First off We have an existing Site-Site IPSEC VPN (route based) between our office and our Azure cloud. This works exactly as it's supposed to. We just got a backup internet connection (Cradle point) for fail over situations. The internet backup is functional, and I've set up an alternate connection with the IP address of our backup option, but the site-site VPN never comes back up when we do a fail over test. Functionally, on the "local" side, the same firewall is initiating the connection, so what I've done is set up the backup connection to use the same PSK, but to the ip of the backup internet rather than our "normal" IP.

Here's a hypothetical setup:
Main internet: PSK: ABC
Backup internet: PSK: ABC

The VPN between Main and Azure works perfectly. The tunnel is up and passes information normally. When we attempt a failover test, the connection between and never comes up, despite having a "Connection" of it's own in Azure. Any help at all is appreciated.


Looks like this is an expected behavior, check this link: http://www.gi-architects.co.uk/2015/12/azure-highly-available-dynamic-vpn-automatic-failover/ (written by Luben Kirov)

Real VPN failover is on Microsoft rader, but haven't been implimented yet: https://feedback.azure.com/forums/217313-networking/suggestions/7911798-vpn-failover

Unless you contact the Azure support team and they tell you otherwise, I think there no real way for this to be done.

  • Thanks Noor- I'll read those links. Not exactly the answer I was hoping for, but I guess it is what it is. – bcarlock Nov 1 '16 at 13:45

As Noor mentioned, for a VPN site-to-site, configure 2 or more links of Internet are not support. Maybe we can use multiple VPN devices from your on-premises network to connect to your Azure VPN gateway, as shown in the following diagram: enter image description here

This configuration provides multiple active tunnels from the same Azure VPN gateway to your on-premises devices in the same location. We can set different internet to the VPN devices, in this configuration, the Azure VPN gateway is still in active-standby mode.

More information about active-standby mode, please refer to the link below:

If you still have questions, welcome to post back here. Thanks.
Best Regards,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.