Skip to content
cccskills
FreePublished on GitHub

azure-vpn-gateway

Expert knowledge for Azure VPN Gateway development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring S2S/P2S tunnels, BGP/NAT, IPsec/IKE crypto, VPN client auth, or cross-cloud/ExpressRoute VPNs, and other Azure VPN Gateway related development tasks. Not for Azure Virtual Network (use azure-virtual-network), Azure Virtual WAN (use azure-virtual-wan), Azure ExpressRoute (use azure-expressroute), Azure Application Gateway (use azure-application-gateway).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills
Works withAWSAzure
See how to install

Files included (1)

  • SKILL.md16.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Azure VPN Gateway Skill

This skill provides expert guidance for Azure VPN Gateway. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

CategoryLinesDescription
TroubleshootingL37-L43Diagnosing and fixing Azure VPN Gateway issues: client prerequisites, packet captures, tunnel resets, connection health checks, and answers to common troubleshooting FAQs.
Best PracticesL44-L48Guidance on using network virtual appliances (NVAs) in Azure as VPN endpoints for remote access, including design, routing, security, and integration with Azure VPN Gateway.
Decision MakingL49-L58Guidance on choosing VPN Gateway SKUs and planning migrations: Linux VPN client, P2S protocols (SSTP to IKEv2/OpenVPN), client types, and Classic-to-Resource Manager gateways.
Architecture & Design PatternsL59-L65Designing Azure VPN Gateway architectures: choosing topologies, active-active setups, cross-region peering, and high-availability connectivity patterns.
Limits & QuotasL66-L70VPN Gateway client version history, SKU comparisons, and FAQs about gateway limits, scale, performance, and connection behavior
SecurityL71-L87Securing Azure VPN Gateway: IPsec/IKE crypto, forced tunneling, P2S auth (Entra ID, RADIUS, MFA, Device SSO), access control, cert migration, roles/permissions, and security best practices.
ConfigurationL88-L137Configuring Azure VPN Gateway and clients for P2S/S2S: auth methods, certificates, IPsec/BGP/NAT policies, routing, monitoring, Always-On, VNet-to-VNet, and device/Entra/Intune setup.
Integrations & Coding PatternsL138-L145Configuring Azure VPN with external systems: NPS/RADIUS user groups, S2S certificate tunnels, VPN over ExpressRoute, Cisco ASA setups, and BGP connections with AWS.
DeploymentL146-L155Deploying and upgrading Azure VPN Gateways (SKUs, zones, active/active), creating S2S VPNs via PowerShell/CLI, and distributing Azure VPN client profiles with Intune.

Troubleshooting

TopicURL
Use packet capture on VPN Gateway for diagnosticshttps://learn.microsoft.com/en-us/azure/vpn-gateway/packet-capture
Reset VPN Gateway or connection to restore IPsec tunnelshttps://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway
Verify Azure VPN Gateway connection healthhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-verify-connection-resource-manager

Best Practices

TopicURL
Use NVAs in Azure for remote access scenarioshttps://learn.microsoft.com/en-us/azure/vpn-gateway/nva-work-remotely-support

Decision Making

TopicURL
Select appropriate Azure VPN Gateway SKUhttps://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus
Plan migration from Azure VPN Client for Linuxhttps://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-linux-retirement
Map and migrate Azure VPN Gateway SKUshttps://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation
Migrate Azure P2S VPN from SSTP to IKEv2/OpenVPNhttps://learn.microsoft.com/en-us/azure/vpn-gateway/ikev2-openvpn-from-sstp
Migrate P2S VPN from manual to Microsoft-registered clienthttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway-update
Migrate VPN Gateways from Classic to Resource Managerhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-classic-resource-manager-migration

Architecture & Design Patterns

TopicURL
Design and configure active-active Azure VPN gatewayshttps://learn.microsoft.com/en-us/azure/vpn-gateway/about-active-active-gateways
Use cross-region VPN/ExpressRoute gateways via peeringhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-different-region
Design highly available Azure VPN Gateway connectivityhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

Limits & Quotas

TopicURL
Compare Azure VPN Gateway legacy SKUs and limitshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-skus-legacy

