Error when upgrading Virtual Network Gateway's public IP from Basic SKU to Standard

Question

Error when upgrading Virtual Network Gateway's public IP from Basic SKU to Standard

Matthew Lam 40

Hi,

Basic Public IP is retiring in Sep 2025, so I tried to upgrade our Basic Public IPs. One of them belongs to a Virtual Network Gatway, so I tried to follow https://learn.microsoft.com/en-gb/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal#migrate to upgrade the Public IP in Azure Portal. The validation is shown as passed, so I pressed the 'Prepare' button to start the migration. However, the migration is aborted and there is no concrete error message explaining what went wrong. I tried 'Prepare' and 'Abort' for few more times and it did not work. I also checked that the gateway subnet is already '/27' as suggested in the documentation. I also tried running via PowerShell.

$ Invoke-AzVirtualNetworkGatewayPrepareMigration -InputObject $gateway -MigrationParameter $migrationParams
Invoke-AzVirtualNetworkGatewayPrepareMigration: Current Virtual network gateway migration state is Abort, it can not continue with migration state:Prepare
StatusCode: 400
ReasonPhrase:
ErrorCode: CannotContinueMigrateGatewayWithIncorrectState
ErrorMessage: Current Virtual network gateway migration state is Abort, it can not continue with migration state:Prepare
OperationID : 

$ Invoke-AzVirtualNetworkGatewayAbortMigration -InputObject $gateway
Invoke-AzVirtualNetworkGatewayAbortMigration: Long running operation failed with status 'Failed'. Additional Info:'An error occurred.'
StatusCode: 200
ReasonPhrase:
Status: Failed
ErrorCode: InternalServerError
ErrorMessage: An error occurred.

How can I deal with it?

The Virtual Network Gateway

SKU: Standard
Gateway type: VPN
VPN type: Route-based
Public IP SKU: Basic

Thank you!

0 comments

Answer accepted by question author

TP 157.5K Volunteer Moderator

Hi,

According to current timeline documentation there is no action needed. Your Standard SKU VPN Gateway will be automatically migrated before September 30, 2025 with no downtime expected.

Please see excerpt from documentation below:

Migrate a gateway SKU Your legacy gateway will be migrated seamlessly from backend without any connectivity impact before September 30, 2025. This is different from the initial approach of providing a migration path.

Excerpt from timeline below:

Event	Customer impact	Anticipated timelines	Customer action/Prerequisites	Documentation	Announcement links
Gateway SKU retirement: Standard and High Performance SKUs.	- New Standard/High Perf SKU gateway creations blocked Nov 2023. - Standard/High Perf SKU gateways will be migrated to VpnGw1/VpnGw2 on non-AZ regions and to VpnGw1AZ/VpnAz2 on AZ regions. - No downtime is expected for migration.	- May 2025 to Sep 2025: Standard/HighPerf SKU migration. - Sep 2025: Standard/HighPerf SKU retirement.	- No action required	Working with VPN Gateway legacy SKUs	Standard and HighPerf gateway SKU retirement

After automatic migration please verify the IP SKU. The deadline for Basic SKU Public IP when used with VPN Gateway is end of January 2026, so if for some reason IP SKU isn't updated immediately there is still plenty of time.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Anonymous

2025-09-15T03:06:32.1+00:00

Hi Matthew Lam,

I hope TP’s answer was helpful to you. If there's anything you're still unsure about, please feel free to let us know, we're happy to help further.

If the solution worked for you, don’t forget to "Accept the Answer" doing so helps others in the community who may have the same question.

Thanks!

Harish.
Matthew Lam 40 Reputation points

2025-09-15T03:29:17.48+00:00

Hi,

Thank you for answering my question. However, I am still confused with the timeline and it would be great you can clarify.

If the Virtual Network Gateway will upgrade automatically without downtime, will the Basic Public IP be upgraded automatically as well?
TP 157.5K Reputation points Volunteer Moderator

2025-09-15T10:05:38.6766667+00:00

If the Virtual Network Gateway will upgrade automatically without downtime, will the Basic Public IP be upgraded automatically as well?

It's unclear. Let me explain. If it is automatically migrated to VpnGw1AZ SKU by September 30 then the IP would be automatically upgraded to Standard. If it is migrated to VpnGw1 SKU as an intermediary step then you may need to use portal to remove Basic SKU.

See this excerpt from FAQ:

Will my IP address change when my Legacy VPN gateway SKU (Standard or HighPerformance) is migrated to a Non-AZ SKU (VpnGw1 or VpnGw2)?

No, the IP address will not change when the Legacy SKU is migrated to a Non-AZ SKU. After SKU migration, you can choose to migrate the Basic SKU IP address to Standard SKU IP address through a customer controlled portal experience. For more information about Basic SKU IP migration, see About migrating a Basic SKU public IP address to Standard SKU for VPN Gateway article.

Leaving it on Basic SKU temporarily is okay since the deadline isn't until end of January 2026.

The deadlines, procedures, etc., related to VPN Gateway keep getting pushed back, modified/changed repeatedly. Originally, customers were going to have the ability to migrate from Standard to new SKU themselves, and if that had happened they would've used portal experience to update IP from Basic to Standard.

