Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
VPN Gateway: Site-to-site BGP tunnel outage — Investigation and prevention
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 23%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC9%3C/text%3E%3C/svg%3E)
ChrisZ-9474
0
Reputation points
Problem description
I am experiencing a prolonged outage of my site-to-site VPN connection between my Azure Virtual Network Gateway and Google Cloud Platform. The BGP-enabled tunnel has been down for over an hour starting around 2026-11-02 11:00 UTC. I am seeking to understand the cause of this outage, why I did not receive any notifications, and what measures I can implement to prevent similar issues in the future.
Environment
Azure VPN Gateway / Virtual Network Gateway, region not specified, BGP-enabled tunnel to Google Cloud Platform
What I've already tried
The initial report indicates that the outage began with a tunnel disconnect, and there was a planned failover event on 2026-10-30, which did not align with the outage window on 2026-11-02. No configuration changes, maintenance activities, or peer-side events were documented during the outage window. Diagnostic insights show no platform maintenance in that time frame, and there is no evidence of platform or peer-side issues.
Current status
Currently, the BGP tunnel remains down, and I am looking for assistance to identify the root cause, improve notifications, and implement preventative measures.
Azure VPN Gateway
-
Hemant Bharadwaj 90 Reputation points Microsoft Employee2026-11-03T16:02:33.4733333+00:00 From your timeline, this should be treated as a tunnel/BGP session troubleshooting case with both control-plane and data-plane evidence collection (not only portal status checks).
- Check tunnel and BGP status on both sides at same UTC timestamps.
- Validate BGP peer state, learned routes, and ASN settings consistency.
- Ref: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-bgp-overview
- Run Azure VPN diagnostics for S2S outage path.
- Follow Microsoft S2S troubleshooting flow and verify shared key, IPsec policy compatibility, and route propagation.
- Ref: https://learn.microsoft.com/en-us/troubleshoot/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect
- Confirm monitoring/alerts were configured for tunnel down events.
- Configure Azure Monitor metrics/alerts for Tunnel Ingress/Egress and tunnel status so future outages notify immediately.
- Ref: https://learn.microsoft.com/azure/vpn-gateway/monitor-vpn-gateway
- Preventive architecture checks.
- Ensure active-active gateways where required, multiple tunnels, and tested failover runbook.
- Review BGP timers/hold times with GCP peer to avoid unnecessary flap sensitivity.
- Data to capture for RCA/support.
- Gateway resource ID, connection name, public IPs on both ends, BGP peer IP/ASN, exact outage UTC window, and activity logs.
If you share sanitized BGP state snapshots from both Azure and GCP during outage time, we can pinpoint likely root cause branch faster.
“If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.”
- Check tunnel and BGP status on both sides at same UTC timestamps.
Sign in to comment
Sign in to answer