Configure active-active VPN gateways using the portal

This article helps you create highly available active-active VPN gateways using the Resource Manager deployment model and Azure portal. You can also configure an active-active gateway using PowerShell.

To achieve high availability for cross-premises and VNet-to-VNet connectivity, you should deploy multiple VPN gateways and establish multiple parallel connections between your networks and Azure. See Highly Available cross-premises and VNet-to-VNet connectivity for an overview of connectivity options and topology.


The active-active mode is available for all SKUs except Basic or Standard. For more information, see Configuration settings.

The steps in this article help you configure a VPN gateway in active-active mode. There are a few differences between active-active and active-standby modes. The other properties are the same as the non-active-active gateways.

  • Active-active gateways have two Gateway IP configurations and two public IP addresses.
  • Active-active gateways have active-active setting enabled.
  • The virtual network gateway SKU can't be Basic or Standard.

If you already have a VPN gateway, you can Update an existing VPN gateway from active-standby to active-active mode, or from active-active to active-standby mode.

Create a VNet

If you don't already have a VNet that you want to use, create a VNet using the following values:

  • Resource group: TestRG1
  • Name: VNet1
  • Region: (US) East US
  • IPv4 address space:
  • Subnet name: FrontEnd
  • Subnet address space:
  1. Sign in to the Azure portal.

  2. In Search resources, service, and docs (G+/), type virtual network.

    Screenshot shows the Azure portal Search bar.

  3. Select Virtual Network from the Marketplace results.

    Screenshot shows the Azure portal Search bar results and selecting Virtual Network from Marketplace.

  4. On the Virtual Network page, select Create.

    Screenshot shows Virtual Network page and selecting the Create button.

  5. Once you select Create, the Create virtual network page opens.

  6. On the Basics tab, configure Project details and Instance details VNet settings.

    Screenshot shows the Basics tab.

    When you fill in the fields, you see a green check mark when the characters you enter in the field are validated. Some values are autofilled, which you can replace with your own values:

    • Subscription: Verify that the subscription listed is the correct one. You can change subscriptions by using the drop-down.
    • Resource group: Select an existing resource group, or click Create new to create a new one. For more information about resource groups, see Azure Resource Manager overview.
    • Name: Enter the name for your virtual network.
    • Region: Select the location for your VNet. The location determines where the resources that you deploy to this VNet will live.
  7. On the IP Addresses tab, configure the values. The values shown in the examples below are for demonstration purposes. Adjust these values according to the settings that you require.

    Screenshot shows the IP Addresses tab.

    • IPv4 address space: By default, an address space is automatically created. You can click the address space to adjust it to reflect your own values. You can also add additional address spaces.
    • Subnet: If you use the default address space, a default subnet is created automatically. If you change the address space, you need to add a subnet. Select + Add subnet to open the Add subnet window. Configure the following settings and then select Add to add the values:
      • Subnet name: In this example, we named the subnet "FrontEnd".
      • Subnet address range: The address range for this subnet.
  8. On the Security tab, at this time, leave the default values:

    • DDos protection: Disabled
    • Firewall: Disabled
  9. Select Review + create to validate the virtual network settings.

  10. After the settings have been validated, select Create.

Create an active-active VPN gateway

In this step, you create an active-active virtual network gateway (VPN gateway) for your VNet. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU.

Create a virtual network gateway using the following values:

  • Name: VNet1GW
  • Region: East US
  • Gateway type: VPN
  • VPN type: Route-based
  • SKU: VpnGw2
  • Generation: Generation2
  • Virtual network: VNet1
  • Gateway subnet address range:
  • Public IP address: Create new
  • Public IP address name: VNet1GWpip
  1. In Search resources, services, and docs (G+/) type virtual network gateway. Locate Virtual network gateway in the search results and select it.

    Screenshot of Search field.

  2. On the Virtual network gateways page, select + Create. This opens the Create virtual network gateway page.

    Screenshot of virtual network gateways page with Create highlighted.