Security

TopicURL
Implement forced tunneling for S2S VPN connectionshttps://learn.microsoft.com/en-us/azure/vpn-gateway/about-site-to-site-tunneling
Configure custom IPsec/IKE policies in Azure portalhttps://learn.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto
Enable multifactor authentication for P2S VPN usershttps://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
Configure P2S VPN with Entra ID and manual client apphttps://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant
View and disconnect Azure P2S VPN sessions securelyhttps://learn.microsoft.com/en-us/azure/vpn-gateway/p2s-session-management
Create custom audience app ID for P2S Entra VPNhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-register-custom-app
Configure P2S access control by Entra users and groupshttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-users-access
Enable Device SSO for Azure VPN Client with Entra IDhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-windows-device-sso
Set up P2S RADIUS VPN with PowerShell for Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-radius-ps
Understand roles and permissions for VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/roles-permissions
Apply security best practices to Azure VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/secure-vpn-gateway
Configure cryptographic settings for Azure VPN gatewayshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto
Integrate Azure P2S RADIUS with NPS for MFAhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-radius-mfa-nsp

Configuration

TopicURL
Generate P2S VPN client profiles for Entra authenticationhttps://learn.microsoft.com/en-us/azure/vpn-gateway/about-vpn-profile-download
Add or remove S2S connections on a VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/add-remove-site-to-site-connections
Configure optional Azure VPN Client settings for P2Shttps://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations
Configure BGP settings for Azure VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/configure-bgp
Create custom IPsec policies for P2S VPNhttps://learn.microsoft.com/en-us/azure/vpn-gateway/create-custom-policies-p2s-ps
Configure custom traffic selectors for VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/custom-traffic-selectors
Configure customer-controlled maintenance windows for VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/customer-controlled-gateway-maintenance
Reconfigure Azure VPN gateways for active-active modehttps://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-change-active-active
Configure monitoring for Azure VPN Gateway with Azure Monitorhttps://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway
Reference monitoring metrics for Azure VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/monitor-vpn-gateway-reference
Configure NAT rules on Azure VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/nat-howto
Manage Azure VPN Gateway root certificate migrationhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about-gateway-certificate-migration
Configure P2S certificate authentication on VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificate-gateway
Generate P2S VPN certificates on Linux with OpenSSLhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificates-linux-openssl
Configure P2S VPN gateway with Entra ID clienthttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway
Configure Azure VPN Client with Entra ID for P2Shttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client
Install client certificates for Azure P2S VPNhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert
Configure Azure VPN Gateway for P2S RADIUS authhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-radius-gateway
Configure P2S VPN user groups and IP poolshttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-about
Configure P2S VPN user IP pools with Azure CLIhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-cli
Generate and update P2S VPN client profiles in Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-vpn-profile-update
Configure P2S VPN clients with certificate authhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-certificate
Configure VPN clients for P2S RADIUS authenticationhttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-radius
Configure certificate-authenticated site-to-site VPN gatewayshttps://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway
Configure high-bandwidth S2S tunnels via ExpressRoutehttps://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-high-bandwidth-tunnel
Configure forced tunneling for S2S VPN in Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-tunneling
Understand Point-to-Site VPN routing behavior in Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing
Supported VPN devices and IPsec parameters for Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices
Azure VPN Gateway resource and connection settingshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings
Generate P2S VPN certificates using Windows PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
Generate P2S VPN certificates on Linux strongSwanhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site-linux
Generate P2S VPN certificates using MakeCerthttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site-makecert
Connect classic VNets to ARM VNets via VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-different-deployment-models-portal
Connect classic VNets to ARM VNets with PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-different-deployment-models-powershell
Configure route-based VPN to multiple policy-based deviceshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
Set up Always-On device VPN tunnel to Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel
Configure macOS Always-On VPN device tunnel to Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel-macos
Configure Always-On user VPN tunnel for Azurehttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-always-on-user-tunnel
Configure certificate-based Point-to-Site VPN with PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps
Configure VNet-to-VNet VPN connections using Azure CLIhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-cli
Configure VNet-to-VNet VPN connection in portalhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal
Configure custom IPsec/IKE policies with PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell
Advertise custom routes to P2S VPN clientshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes
Create VNet-to-VNet VPN connections with PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vnet-vnet-rm-ps
Configure and troubleshoot Azure VPN Gateway connectionshttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq
Create Intune custom profile for Azure VPN clienthttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-profile-intune

