Migrate to a Standard SKU public IP address on Azure VPN Gateway VpnGw1

Hi METAKOL MK,

It looks like you’re running into the “InputIpResourceUrlNotValidForActiveActiveGatewayWithP2S” error because your VPN gateway is configured in active-active mode with Point-to-Site enabled, and Azure requires three public IPs in that scenario (two for the active-active instances and a third for P2S). Since you currently only have two Basic SKU IPs attached, the migration validation fails.

Here’s how to fix it:

Create a third Standard-SKU, non-zonal public IP for your gateway:

# Replace placeholders with your values
$rg        = "CompanyResources"
$region    = "YourRegion"
$ipName    = "MyGatewayP2SIP"

$thirdIp = New-AzPublicIpAddress `
  -Name $ipName `
  -ResourceGroupName $rg `
  -Location $region `
  -AllocationMethod Static `
  -Sku Standard

Attach that new IP to your VPN Gateway:

# Get your existing gateway
$gw = Get-AzVirtualNetworkGateway `
  -Name "MyGateway" `
  -ResourceGroupName $rg

# Get the GatewaySubnet reference
$vnet = Get-AzVirtualNetwork -ResourceGroupName $rg -Name "<YourVNetName>"
$subnet = $vnet.Subnets | Where-Object Name -EQ "GatewaySubnet"

# Create a new IP configuration for P2S
$p2sConfig = New-AzVirtualNetworkGatewayIpConfig `
  -Name "vnetGatewayP2SConfig" `
  -Subnet $subnet `
  -PublicIpAddress $thirdIp

# Add it to your gateway’s configurations
$gw.IpConfigurations.Add($p2sConfig)

# Push the update
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw

Wait for the gateway update to finish (this can take 10–15 minutes). Once it’s back in the “Succeeded” state you should see three IP slots under Configuration → Public IP Addresses in the portal.

Re-run the migration preparation – either in the portal or via PowerShell:

# Prepare migration
$migrationParams = New-AzVirtualNetworkGatewayMigrationParameter `
  -MigrationType UpgradeDeploymentToStandardIP

Invoke-AzVirtualNetworkGatewayPrepareMigration `
  -InputObject $gw `
  -MigrationParameter $migrationParams

At this point the prepare step should succeed. You can then execute and commit the migration as usual (noting the expected ~10 minutes of downtime during Execute).

Why does my Active‑Active VPN Gateway with Point‑to‑Site (P2S) require a third Public IP?

For Active‑Active VPN Gateways with P2S enabled, a third Public IP is required to support the P2S endpoint alongside the two IPs used for Active‑Active instances**, Refer the link for more details.

**Note: If you encounter any errors while creating the third Public IP address through the Azure Portal, please use the Azure CLI command below instead.

Ensure that the Public IP address is created in the same resource group as the VPN Gateway and uses the appropriate SKU and configuration required for the deployment.

az network public-ip create -g MyResourceGroup -n MyIp

References: https://learn.microsoft.com/azure/vpn-gateway/basic-public-ip-migrate-about#faq https://learn.microsoft.com/azure/vpn-gateway/basic-public-ip-migrate-howto?tabs=portal https://learn.microsoft.com/powershell/module/az.network/invoke-azvirtualnetworkgatewaypreparemigration?view=azps-16.0.0
https://learn.microsoft.com/powershell/module/az.network/new-azvirtualnetworkgatewaymigrationparameter?view=azps-16.0.0

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Pleaseand “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.