VPN Gateway: Intermittent Connectivity Issues in Site-to-Site VPN

Kriangkrai Hongthong 0 Reputation points
2026-11-10T12:01:48.94+00:00

Problem description

I am experiencing intermittent connectivity on my Azure Site-to-Site VPN connection that uses IPsec and BGP between Azure VPN Gateway and a Palo Alto Networks firewall. The outages began on November 7, 2026, with two brief disruptions of about three minutes each. During these outages, the IPsec tunnel became unresponsive, and the BGP session was lost and re-established. I am seeking assistance to understand the root cause of these interruptions and how to prevent future occurrences.

Environment

Azure VPN Gateway, SKU: VpnGw2AZ, Gateway mode: active-active, Connection type: Site-to-Site VPN with IPsec and BGP, Region not specified.

What I've already tried

The initial report includes details of the outages and the observed symptoms. No follow-up troubleshooting steps, logs, or diagnostic outputs have been provided in the case record. I have not performed any diagnostic actions myself.

Current status

I am looking for guidance from Microsoft Support to review internal Azure platform logs, gateway health status, and platform telemetry for the specified gateway instance during the reported outages to identify the underlying cause and recommend corrective measures.

Azure VPN Gateway
Azure VPN Gateway

An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Salamat Shah 990 Reputation points MVP
    2026-11-10T13:27:40.66+00:00

    Dear Hongthong,

    Focus first on IKE/IPsec rekey events and Palo Alto logs, as 2–3-minute outages with automatic recovery typically indicate tunnel renegotiation or transient connectivity issues rather than a permanent Azure gateway fault.

    • Check Azure VPN Gateway Diagnostic Logs during the outage window.
    • Review Palo Alto system, IKE, IPsec, and BGP logs for tunnel resets/rekeys.
    • Verify IKE/IPsec parameters match on both sides (encryption, lifetime, PFS, DPD).
    • Validate BGP configuration and timers on Azure and Palo Alto.
    • Check Azure Service Health for gateway maintenance events.
    • Enable VPN Gateway diagnostics and alerts for future monitoring.
    • if no firewall-side issue is found, open a Microsoft Support case and request backend VPN Gateway health analysis during the reported timestamps.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.