Share via

Migrate to a Standard SKU public IP address for VPN Gateway - Query

VishalKulkarni-0961 0 Reputation points
2026-06-18T18:13:32.53+00:00

While migrating to standard SKU public IP address for VPN gateway will Vnet and their respective IP will be affected?

Azure Virtual Network
Azure Virtual Network

An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jose Benjamin Solis Nolasco 9,286 Reputation points Volunteer Moderator
    2026-06-18T23:42:07.39+00:00

    Welcome to Microsoft Q&A

    Hello @VishalKulkarni-0961 I hope you are doing well,

    To answer your question directly: No, migrating the VPN Gateway Public IP from Basic to Standard SKU using the native migration process will not alter your Virtual Network (VNet) address space, nor will it affect the private IP addresses assigned to any resources within that VNet.

    Here is the technical breakdown of what actually occurs during the migration:

    VNet and Subnet Integrity: The migration operates strictly on the external networking edge (the Public IP and the VPN Gateway compute instances). Your internal VNet architecture, peering connections, and private IP allocations remain completely untouched.

    Public IP Retention: If you use the official Migrate to Standard IP feature in the Azure Portal or via Azure PowerShell, your existing Public IP address is preserved. Even if your Basic IP was previously allocated dynamically, the migration process automatically locks it in as a Static assignment on the new Standard SKU without changing the actual IP address. This prevents you from having to update your on-premises firewall configurations.

    Gateway SKU Upgrade: As part of the migration, the backend Azure compute instances hosting your VPN Gateway are upgraded to an Availability Zone (AZ) aware SKU (for example, VpnGw1 becomes VpnGw1AZ).

    1. Gateway Subnet Requirement: While the VNet is not negatively affected, you must ensure your GatewaySubnet has enough available IP addresses to facilitate the background instance swap. If your GatewaySubnet is /28 or smaller, you will need to add an additional prefix to it before the migration tool will allow you to proceed.

    The only impact you will observe is a brief 5 to 10-minute tunnel disconnection during the Execute phase of the migration as the IPsec tunnels fail over to the new Standard SKU infrastructure. Key tecnical requirements and impacts https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about

    Key tecnical requirements and impacts

    Item Impact / requirement
    Must have ≥3 available IPs in the prefix for migration validation; if your GatewaySubnet is /28 or smaller, add a prefix or expand to /27 before migrating.
    -------- --------
    Must have ≥3 available IPs in the prefix for migration validation; if your GatewaySubnet is /28 or smaller, add a prefix or expand to /27 before migrating.
    --------
    GatewaySubnet size Must have ≥3 available IPs in the prefix for migration validation; if your GatewaySubnet is /28 or smaller, add a prefix or expand to /27 before migrating.
    Downtime Short interruption during Execute step — typically 5–10 minutes while instances are swapped. Plan maintenance windows.
    IP retention Public IP value preserved; migration locks dynamic Basic IP into a static Standard IP.
    Duration Full migration (prepare → execute → commit) can take up to ~2 hours depending on environment; individual steps have typical durations (prepare ~40m, execute 5–10m, commit ~30m).
    • Verify GatewaySubnet free addresses: confirm at least three free IPs; if not, add an additional prefix or enlarge the subnet.
    • Export current configuration: save gateway and public IP resource JSON and current VPN tunnel configs.
    • Notify stakeholders: schedule a maintenance window for the 5–10 minute interruption.
    • Run portal validation: use the VPN Gateway → Configuration → Migrate workflow; fix any prerequisites flagged by validation.
    • Test post‑migration: validate tunnels, BGP (if used), and connectivity after Commit completes.

    Risks, tradeoffs, and mitigation

    • Risk: insufficient GatewaySubnet IPs will block migration validation. Mitigation: expand subnet or add prefix before starting.
    • Risk: brief tunnel downtime may affect production traffic. Mitigation: schedule during low‑traffic window and have failover/backup plans.
    • Tradeoff: migration may convert gateway to AZ SKU (improves availability) but may change underlying instance topology — validate any downstream automation that depends on exact SKU names.

    If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

    Was this answer helpful?

  2. Venkatesan S 9,565 Reputation points Microsoft External Staff Moderator
    2026-06-18T19:14:22.3633333+00:00

    Hi @VishalKulkarni-0961

    Thanks for reaching out in Microsoft Q&A forum,

    While migrating to standard SKU public IP address for VPN gateway will Vnet and their respective IP will be affected?

    Migrating the VPN Gateway from a Basic SKU Public IP to a Standard SKU Public IP using Microsoft's supported migration process will not affect your Virtual Network (VNet), its address space, subnets, or the private IP addresses assigned to resources within the VNet.

    Key points:

    • The VNet and its configuration remain unchanged.
    • Private IP addresses assigned to resources within the VNet are not affected.
    • The VPN Gateway public IP address is preserved when using the supported migration process.
    • The gateway is upgraded to the corresponding Availability Zone (AZ) SKU as part of the migration.
    • While the migration is designed to minimize impact, a brief connectivity interruption may occur during the operation.

    Using the built-in migration option is the recommended approach, as it allows the existing VPN Gateway public IP address to be retained. In contrast, manually deleting and recreating the VPN Gateway would result in a new public IP address being assigned, requiring updates to any on-premises VPN devices and configurations that reference the gateway's public IP.

    For additional details, please refer to the official Microsoft documentation:
    How to migrate a Basic SKU public IP address to a Standard SKU for VPN Gateway - Azure VPN Gateway | Microsoft Learn

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.