  3. On the Basics tab, fill in the values for Project details and Instance details.

    Screenshot of Instance fields.

    • Subscription: Select the subscription you want to use from the dropdown.
    • Resource Group: This setting is autofilled when you select your virtual network on this page.
    • Name: Name your gateway. Naming your gateway not the same as naming a gateway subnet. It's the name of the gateway object you are creating.
    • Region: Select the region in which you want to create this resource. The region for the gateway must be the same as the virtual network.
    • Gateway type: Select VPN. VPN gateways use the virtual network gateway type VPN.
    • VPN type: Select the VPN type that is specified for your configuration. Most configurations require a Route-based VPN type.
    • SKU: Select the gateway SKU you want to use from the dropdown. The SKUs listed in the dropdown depend on the VPN type you select. Make sure to select a SKU that supports the features you want to use. For more information about gateway SKUs, see Gateway SKUs.
    • Generation: Select the generation you want to use. For more information, see Gateway SKUs.
    • Virtual network: From the dropdown, select the virtual network to which you want to add this gateway.
    • Gateway subnet address range: This field only appears if your VNet doesn't have a gateway subnet. It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway. We don't recommend creating a range any smaller than /28. If you already have a gateway subnet, you can view GatewaySubnet details by navigating to your virtual network. Click Subnets to view the range. If you want to change the range, you can delete and recreate the GatewaySubnet.
  1. Specify in the values for Public IP address. These settings specify the public IP address object that gets associated to the VPN gateway. The public IP address is dynamically assigned to this object when the VPN gateway is created. For gateways that are not zone-redundant, the only time the Public IP address changes is when the gateway is deleted and re-created. It doesn't change across resizing, resetting, or other internal maintenance/upgrades of your VPN gateway.

    Screenshot of public IP address field.

    • Public IP address: Leave Create new selected.
    • Public IP address name: In the text box, type a name for your public IP address instance.
    • Assignment: VPN gateway supports only Dynamic.
    • Enable active-active mode: Select Enabled.
    • Second Public IP Address: Select Create new.
    • Public IP address name: Name the second Public IP address.
    • Leave Configure BGP as Disabled, unless your configuration specifically requires this setting. If you do require this setting, the default ASN is 65515, although this can be changed.
  2. Select Review + create to run validation.

  3. Once validation passes, select Create to deploy the VPN gateway.

You can see the deployment status on the Overview page for your gateway. After the gateway is created, you can view the IP address that has been assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device.


When working with gateway subnets, avoid associating a network security group (NSG) to the gateway subnet. Associating a network security group to this subnet may cause your virtual network gateway (VPN and Express Route gateways) to stop functioning as expected. For more information about network security groups, see What is a network security group?.

Update an existing VPN gateway

This section helps you change an existing Azure VPN gateway from active-standby to active-active mode, and from active-active to active-standby mode. When you change an active-standby gateway to active-active, you create another public IP address, then add a second gateway IP configuration.

Change active-standby to active-active

Use the following steps to convert active-standby mode gateway to active-active mode. If your gateway was created using the Resource Manager deployment model, you can also upgrade the SKU on this page.

  1. Navigate to the page for your virtual network gateway.

  2. On the left menu, select Configuration.

  3. On the Configuration page, configure the following settings:

    • Change the Active-active mode to Enabled.
    • Click Create another gateway IP configuration.

    Screenshot shows the Configuration page.

  4. On the Choose public IP address page and either specify an existing public IP address that meets the criteria, or select +Create new to create a new public IP address to use for the second VPN gateway instance.

  5. On the Create public IP address page, select the Basic SKU, then click OK.

  6. At the top of the Configuration page, click Save. This update can take about 30-45 minutes to complete.

Change active-active to active-standby

Use the following steps to convert active-active mode gateway to active-standby mode.

  1. Navigate to the page for your virtual network gateway.

  2. On the left menu, select Configuration.

  3. On the Configuration page, change the Active-active mode to Disabled.

  4. At the top of the Configuration page, click Save.

Next steps

To configure connections, see the following articles: