Share via

VPN Gateway stuck in Updating state after failed prepareMigration to Standard IP - need backend KVS unlock

Mike Sexton 0 Reputation points
2026-06-05T21:28:32.8033333+00:00

Hi @Ravi Varma Mudduluru — I'm experiencing the same issue described in this thread: https://learn.microsoft.com/en-us/answers/questions/5566797/troubleshooting-vpn-gateway-migration-error-to-sta

Our VPN Gateway has been stuck in "Updating" state for over an hour after a failed Prepare Migrate operation on June 5, 2026. Error returned: "Failed to prepare for migration to Standard IP Based Deployment. Error: error."

Details: VpnGw1, Active-Passive, no BGP, GatewaySubnet /24, East US. This gateway supports a critical WatchGuard Site-to-Site VPN tunnel connecting our office to Azure. The tunnel is currently up but the gateway is locked and we cannot proceed with the migration. We are on the Developer support plan. Based on your previous response, it appears this requires a backend KVS fix. Can you open a case on our behalf or advise next steps?

Azure VPN Gateway
Azure VPN Gateway

An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-05T21:28:53.2866667+00:00

    This issue can't be fixed directly from the portal and requires Azure Support to intervene.

    Next steps:

    1. Open an Azure support request
      • Use the Azure portal to create a support ticket for Azure VPN Gateway.
      • Since the subscription already has a Developer support plan, create a technical support case and clearly state:
        • VPN Gateway is stuck in Updating after a failed Prepare step for Basic → Standard public IP migration.
        • SKU (VpnGw1), region (East US), GatewaySubnet size (/24), and that the gateway is currently serving a critical site-to-site tunnel.
        • Date/time of the failed prepareMigration operation.
      • Ask explicitly for backend remediation/unlock of the gateway resource so that migration can be retried.
    2. Use self-help and troubleshooting content only for connectivity issues
      • Since the tunnel is still up, avoid disruptive actions like deleting/recreating the gateway until Support confirms it is safe.
      • If the tunnel later drops, follow the site-to-site troubleshooting guidance, starting with a gateway reset and tunnel reset on the on-premises device, as described in the site-to-site troubleshooting article.
    3. Be aware of automatic migration behavior
      • If automatic migration after June 2026 encounters constraints (for example, subnet issues), the backend migration cannot complete and manual intervention is required. In such cases, Azure Support must guide the required changes and/or perform backend fixes.
    4. If self-help and Q&A are insufficient
      • Use Microsoft Q&A for additional community guidance, but for a stuck Updating state and KVS/backend issues, the only resolution path is via an Azure support request in the portal.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.