addresses-affect-my-vpn-gateways

If you use any scripts or templates referencing Basic public IP resources, please update them to use the IP address property of the VPN gateway post migration.

I hope this helps to clarify the issue.

Thanks,

Pranitha

Answer 2

Muhammad Yousuf 0

Hi Pranitha Maddi,

Thank you for your reply, but we also got an email from Azure regarding to VPN gateway as its expiring date is for next year. Could you please assist here?

User's image

Answer 3

Muhammad Yousuf 0

Hi Pranitha Maddi,

Can please make us more clear that if our current VPN gateways are on SKU (Standard and VpnGw1) but Public IP addresses associate to these VPNs are Basic SKU type. So what would be effect in this case?

Share via

Clarification on VPN Gateways and Expiry of Basic Public IP Addresses

3 answers

Your answer