Virtual Network Gateway should use Generation2 VPN

Medium Azure General virtualnetworkgateways-virtual-network-gateway-gen

Applies to

Microsoft.Network/virtualNetworkGateways

What CGPulse checks

A resource passes this rule when vpnGatewayGeneration must equal Generation2. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Use Generation2 VPN gateway for higher throughput and improved performance. In Azure Portal: create new VNet Gateway with Generation2 SKU. See: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

Careful: Cannot change generation in-place. Requires deleting and recreating the gateway, which causes downtime

CLI

az network vnet-gateway show --ids "{id}" --query "vpnGatewayGeneration" -o tsv

Terraform

# WARNING: Changing generation requires resource recreation (downtime)
resource "azurerm_virtual_network_gateway" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  type                = "Vpn"
  vpn_type            = "RouteBased"
  generation          = "Generation2"
  sku                 = "VpnGw2"
  ip_configuration {
    name                          = "primary"
    public_ip_address_id          = azurerm_public_ip.{name}.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan