How to migrate from SSTP to IKEv2 protocol on the Basic SKU of the Point-to-Site Azure VPN Gateway?

Question

How to migrate from SSTP to IKEv2 protocol on the Basic SKU of the Point-to-Site Azure VPN Gateway?

Sepehr Soltanieh 25

I've recently came across this article in the official Microsoft docs, suggesting that the SSTP protocol will soon retire. The Basic VPN SKU (more information on VPN SKUs) so far only supported SSTP. That article suggested that IKEv2 support will come to Basic SKU VPN gateways as well and that starting November 2025 (last month) all new Basic SKU VPN gateways will be created by IKEv2 by default. It also teaches you how to manually change the protocol in case the gateway was created prior to November 2025.

Today (December 1, 2025), I attempted to create a new Basic SKU VPN gateway in the West US region, and after configuring the point-to-site settings, I downloaded the client configuration files from Azure Portal and found out that the generic VpnSettings.xml file still uses the SSTP protocol. I tried changing the tunnel type manually from SSTP to IKEv2 but the options depicted in the documentation were simply non-present.

I need to switch to IKEv2 so that I can use the VPN client on my non-Windows machines. I would appreciate any help or insight.

Thanks!

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Thanmayi Godithi 2,215 Microsoft External Staff Moderator

Hi @Sepehr Soltanieh,

Thank you for reaching out on Microsoft Q&A forum.

I understand that even when you configure a new Basic SKU VPN gateway to use IKEv2 protocol,it still uses SSTP.

Can you once try using PowerShell and confirm if that works?

Refer the below document and try updating tunnel type using PowerShell.

https://learn.microsoft.com/en-us/azure/vpn-gateway/ikev2-openvpn-from-sstp?tabs=powershell

User's image

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. If you have extra questions about this answer, please click "Comment".

Sepehr Soltanieh 25 Reputation points

2025-12-02T08:41:25.57+00:00
That was an awesome idea! I don't know why I didn't notice the script earlier.

I was able to switch my gateway's tunnel protocol using the Azure CLI script below, which is inspired by the PowerShell script shown in the above screenshot:

az network vnet-gateway update --name <vpn-gw-name> --resource-group <rg-name> --client-protocol IkeV2

I tested this on my Linux client using strongSwan and tested split-tunneling and SSHing, both of which worked perfectly fine.

Thanks!

Share via

How to migrate from SSTP to IKEv2 protocol on the Basic SKU of the Point-to-Site Azure VPN Gateway?

0 additional answers

Your answer