Share via

Migrate Virtual Network Gateway - P2S VPN configuration

Gregor Anton Grinč 171 Reputation points
2023-03-30T18:27:42.7366667+00:00

Hello,

I would like to ask whether it would be possible to migrate Virtual Network Gateway P2S VPN configuration into another Virtual Network Gateway so that end users would not need to set up anything new and could just function like they did until then.

I want to recreate P2S VPN in another subscription with identical root certificates from which client certificates are derived. And I think that if I set up a new Virtual Network Gateway with the same root certificates users would not need to install new client certificates since those that they already have would be generated from the same root. So I guess this would not pose a problem, but if yes please correct me.

However, I think users would need to download new VPN Gateway files and do new setup because otherwise it just would not be possible for them to connect to new Gateway with the same old config files from previously created GW in another subscription. Therefore, am I thinking correctly when I say they would need to download these new files and perform the configuration otherwise they could not connect to new Gateway providing VPN? This would mean there is not one seamless way of migrating users to another Gateway providing P2S VPN.

Thank you

Gregor

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,797 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,775 questions
0 comments
Accepted answer
  1. GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
    2023-03-31T07:00:05.4966667+00:00

    Hello @Gregor Anton Grinč ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you would like to know if it is possible to migrate Virtual Network Gateway P2S VPN configuration into another Virtual Network Gateway so that end users would not need to set up anything new and could just function like they did until then.

    As you rightly mentioned, if you recreate P2S VPN in another subscription with the same root certificates from which the current client certificates are derived, the users won't need to install new client certificates and the existing ones will work.

    However, the VPN client configuration may vary depending upon the new VPN gateway P2S configuration & connected Vnet.

    If you have a Vnet with the same address range as the old one and create a VPN gateway P2S config with the same address pool as the old one:

    Then you just need to edit the VPN server name or address in the existing VPN connection and add the new VPN gateway FQDN.

    In case of native windows VPN client:

    User's image

    In case of Standalone Azure VPN client downloaded from MS Store/App center:

    User's image

    If you have a Vnet with different address range and create a VPN gateway P2S config with the different address pool:

    Then you can update the new VPN routes in the routes.txt file which can be found in the below location:

    C:\Users\UserName\AppData\Roaming\Microsoft\Network\Connections<VirtualNetworkId>\routes.txt

    This file should contain your connected Vnet address range, any peered Vnet address range (if gateway transit/use remote gateway options are enabled in the Vnet peering) and the P2S VPN address pool range.

    However, it is recommended to download the new VPN Gateway files and install the client again to avoid any issues.

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.