VPN Gateway and ExpressRoute — gateway SKUs and retirements, GatewaySubnet, active-active and BGP, IKE error codes, circuit states and gateway migration errors
Connecting a VNet to on-premises — VPN Gateway SKUs (AZ SKUs only for new gateways; non-AZ VpnGw1-5 retired after September 30, 2026; legacy Standard and HighPerformance retired; Basic public IPs gone), ExpressRoute gateway SKUs and the migration experience, GatewaySubnet sizing, active-active and BGP rules, the site-to-site IKE error codes with fixes, ExpressRoute circuit and provider states, and gateway migration errors.
markdownreferencev1929A-WHFMstage: operatetrust: officialservice: networkinginterface: cliinterface: portalVPN GatewayVpnGw1AZVpnGw2AZnon-AZ VPN gateway SKU retirementStandard HighPerformance VPN gateway legacy SKUBasic VPN gateway SKUDelete Basic Public Ip ReferenceGatewaySubnet /27active-active VPN gatewayBGP ASN 65515 reservedAPIPA BGPsite-to-site VPN error codesNegotiation timed out 13805IKE authentication credentials are unacceptable 13801Policy match error 13868No policy configured 13825Traffic selectors unacceptable 13999The remote computer refused the network connection 1225IKEDiagnosticLogconnectionStatus NotConnectedExpressRoute gatewayErGw1AzErGwScaleFastPathExpressRoute gateway migrationCircuit status EnabledProvider status ProvisionedServiceProviderProvisioningState NotProvisionedVirtual network doesn't have sufficient space for deploying another gatewaylegacy connection mode ExpressRouteVPN ExpressRoute coexistence
VPN Gateway and ExpressRoute
Gateways and their SKUs
- Both gateway types live in a subnet named exactly
GatewaySubnet, /27 or larger (more for VPN and ExpressRoute coexistence or migrations), with nothing else in it. Don't put an NSG that blocks UDP 500/4500 or a UDR that blackholes the on-premises peer on it. - VPN Gateway: since November 1, 2025 new gateways must use an AZ SKU (
VpnGw1AZ–VpnGw5AZ) with a Standard public IP. Non-AZVpnGw1–VpnGw5were scheduled for deprecation after September 30, 2026: check withaz network vnet-gateway show -g <rg> -n <gw> --query sku.nameand upgrade any name withoutAZ(no downtime expected). Legacy Standard / HighPerformance SKUs are retired (Microsoft's pages give both September 30, 2025 and June 2026). Basic is dev/test only: no IPv6, no RADIUS, CLI or PowerShell only; a Basic gateway with a Basic public IP needs only "Delete Basic Public Ip Reference" (the address stays). Standard-IP gateways move to Generation 2 automatically. - ExpressRoute gateway:
ErGw1Az/ErGw2Az/ErGw3Azor the scalableErGwScale; FastPath needsErGw3Az,UltraPerformanceorErGwScalewith 10+ scale units. Move a Standard, HighPerformance or UltraPerformance gateway to an AZ SKU with the gateway migration experience (a second gateway is created in the same subnet); other SKU changes may mean delete and recreate, with downtime. Microsoft manages the gateway's public IP.
VPN design rules
- Active-active gives each gateway instance its own public IP and tunnel; configure the on-premises device for both tunnels. Converting an existing gateway that uses non-APIPA BGP peer addresses causes downtime.
- BGP: the on-premises ASN must differ from the gateway's; Azure reserves 8074, 8075, 12076, 65515 and 65517–65520. The local network gateway carries the on-premises BGP peer IP; Azure adds its /32 route itself.
- Point-to-site: the Azure VPN Client for Linux (preview) retired on August 31, 2026.
Site-to-site errors
Read the reason first: az network vpn-connection show -g <rg> -n <conn> --query "{status:connectionStatus, egress:egressBytesTransferred, ingress:ingressBytesTransferred}", then the gateway's IKEDiagnosticLog in Log Analytics (add a diagnostic setting with allLogs if none exists, then retry the connection).
| IKE error (code) | Cause → fix |
|---|---|
Negotiation timed out (13805) | The on-premises device isn't answering IKE: check its public IP on the local network gateway (the external address if it's behind NAT), UDP 500/4500 reachability, and that the device is supported |
IKE authentication credentials are unacceptable (13801) | Pre-shared key mismatch: set the same key on the connection and the device |
Policy match error (13868) / No policy configured (13825) | IKE/IPsec policy (or PFS) mismatch: align the custom policy on the connection with the device |
Traffic selectors unacceptable (13999) | Address ranges differ: match the local network gateway prefixes and the device's selectors, or use usePolicyBasedTrafficSelectors for policy-based devices |
Invalid header (13824) / Invalid payload received (13843) / Invalid cookie received (13846) | Unsupported IKE messages from the device: use a validated device and configuration |
The recipient cannot handle version of IKE specified in the header (13880) | IKEv1 on one side, IKEv2 on the other |
Failure in Diffie-Hellman computation (13822) | DH group mismatch |
The remote computer refused the network connection (1225) | The Azure connection is Initiator only: set connection mode to Default or Responder only |
Connected but 0 bytes | Traffic selector or subnet mismatch, or routing on either side |
BGP peer not Connected | ASN or peer IP mismatch, BGP not enabled on the connection, or a reserved ASN |
ExpressRoute
- A circuit works only when Circuit status is Enabled (Microsoft side) and Provider status is Provisioned (
serviceProviderProvisioningState). Stuck at Not enabled: Microsoft support. Stuck at Not provisioned: your connectivity provider. - Gateway migration errors:
| Message | Fix |
|---|---|
Virtual network {vnetName} doesn't have sufficient space for deploying another gateway. | Recreate GatewaySubnet as /27 or larger |
| Connections created before 2017 (legacy mode) | Delete and recreate the connections first |
| Gateway or a connected resource in a failed state | Bring everything to Succeeded (a GET then SET on the resource) |
| Default-SKU gateway | Resize to Standard before migrating |
| FastPath or route weight changed during migration | Not allowed: keep the original values |
…already contains the maximum number of allowed gateways. | A VNet holds at most two ExpressRoute gateways |
| A dedicated HSM in the VNet | Deallocate it before migrating |