VPN Gateway migration from basic to standard failed

Question

VPN Gateway migration from basic to standard failed

Ioan Balint 30

Hi, we were trying to migrate a VPN gateway (VPNGW1) from the basic SKU to the standard one and have used "Migrate to Stadard IP" option under the configuration blade of the VPN Gateway. Although the Preparation stage completed successfully, when performing the actual migration it does not complete but instead just displays the message "An error occurred" with no further details. Even so, the Public IP address of the Gateway seems to have been migrated from basic to standard but we're unable to complete the migration. Could you please let us know where can we find more details about the error and how to rectify it.

Many thanks.

Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-09-24T14:45:16.24+00:00
Hi @Ioan Balint,

Thanks for reaching out on Microsoft Q&A platform.
I understand you're trying to migrate your VPN Gateway (VPNGW1) from the Basic SKU to the Standard SKU using the “Migrate to Standard IP” option in the Azure portal.

According to Microsoft Learn:

“Before you initiate migration for your VPN gateway, verify that your gateway subnet has at least three available IP addresses in your current prefix. If your current gateway subnet is /28 or smaller, the migration tool may error out.”

So could you please check and confirm the below:

Is your gateway subnet at least /27?

Are there 3+ available IPs in that subnet?

If not, resize the subnet before retrying the migration.

Also, please make a note of the below statement Microsoft Q&A:

“The current migration tool only supports VpnGw1–5 (active-passive) gateways. Migration for active-active setups is not yet supported.”

So if your gateway is active-active, the migration will fail.

Could you please check the above steps and let us know if that helps or if you need further assistance on this issue.
Ioan Balint 30 Reputation points

2025-09-24T15:08:50.35+00:00

Thanks for your reply.

Yes, the subnet is at least /27, and yes, there are at least 3+ available IPs in the subnet. These pre-requisites are also checked in the preparation step of the migration tool from what I've seen and this step completed successfully. The gateway is a VpnGw1 SKU at the moment and has the "active-active" mode disabled. It would be good to be able to get more information about what is the actual error encountered in the migration step but this is not being displayed. Can you please let us know how we can continue troubleshooting this issue?
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-09-25T12:00:52.9166667+00:00

Hi @Ioan Balint,

For further troubleshooting, could you please share below details in Private message so we can connect privately over a call to resolve the issue? Also, could you please share your available times for scheduling the Teams call?

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Answer accepted by question author

2 additional answers

Your answer

Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-09-24T14:45:16.24+00:00

Hi @Ioan Balint,

Thanks for reaching out on Microsoft Q&A platform.
I understand you're trying to migrate your VPN Gateway (VPNGW1) from the Basic SKU to the Standard SKU using the “Migrate to Standard IP” option in the Azure portal.

According to Microsoft Learn:

“Before you initiate migration for your VPN gateway, verify that your gateway subnet has at least three available IP addresses in your current prefix. If your current gateway subnet is /28 or smaller, the migration tool may error out.”

So could you please check and confirm the below:

Is your gateway subnet at least /27?

Are there 3+ available IPs in that subnet?

If not, resize the subnet before retrying the migration.

Also, please make a note of the below statement Microsoft Q&A:

“The current migration tool only supports VpnGw1–5 (active-passive) gateways. Migration for active-active setups is not yet supported.”

So if your gateway is active-active, the migration will fail.

Could you please check the above steps and let us know if that helps or if you need further assistance on this issue.
Ioan Balint 30 Reputation points

2025-09-24T15:08:50.35+00:00

Thanks for your reply.

Yes, the subnet is at least /27, and yes, there are at least 3+ available IPs in the subnet. These pre-requisites are also checked in the preparation step of the migration tool from what I've seen and this step completed successfully. The gateway is a VpnGw1 SKU at the moment and has the "active-active" mode disabled. It would be good to be able to get more information about what is the actual error encountered in the migration step but this is not being displayed. Can you please let us know how we can continue troubleshooting this issue?
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-09-25T12:00:52.9166667+00:00

Hi @Ioan Balint,

For further troubleshooting, could you please share below details in Private message so we can connect privately over a call to resolve the issue? Also, could you please share your available times for scheduling the Teams call?

