Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
VPN Gateway: Connection Update Fails with GwmOperationTimeOut
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 51%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHT%3C/text%3E%3C/svg%3E)
Hasan Tarık YILMAZ
0
Reputation points
Problem description
I am experiencing an issue when attempting to update my Azure Site-to-Site VPN connection. Specifically, when I try to add a new custom traffic selector to the existing connection, the operation remains in 'Updating' status for a long time and then fails with a 'ResourceOperationFailure' error, citing 'GwmOperationTimeOut'. The existing VPN tunnel remains connected, and the gateway's provisioning state is 'Succeeded'. I have confirmed that the connection is still active, and the virtual network gateway is operational. The error occurs during the configuration update via the Azure portal.
Environment
Azure VPN Gateway in West Europe; existing production Site-to-Site VPN connection; policy-based traffic selectors enabled; attempting to add a custom traffic selector; tunnel remains connected; provisioning state: Succeeded.
What I've already tried
I attempted to update the VPN connection by adding a new custom traffic selector through the Azure portal. The update stays in 'Updating' status for an extended period before failing with a timeout error. I checked the current operational state and activity logs, noting the failure details. I have not tried using Azure CLI or ARM/Bicep templates to perform the update, as I want to avoid disrupting the active VPN connection in production.
Current status
I am seeking assistance to understand the cause of the timeout during the update, to determine if there are limitations or issues with adding custom traffic selectors, and to receive guidance on a safe remediation procedure that does not disrupt the existing active VPN connection.
Azure VPN Gateway
-
Allan Solomon Mejia 10,465 Reputation points2026-10-08T18:19:28.7133333+00:00 Hello @Hasan Tarık YILMAZ
Custom traffic selectors are supported on both policy-based and route-based Azure VPN gateways, and Microsoft supports updating an existing connection through the portal. The address ranges must be entered in CIDR notation.
The fact that the tunnel remains connected while the update fails is possible because the provisioning state represents the Azure Resource Manager control-plane operation and is independent of the resource’s current traffic-processing state.
Before retrying:
- Check the connection’s Activity log and record the failed operation’s timestamp, correlation ID, and complete error details.
- Verify that all local and remote selector ranges use valid CIDR notation and match the encryption domains configured on the on-premises VPN device.
- Confirm that no other write operation is running against the VPN gateway, local network gateway, or connection.
- Export or document the existing connection, IPsec/IKE policy, shared-key configuration, and selectors before making another change.
- Perform the retry during a maintenance window. Changing traffic selectors can affect IPsec security-association negotiation, particularly because Azure proposes the custom selectors when Azure initiates the connection.
If the connection resource enters a Failed provisioning state, refreshing it through a read followed by a write:
Get-AzVirtualNetworkGatewayConnection ` -Name "<connection-name>" ` -ResourceGroupName "<resource-group>" | Set-AzVirtualNetworkGatewayConnectionRun this only after retrieving the complete current resource configuration, using an up-to-date Az PowerShell module. Take note that issuing a write with incomplete properties or an older API version can overwrite settings.
If the update fails again with valid selectors, open an Azure support request and provide the connection resource ID, gateway SKU, region, UTC timestamp, correlation ID, complete error response, current selectors, and intended selectors. Microsoft support will need to check the gateway-management operation on the service side.
References:
Custom traffic selectors for VPN Gateway
Troubleshoot Microsoft.Network failed provisioning states
Restore a Microsoft.Network connection to Succeeded
Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.
Sign in to comment
Sign in to answer