Integrations & Coding Patterns

TopicURL
Configure NPS RADIUS VSAs for P2S user groupshttps://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-radius
Configure S2S VPN over ExpressRoute private peeringhttps://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering
Sample Cisco ASA configuration for Azure VPN Gatewayhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-3rdparty-device-config-cisco-asa
Configure BGP VPN connection between Azure and AWShttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp

Deployment

TopicURL
Migrate VPN Gateway Basic public IP to Standardhttps://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about
Migrate VPN Gateway public IP from Basic to Standardhttps://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto
Create a Basic SKU VPN Gateway via PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/create-gateway-basic-sku-powershell
Deploy zone-redundant VPN and ExpressRoute gatewayshttps://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway
Upgrade Azure VPN Gateway SKU with minimal downtimehttps://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade
Create S2S VPN with shared key using PowerShellhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell
Create S2S VPN with shared key using Azure CLIhttps://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-cli

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

azure-active-directory-b2c

Free

Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when building B2C user flows/custom policies, configuring IdPs/MFA, securing APIs, automating CI/CD, or monitoring with Sentinel, and other Azure Active Directory B2C related development tasks. Not for Azure Role-based access control (use azure-rbac), Azure Information Protection (use azure-information-protection), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

azure-advisor

Free

Expert knowledge for Azure Advisor development including best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. Use when managing Advisor alerts, digests, recommendation states, Resource Graph queries, or RBAC access, and other Azure Advisor related development tasks. Not for Cost Management (use azure-cost-management), Azure Monitor (use azure-monitor), Azure Policy (use azure-policy), Azure Security (use azure-security).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

azure-ai-vision

Free

Expert knowledge for Azure AI Vision development including decision making, limits & quotas, configuration, integrations & coding patterns, and deployment. Use when using Image Analysis, Read OCR containers, smart-crop thumbnails, background removal, or video frame analysis, and other Azure AI Vision related development tasks. Not for Azure AI Custom Vision (use azure-custom-vision), Azure AI Video Indexer (use azure-video-indexer), Azure AI Document Intelligence (use azure-document-intelligence), Azure AI Immersive Reader (use azure-immersive-reader).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

azure-aks-edge-essentials

Free

Expert knowledge for Azure Kubernetes Service Edge Essentials development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying AKS Edge/Hybrid with Arc, Azure Local, GitOps, IoT/OPC/ONVIF, or Key Vault-integrated workloads, and other Azure Kubernetes Service Edge Essentials related development tasks. Not for Azure Kubernetes Service (AKS) (use azure-kubernetes-service), Azure IoT Edge (use azure-iot-edge), Azure Stack Edge (use azure-stack-edge), Azure Container Apps (use azure-container-apps).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

azure-analysis-services

Free

Expert knowledge for Azure Analysis Services development including troubleshooting. Use when resolving server connectivity, firewall/VNet, DNS, client connection, or network error issues, and other Azure Analysis Services related development tasks. Not for Azure Synapse Analytics (use azure-synapse-analytics), Azure SQL Database (use azure-sql-database), Azure SQL Managed Instance (use azure-sql-managed-instance), SQL Server on Azure Virtual Machines (use azure-sql-virtual-machines).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

azure-anyscale-on-azure

Free

Expert knowledge for Azure Anyscale On Azure development including limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when registering AKS as Anyscale clouds, wiring ACR images, enabling Private Link/RBAC, ARM-based deployments, or region checks, and other Azure Anyscale On Azure related development tasks. Not for Azure Databricks (use azure-databricks), Azure Kubernetes Service (AKS) (use azure-kubernetes-service), Azure Machine Learning (use azure-machine-learning), Azure HDInsight (use azure-hdinsight).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills787Updated Oct 19, 2026

See all skills by MicrosoftDocs

Report a problem with this skill