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Answer 1

Thanmayi Godithi 1,635 Microsoft External Staff Moderator

Hi @Ioan Balint,

If you are using Basic SKU VPN Gateway:

Microsoft has confirmed that a new automated migration tool will be available starting October 2025. This tool will take care of moving Basic public IPs to Standard automatically, so you can simply wait for that process if you prefer.

User's image

If you are using Standard / HighPerformance SKU VPN Gateway :

If your VPN Gateway is on the Standard or HighPerformance SKU, again, no action is required from your side. Microsoft will handle the migration automatically in the backend between May and September 2025, and all gateways will be fully migrated before February 28, 2026. Please don't attempt to use migrate in portal at this time.

The process is seamless, and no downtime is expected. You don’t need to run any migration yourself in the portal.

User's image

Reference document link : https://free.blessedness.top/en-us/azure/vpn-gateway/whats-new#upcoming-projected-changes

If you are unable to view your public IP, or if your gateway appears to be in an unusual state, we need to contact backend team for resolution.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Ioan Balint 30 Reputation points

2025-09-26T11:13:45.1+00:00

Thank you for the info. The VPN Gateway we were trying to migrate is VpnGw1, so not the Basic variety. Will the new process take care of the migration even though we have already began it through the migration tool? The issue is that we have tried to abort the migration the other day after it errored out thinking that it might work if we try again and once the abort process completed the existing VPN gateway connections disconnected and stayed like that so we ran the migration tool again which reconnected but errored out again.
Ioan Balint 30 Reputation points

2025-10-06T11:13:37.57+00:00

After this was raised with the Microsoft internal backend team and they have amended things there (not aware of what they changed) the migration has been completed successfully.
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-10-08T09:05:31.0366667+00:00

Hi @Ioan Balint,

Happy that the issue is resolved for you. Could you please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Ioan Balint 30 Reputation points

2025-10-08T09:24:43.2466667+00:00

Hi Thanmay, would it be possible please to post another answer with the actual resolution (the infra backend team had to resolve this after being contacted by you) as none of the above answers are reflecting that, and accepting any of them might mislead others in the community.

Answer 2

Ioan Balint 30

After this was raised with the Microsoft internal backend team and they have amended things there (not aware of what they changed) the migration has been completed successfully.

Answer 3

TP 141.8K Volunteer Moderator

Hi @Ioan Balint

Please confirm that the Public IP address that is associated with your VPN Gateway has been successfully upgraded to Standard SKU.

To do this please navigate to your VPN Gateway in the Azure portal, then on Overview blade click on the Public IP address, similar to below:

User's image

Next on Overview blade of the Public IP address, please verify SKU is Standard, similar to below:

User's image

Please add a comment below with your findings and I will advise further.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Ioan Balint 30 Reputation points

2025-09-25T09:41:25.7766667+00:00

Thanks again. There is no Public IP address listed on the gateway's overview page, instead there are only a couple of parallel horizontal lines (see screenshot below). But the Public IP address that was previously listed there has been upgraded now to the Standard SKU whereas previously it was the Basic SKU. The existing connections with other gateways are also shown as connected and have been tested with traffic between the remote v-nets and confirmed working.
TP 141.8K Reputation points Volunteer Moderator

2025-09-26T12:04:56+00:00

Hi @Ioan Balint, I recommend you create a Technical support request so that backend engineer can fix or confirm you are okay keeping it as-is. To open case yourself via Azure portal you need at least Standard support.

What level support do you have? You can check in portal using below link:

https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/supportPlans

VpnGw1 SKU VPN Gateway will be automatically migrated to VpnGw1AZ SKU between now and September 2026, however, since your VPN Gateway is in strange state I don't know how they will handle it. Perhaps it will be able to migrated without issue, unsure.

I think it is safer to have backend engineer make sure it is okay rather than wait and risk potential downtime.
Ioan Balint 30 Reputation points

2025-09-26T14:16:15.8633333+00:00

Thanks, we only have the developer support plan so unable to create Technical support request - this is why the question was posted here in the first place.
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-09-26T15:14:30.2+00:00

Hi @Ioan Balint,

I will send you an email invite, we can connect offline and guide you.

Thanks

Share via

VPN Gateway migration from basic to standard failed

2 additional answers

Your answer