Azure VPN (basic) P2S won't connect using IKEv2

Question

Azure VPN (basic) P2S won't connect using IKEv2

Adam-2452 20

I have an Azure VPN (Basic SKU) that has been working fine using SSTP for Point-to-site connections. I tried following the steps in migrate your VPN gateway (Option 1) to migrate to IKEv2. However, the new VPN client never connects - it just sits at "Verifying the password" and counts seconds forever (or "Connecting to ..." if I use the powershell client installer). If I re-install the old client, it connects just fine again using SSTP (NOTE: this is with no other change to the Virtual network gateway itself). I've tried disabling the Firewall on my Windows machine and on my router, but no change.

0 comments

Answer accepted by question author

Marco Brouwer 80

@Adam-2452 @Jose Benjamin Solis Nolasco

I’m seeing the exact same issue on a Basic SKU gateway.

The generated *.vpn.azure.com hostname resolves to a different public IP than the public IP assigned to my VPN Gateway. Wireshark shows repeated IKE_SA_INIT requests to the hostname-resolved IP, but no response at all.

When I test against the actual public IP assigned to the VPN Gateway, I immediately get IKE_SA_INIT and IKE_AUTH responses.

As a workaround, I added a hosts-file entry that maps the original Azure VPN hostname to the actual public IP of the VPN Gateway. This is important because the VPN client still needs to connect using the Azure DNS name rather than directly using the IP address.

With that hosts-file override in place, the P2S IKEv2 VPN connects successfully.

So for now this appears to be a working workaround. It also strongly suggests that the Basic SKU IKEv2 configuration itself is functioning, but the Azure-generated P2S hostname is being mapped to the wrong or non-responsive backend endpoint.

Jose Benjamin Solis Nolasco 12,691 Reputation points Volunteer Moderator

2026-09-23T00:51:39.9533333+00:00

Thanks for sharing this information to our comunity, I will try to reproduce this on my lab is kinda wierd issue sounds like a DNS for me.
Adam-2452 20 Reputation points

2026-09-24T19:45:25.0933333+00:00

@Marco Brouwer

Added the hosts file record and everything works perfectly! Commented out the record just to verify that the connection still spins - it does. Also, for anybody else looking at this later, no firewall shenanigans were needed.

I find it very weird that we're required to have a public IP address, then Azure generates a random domain name that doesn't point it...

Thank you for the workaround!
Marco Brouwer 80 Reputation points

2026-09-24T19:50:44.5366667+00:00

@Adam-2452 @Jose Benjamin Solis Nolasco
Great to hear it works for you too! So it seems normally some backend gateway is in the middle, and it does not listen on IkeV2 ports. My circumverting it via the hosts file directly to the VPN gw it works.

@Jose I think this really is a problem. Maybe escalate this internally and have MS fix it? Also the documentation MS has it not right. IkeV2 is supported since november 2025, but the VPN gateway overview page says it doesn't.

1 additional answer

Your answer

Jose Benjamin Solis Nolasco 12,691 Reputation points Volunteer Moderator

2026-09-23T00:51:39.9533333+00:00

Thanks for sharing this information to our comunity, I will try to reproduce this on my lab is kinda wierd issue sounds like a DNS for me.
Adam-2452 20 Reputation points

2026-09-24T19:45:25.0933333+00:00

@Marco Brouwer

Added the hosts file record and everything works perfectly! Commented out the record just to verify that the connection still spins - it does. Also, for anybody else looking at this later, no firewall shenanigans were needed.

I find it very weird that we're required to have a public IP address, then Azure generates a random domain name that doesn't point it...

Thank you for the workaround!
Marco Brouwer 80 Reputation points

2026-09-24T19:50:44.5366667+00:00

@Adam-2452 @Jose Benjamin Solis Nolasco
Great to hear it works for you too! So it seems normally some backend gateway is in the middle, and it does not listen on IkeV2 ports. My circumverting it via the hosts file directly to the VPN gw it works.

@Jose I think this really is a problem. Maybe escalate this internally and have MS fix it? Also the documentation MS has it not right. IkeV2 is supported since november 2025, but the VPN gateway overview page says it doesn't.

Answer 1

Welcome to Microsoft Q&A!

Hello @Adam-2452 I hope you are doing well,

The issue occurs because the Basic SKU has platform limitations and does not support IKEv2 or RADIUS for Point-to-Site connections. On the Basic SKU, Point-to-Site connections are strictly limited to SSTP.

Because the gateway itself remained on the Basic SKU, it is only listening for SSTP on TCP port 443. The IKEv2 client tries to negotiate over UDP ports 500 and 4500, but the gateway ignores the handshake, leaving the client hanging indefinitely at "Verifying the password."

Deploy a VpnGw1 (or VpnGw1AZ) SKU: Azure does not allow an in-place upgrade from Basic to production SKUs via the dropdown. You must delete the Basic gateway and recreate it as VpnGw1 (or VpnGw1AZ) with a Standard SKU Public IP.

Enable IKEv2: On the new gateway, go to Point-to-site configuration, set Tunnel type to IKEv2 and SSTP (SSL) (or IKEv2), and click Save.

Download the updated client: Click Download VPN client, install the new package on your machine, and the IKEv2 connection will establish normally.

References:

About Azure Point-to-Site VPN connections - Microsoft Learn

About gateway SKUs - Microsoft Learn

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Adam-2452 20 Reputation points

2026-09-10T18:06:25.4166667+00:00

@Jose Benjamin Solis Nolasco Thanks for your reply!

The only reason I bothered trying to make any change is because there was a large banner informing me that SSTP was being retired (as described in the link in my question). However, it does appear that you're correct that the gateway side simply won't work with IKEv2, despite the number of documentation pages saying it's available since November 2025 and providing explicit instructions of how to implement it, all of the options being available, and lots of warnings instructing that it must be done within the next few months.

I do not consider "upgrading" from Basic to a production SKU at 5-6 times the cost for performance improvements I will never think about utilizing as a reasonable solution.