Then it changed to the migration being handled automatically, with no action needed by customer.

The above is why I asked you to check your IP's SKU after automatic migration has completed. It is possible that they will provide updated guidance for you to use portal to remove Basic SKU Public IP and/or they may want you to "do nothing" and wait for them to migrate you over to AZ SKU.
Anonymous

2025-09-17T02:42:51.95+00:00

Hi Matthew Lam,

i hope the above response by TP was helpful to you, if not please do us know if you have any questions on this?

Thanks,

Harish.

1 additional answer

Your answer

Anonymous

2025-09-15T03:06:32.1+00:00

Hi Matthew Lam,

I hope TP’s answer was helpful to you. If there's anything you're still unsure about, please feel free to let us know, we're happy to help further.

If the solution worked for you, don’t forget to "Accept the Answer" doing so helps others in the community who may have the same question.

Thanks!

Harish.
Matthew Lam 40 Reputation points

2025-09-15T03:29:17.48+00:00

Hi,

Thank you for answering my question. However, I am still confused with the timeline and it would be great you can clarify.

If the Virtual Network Gateway will upgrade automatically without downtime, will the Basic Public IP be upgraded automatically as well?
TP 157.5K Reputation points Volunteer Moderator

2025-09-15T10:05:38.6766667+00:00

If the Virtual Network Gateway will upgrade automatically without downtime, will the Basic Public IP be upgraded automatically as well?

It's unclear. Let me explain. If it is automatically migrated to VpnGw1AZ SKU by September 30 then the IP would be automatically upgraded to Standard. If it is migrated to VpnGw1 SKU as an intermediary step then you may need to use portal to remove Basic SKU.

See this excerpt from FAQ:

Will my IP address change when my Legacy VPN gateway SKU (Standard or HighPerformance) is migrated to a Non-AZ SKU (VpnGw1 or VpnGw2)?

No, the IP address will not change when the Legacy SKU is migrated to a Non-AZ SKU. After SKU migration, you can choose to migrate the Basic SKU IP address to Standard SKU IP address through a customer controlled portal experience. For more information about Basic SKU IP migration, see About migrating a Basic SKU public IP address to Standard SKU for VPN Gateway article.

Leaving it on Basic SKU temporarily is okay since the deadline isn't until end of January 2026.

The deadlines, procedures, etc., related to VPN Gateway keep getting pushed back, modified/changed repeatedly. Originally, customers were going to have the ability to migrate from Standard to new SKU themselves, and if that had happened they would've used portal experience to update IP from Basic to Standard.

Then it changed to the migration being handled automatically, with no action needed by customer.

The above is why I asked you to check your IP's SKU after automatic migration has completed. It is possible that they will provide updated guidance for you to use portal to remove Basic SKU Public IP and/or they may want you to "do nothing" and wait for them to migrate you over to AZ SKU.
Anonymous

2025-09-17T02:42:51.95+00:00

Hi Matthew Lam,

i hope the above response by TP was helpful to you, if not please do us know if you have any questions on this?

Thanks,

Harish.

Answer 1

Hi Matthew Lam,

Thank you for your follow-up question.

Microsoft’s current official guidance confirms that Standard and High-Performance VPN Gateway SKUs will be migrated automatically by Azure before September 30, 2025, with no expected downtime. This migration covers the VPN Gateway SKU itself but does not automatically upgrade the associated Basic Public IP resources.

Regarding the Basic Public IP SKU, the retirement timeline is slightly different. The Basic Public IP SKU will be retired by end of January 2026 when used with VPN Gateways. This means:

Your VPN Gateway SKU migration happens automatically first (by September 2025).
The Basic Public IP SKU used by the VPN Gateway will not be automatically upgraded at that time.
You need to take action to upgrade or recreate the Public IP to a Standard SKU before January 31, 2026, to avoid impact.

This staggered timeline allows customers extra time to properly plan and execute the Public IP SKU upgrade after VPN Gateway migration completes seamlessly.

For your case, since you have not been able to manually prepare the migration through PowerShell or portal, rest assured the VPN Gateway migration will still occur automatically. For the Public IP, plan the manual upgrade/recreation to Standard SKU before the January 2026 deadline.

Please refer to these official Microsoft links for detailed timelines and instructions:

VPN Gateway SKU Legacy Migration: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-skus-legacy#migrate
VPN Gateway SKU retirement: https://azure.microsoft.com/updates?id=standard-and-highperformance-vpn-gateway-skus-will-be-retired-on-30-september-2025

I hope this clarifies the sequence and responsibilities between VPN Gateway and Public IP SKU migrations. If this answers your query, please click Accept Answer and Upvote for was this answer helpful.

Thanks,

Harish.

Matthew Lam 40 Reputation points

2025-09-15T09:48:14.7133333+00:00

Hi @Anonymous ,

Thank you for the clarification!

Back to the situation I mentioned in the original questions, which I followed the documentation to upgrade the IP used by the VPN gateway but failed. How can I solve this unknown error or who should I reach out to?

Thanks,

Matthew

Share via

Error when upgrading Virtual Network Gateway's public IP from Basic SKU to Standard

1 additional answer

Your answer