Upgrade to Standard SKU public IP addresses in Azure by 30 September 2025—Basic SKU will be retired

Question

Upgrade to Standard SKU public IP addresses in Azure by 30 September 2025—Basic SKU will be retired

Tikam Sharma 0

Need help in Upgrade to Standard SKU public IP addresses in Azure by 30 September 2025—Basic SKU will be retired and getting issue while upgrading it to standard

0 comments

2 answers

Your answer

Answer 1

Andreas Baumgarten 132.9K MVP Volunteer Moderator

Hi @Tikam Sharma ,

please take a look here: Upgrade Basic Public IP Address to Standard SKU in Azure

If you need more specific support or have more specific questions, please provide some more details/context about the issue you have.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Frech, Robin 0 Reputation points

2025-09-19T18:55:20.9766667+00:00

I have changed today of my central VPN GW from Basic SKU to Standard SKU. Now my traffic to S2S is broken. I cannot do UDP 53 anymore, some other TCP ports are broken. in Azure is everything fine, but exiting Azure will cause unexpected behaivior. Some Site2Sites were disconnected.....
Anonymous

2025-09-22T09:56:36.8666667+00:00
Hello @Frech, Robin,
Good day.

Thank you for sharing the update. I see that after upgrading your Azure VPN Gateway from Basic SKU to Standard SKU, you are encountering issues with Site-to-Site VPN traffic, such as problems with UDP 53 (DNS), certain TCP ports, and some tunnels being disconnected.

These issues can happen due to key architectural and configuration differences between the Basic and Standard SKUs. Below are the main points and suggested next steps to help address the situation:

Main Points to Consider:

1.       A Basic SKU cannot be directly upgraded to Standard; you usually need to delete and recreate the gateway or use the preview migration tool. This process may result in a new public IP unless the migration preserves the IP.

Even if the public IP stays the same, routing, NAT, and traffic handling are different in the Standard SKU. Stricter routing and security enforcement may cause some traffic, such as DNS or certain TCP ports, to fail if rules are not properly updated.

Suggested Next Steps:

Validate Gateway Configuration,

1.       Check the VPN Gateway SKU in the Azure portal (such as VpnGw1, VpnGw2, etc.).

2.       If you use NAT rules, make sure they are recreated and specifically permit UDP 53 and the relevant TCP ports.

3.       Verify that the IPsec/IKE settings are aligned with your on-premises VPN device.

Please review the routing and connectivity,

Use Network Watcher → Connection Troubleshoot to test the traffic paths.

Review the effective routes on the VM NICs to verify that DNS and return paths are valid.

If forced tunneling is enabled, make sure DNS traffic is allowed through the tunnel.

Check On-Premises VPN Device,

1.       If the gateway’s public IP has changed, make sure to update it on your firewall or VPN device.

2.       Check the S2S configuration again, including Phase 1 and Phase 2 settings, algorithms, and the peer IP address.

Reset the Gateway,

1.       From the Azure portal: VPN Gateway → Support + troubleshooting → Reset.

2.       This forces re-establishment of IPsec/IKE tunnels and can resolve transient disconnections.

Important Notes

Downgrading from Standard SKU to Basic is not supported If a rollback is absolutely required, the gateway must be recreated using the Basic SKU. However, since Basic is being phased out, this is not advised.

If you used the migration tool, please ensure the process is fully committed and not left pending.

Kindly let us know if the above helps or you need further assistance on this issue.

Answer 2

Hello @Tikam Sharma,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question about upgrading to Standard SKU public IP addresses in Azure before the retirement of Basic SKU on 30 September 2025, and that you are experiencing some issues with the upgrade process.

Microsoft will stop allowing the creation of new Basic SKU public IPs after 31 March 2025, and all existing Basic SKU IPs will be retired on 30 September 2025. To avoid service disruption, upgrade your Basic SKU IPs to Standard SKU before the retirement date. Start by identifying all Basic SKU IPs in your environment using the Azure portal, PowerShell, or CLI. Review which services (like VMs, Load Balancers, or VPN Gateways) are using these IPs. Some services can be upgraded directly, while others may need a new Standard SKU IP and reassignment. Once upgraded, test connectivity and update any DNS, firewall, or application settings as needed. For more information, see Microsoft’s migration guide: Upgrade Basic SKU public IP to Standard SKU in Azure.

Please use the link below to upgrade the public IP: Upgrade Basic Public IP Address to Standard SKU in Azure | Microsoft Learn

Kindly let us know if you encounter any issues. If so, kindly provide more details so I can assist you further.

Please do not forget to "Accept the answer” and “up-vote it” wherever the information provided helps you, this can be beneficial to other community members__.__ It would be greatly appreciated and helpful to others.

Anonymous

2025-09-22T09:59:37.5366667+00:00

Hello @Tikam Sharma,
Good day.

Just checking in to see if you had a chance to see the previous response by Jeevan shanigarapu. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer. And, if you have any further questions do let us know.

Regards,
Jeevan