Not being able to configure a VPN connection to a site-to-site on premise VPN

Question

Not being able to configure a VPN connection to a site-to-site on premise VPN

I have set up a vpn connection to an on premises, the first try, I use a VpnGateway with sku VpnGw2AZ and everything works as expected.

The issue arrives due that the cost of this sku is too high so I switched to Basic.

But this sku doesn't allow me to personalize the IKE policy, and I get an error every time I try to set the Shared Key (all this in the vpn connection):

"Failed to save configuration changes to connection 'Connection'. Error: Operation 1d5e6a56-4597-48d4-8e8f-c42526e16d5b not found."

Any idea what could be wrong or how can I try to change?

Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-28T15:18:00.33+00:00

Of corse, I understand that... but that includes beeing able to set the shared key in the authentication section?

Also, with the basic sku, is possible to connect to a VPN on premises with the following settings?

IKE Phase 1
Authentication Method: PSK
Encryption: AES256
Authentication: SH256
Diffie-Hellman-Group: 14
Lifetime: 1440 minutos (86400 seg)

IpeSec Phase2
Protocol: IKEv2
Encryption: AES256
Authentication: SHA256
Lifetime: 3600 seg
PFS: Enable
Diffie-Hellman-Group: 14

Or is required to change the settings on premises or use another sku to be able to change them?
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-28T18:26:13.12+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel,

Thank you for your reply,

Or is required to change the settings on premises or use another sku to be able to change them?

If you are using the basic SKU VPN, you have to use the default IKE policy only.
I recommend you use a different SKU, not the basic SKU VPN gateway.

refer this doc: https://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus#benchmark

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-29T12:14:48.5566667+00:00

So, what you're saying is that I shoul not use the Basic SKU in my scenario?
There is no way I could make this work?

In the docs I've seen that the basic does not support P2S IKEv2, but does this means that it also doesn't support S2S (site-to-site) IKEv2?
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-29T18:14:10.0833333+00:00

And what about the error I am getting when trying to set the Shared Key?

Is that expected for the Basic SKU?

"Failed to save configuration changes to connection 'Connection'. Error: Operation 1d5e6a56-4597-48d4-8e8f-c42526e16d5b not found."
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-29T18:33:42.86+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel

And what about the error I am getting when trying to set the Shared Key? Is that expected for the Basic SKU?

This is not expected. Could you please try again? If you encounter the same error, could you share a screenshot? Also, could you try this using Azure CLI?

Refer this link: https://learn.microsoft.com/en-us/cli/azure/network/vpn-connection/shared-key?view=azure-cli-latest
Please let me know if you are still facing the error.
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-30T19:19:45.39+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-05-02T15:34:12.8033333+00:00

Hello @Alvarez Goyeneche, Roman Ezequiel

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-05-02T15:56:49.5533333+00:00

I haven't had the time to try the console way... I'll probably do that these days and update in case of anyone has the same problem.

But in my case, I ended up not using the Basic sku... is gonna cost me extra but I need something more stable and with less problems.

Thanks anyway for the help!!
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-05-02T17:43:01.81+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel,
I convert my comments into an answer.I tried on my end and was able to save after entering the Shared Key. I successfully saved the configuration.

Please do not forget to "Accept the answer” and “Yes” wherever the information provided helps you, this can be beneficial to other community members.

Accepted answer

0 additional answers

Your answer

Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-28T15:18:00.33+00:00

Of corse, I understand that... but that includes beeing able to set the shared key in the authentication section?

Also, with the basic sku, is possible to connect to a VPN on premises with the following settings?

IKE Phase 1
Authentication Method: PSK
Encryption: AES256
Authentication: SH256
Diffie-Hellman-Group: 14
Lifetime: 1440 minutos (86400 seg)

IpeSec Phase2
Protocol: IKEv2
Encryption: AES256
Authentication: SHA256
Lifetime: 3600 seg
PFS: Enable
Diffie-Hellman-Group: 14

Or is required to change the settings on premises or use another sku to be able to change them?
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-28T18:26:13.12+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel,

Thank you for your reply,

Or is required to change the settings on premises or use another sku to be able to change them?

If you are using the basic SKU VPN, you have to use the default IKE policy only.
I recommend you use a different SKU, not the basic SKU VPN gateway.

refer this doc: https://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus#benchmark

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-29T12:14:48.5566667+00:00

So, what you're saying is that I shoul not use the Basic SKU in my scenario?
There is no way I could make this work?

In the docs I've seen that the basic does not support P2S IKEv2, but does this means that it also doesn't support S2S (site-to-site) IKEv2?
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-04-29T18:14:10.0833333+00:00

And what about the error I am getting when trying to set the Shared Key?

Is that expected for the Basic SKU?

"Failed to save configuration changes to connection 'Connection'. Error: Operation 1d5e6a56-4597-48d4-8e8f-c42526e16d5b not found."
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-29T18:33:42.86+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel

And what about the error I am getting when trying to set the Shared Key? Is that expected for the Basic SKU?

This is not expected. Could you please try again? If you encounter the same error, could you share a screenshot? Also, could you try this using Azure CLI?

Refer this link: https://learn.microsoft.com/en-us/cli/azure/network/vpn-connection/shared-key?view=azure-cli-latest
Please let me know if you are still facing the error.
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-30T19:19:45.39+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-05-02T15:34:12.8033333+00:00

Hello @Alvarez Goyeneche, Roman Ezequiel

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Alvarez Goyeneche, Roman Ezequiel 25 Reputation points

2025-05-02T15:56:49.5533333+00:00

I haven't had the time to try the console way... I'll probably do that these days and update in case of anyone has the same problem.

But in my case, I ended up not using the Basic sku... is gonna cost me extra but I need something more stable and with less problems.

Thanks anyway for the help!!
Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-05-02T17:43:01.81+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel,
I convert my comments into an answer.I tried on my end and was able to save after entering the Shared Key. I successfully saved the configuration.

Please do not forget to "Accept the answer” and “Yes” wherever the information provided helps you, this can be beneficial to other community members.

Answer 1

Rohith Vinnakota 4,350 Microsoft External Staff

Hi @Alvarez Goyeneche, Roman Ezequiel

I understand that you want to use the custom IKE policy on the Basic VPN Gateway.

User's image

The Basic SKU does not allow for customization of the IKE policy.
Refer this doc: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#is-a-custom-ipsecike-policy-supported-on-all-azure-vpn-gateway-skus

And what about the error I am getting when trying to set the Shared Key? Is that expected for the Basic SKU?

This is not expected. Could you please try again? If you encounter the same error, could you share a screenshot? Also, could you try this using Azure CLI?

Refer this link: https://learn.microsoft.com/en-us/cli/azure/network/vpn-connection/shared-key?view=azure-cli-latest

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “Yes” wherever the information provided helps you, this can be beneficial to other community members.

Rohith Vinnakota 4,350 Reputation points Microsoft External Staff

2025-04-29T17:23:32.0266667+00:00

Hi @Alvarez Goyeneche, Roman Ezequiel

Thank you for your reply,

So, what you're saying is that I should not use the Basic SKU in my scenario?

Yes

There is no way I could make this work?

Option 1:
Please use the basic VPN gateway with the default settings.

Option 2:

Use a different SKU instead of the basic SKU VPN gateway.

In the docs I've seen that the basic does not support P2S IKEv2, but does this mean that it also doesn't support S2S (site-to-site) IKEv2?

No. The Basic SKU does support S2S (Site-to-Site) connections using IKEv2.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Not being able to configure a VPN connection to a site-to-site on premise VPN

0 additional answers

Your answer