Question

Your company establishes a site-to-site VPN between an Azure route-based VPN gateway (VpnGw2) and an on-premises firewall. The connection reaches the 'Connecting' state but never becomes 'Connected'. Azure diagnostic logs show that IKE Phase 1 negotiation repeatedly fails. You confirm the shared key matches on both sides and the on-premises public IP is correctly set in the local network gateway. The on-premises firewall administrator reports the tunnel is configured for IKEv1 with a policy-based (all-or-nothing) traffic selector. What is the MOST likely cause of the failure?

Accepted Answer

The route-based Azure gateway defaults to IKEv2, which is incompatible with the on-premises IKEv1 policy-based configuration unless a matching custom IPsec/IKE policy is applied.

Answer

The VpnGw2 SKU does not support site-to-site connections and must be upgraded to VpnGw3.

Answer

The local network gateway address space overlaps with the Azure VNet address space, blocking Phase 1.

Answer

BGP must be enabled on the Azure gateway before any IKE Phase 1 negotiation can complete.