Azure VPN setup with VPN Tracker: OpenVPN and IKEv2

Azure VPN setup with VPN Tracker gives Mac, iPhone, and iPad users secure Point-to-Site access to private resources in an Azure virtual network. This guide helps Azure administrators choose between OpenVPN and IKEv2, configure the Azure VPN Gateway, and build the matching connection in VPN Tracker.

The connection direction in this guide is VPN Tracker as the Point-to-Site client and Azure VPN Gateway as the VPN server. It covers certificate-based deployments, concise Azure-side preparation, team rollout, and the migration path for existing SSTP connections.

Which VPN protocols does Azure support?

Azure VPN Gateway supports three Point-to-Site tunnel protocols: OpenVPN, IKEv2, and SSTP. For new VPN Tracker deployments, focus on OpenVPN and IKEv2. Microsoft is retiring SSTP, so it should only be considered when migrating an existing configuration.

• OpenVPN: A TLS-based protocol that works well across restrictive networks and can use TCP 443. Azure supports certificate, RADIUS, and Microsoft Entra ID authentication with OpenVPN. However, Microsoft Entra ID profiles require the Azure VPN Client; this guide therefore uses certificate authentication for the VPN Tracker workflow.
• IKEv2: A standards-based IPsec protocol that is a strong option for Apple devices and mobile network changes. Azure supports certificate or RADIUS authentication with IKEv2. It normally requires outbound UDP 500 and 4500.
• SSTP: A legacy TLS-based protocol. Microsoft stopped supporting new SSTP enablement on August 31, 2026, and existing SSTP connections are scheduled to stop working after March 31, 2027.

For Microsoft’s current protocol and authentication matrix, see About Azure Point-to-Site VPN.

Which VPN is best for Azure?

OpenVPN is the best general starting point when users connect from many networks or when outbound IPsec traffic may be blocked. For a VPN Tracker connection, use an Azure certificate-authenticated OpenVPN profile and the configuration package generated for the gateway.

IKEv2 is often the best fit for managed Apple deployments that already use client certificates and prioritize efficient reconnection when moving between Wi-Fi and mobile networks. Choose it only where UDP 500 and 4500 are permitted.

If your gateway currently uses SSTP, treat protocol choice as a migration decision. Adding IKEv2 alongside SSTP is the least disruptive staged path. Moving to OpenVPN requires a coordinated cutover because Azure cannot run SSTP and OpenVPN together on the same gateway. Azure can run IKEv2 and OpenVPN together.

Before you start

You need Azure administrator access and an existing route-based Azure VPN Gateway with Point-to-Site configuration available. Gather these values before creating the VPN Tracker connection:

• A gateway SKU that supports the selected tunnel and authentication combination
• The selected tunnel protocol: OpenVPN or IKEv2
• The Azure VPN client address pool, which must not overlap the virtual network or the users’ local networks
• The virtual network address ranges that remote users must reach
• The generated Azure VPN client configuration package
• The Azure gateway hostname or FQDN from that package
• A unique client certificate with its private key for each user or managed device
• The required root and intermediate certificates
• Internal DNS server addresses and search domains, if applicable

Use a certificate issued for Client Authentication. A separate certificate for each user or managed device is recommended because individual access can then be revoked without replacing credentials for the rest of the team. Never share private keys through ordinary email or chat.

Connect to Azure with OpenVPN

For OpenVPN, select OpenVPN (SSL) or IKEv2 and OpenVPN (SSL).

Brief Azure setup

1. In the Azure portal, open the relevant Virtual network gateway and select Point-to-site configuration.
2. Configure a non-overlapping client address pool.
3. For Tunnel type, choose OpenVPN (SSL) or IKEv2 and OpenVPN (SSL).
4. For the VPN Tracker workflow in this guide, choose Azure certificate authentication and upload the public data of the trusted root certificate. RADIUS is an alternative for appropriately tested deployments.
5. Save the gateway configuration, then generate and download a fresh VPN client profile configuration package.
6. Extract the package and locate OpenVPN/vpnconfig.ovpn. Use the package generated after your latest gateway change.

Azure supports multiple authentication types. For the VPN Tracker workflow in this guide, select Azure certificate.

Important: Microsoft Entra ID authentication is available only with OpenVPN and Microsoft’s documented client flow requires the Azure VPN Client. Do not substitute an Entra ID AzureVPN XML profile for the certificate-based OpenVPN profile used here.

Create the OpenVPN connection in VPN Tracker

1. Have the user’s client certificate, private key, and complete certification chain available for setup.
2. Open the Azure connection creator and choose OpenVPN.
3. Import the .ovpn profile from the Azure VPN client configuration package.
4. When requested, select the matching client certificate and verify that the full trust chain is available.
5. Name the connection clearly, for example Azure Production – OpenVPN.
6. Review the imported gateway hostname, protocol, port, and routes. Do not replace the Azure FQDN with an IP address unless the server certificate explicitly covers that IP address.
7. Keep automatic network configuration where possible. Add Azure virtual network ranges, internal DNS servers, or search domains manually only if they are not supplied by the imported profile.
8. Save the connection and test it from a network outside Azure and outside the user’s normal office LAN.

Import the Azure OpenVPN profile, then verify the gateway address, port 443, and network configuration.

Connect to Azure with IKEv2

For IKEv2, select IKEv2 or IKEv2 and OpenVPN (SSL).

Brief Azure setup

1. Open Virtual network gateway > Point-to-site configuration in the Azure portal.
2. Select IKEv2 or IKEv2 and OpenVPN (SSL) as the tunnel type.
3. Select Azure certificate authentication, upload the trusted root certificate’s public data, and save the configuration. RADIUS can be used only when the complete authentication path has been tested.
4. Generate and download a new VPN client profile configuration package.
5. From the package, note the complete Azure VPN server FQDN and obtain the gateway root certificate. Separately issue a client certificate from the trusted root CA and export it with its private key.
6. Confirm that client networks allow outbound UDP 500 and 4500.

After saving the Point-to-Site configuration, generate and download a fresh VPN client profile package.

Create the IKEv2 connection in VPN Tracker

1. Extract the current Azure VPN client configuration package. In the Generic folder, locate VpnSettings.xml and VpnServerRoot.cer.
2. Open the Azure connection creator and choose IKEv2.
3. Enter the complete Azure gateway FQDN from the VpnServer entry in VpnSettings.xml.
4. Leave Network Configuration set to Automatic.
5. For server authentication, keep User Authentication (+ Server Certificate) selected and upload VpnServerRoot.cer.
6. For user authentication, select EAP with User Certificate (EAP-TLS). Upload the client certificate with its private key and certification chain, followed by the issuing CA certificate when requested.
7. Keep server-certificate and remote-identity verification enabled. The remote identity must match the Azure gateway FQDN unless the downloaded profile specifies a different certificate identity.
8. Create and test the connection. Verify one internal IP address and one internal DNS name. Add routes or internal DNS settings manually only if the automatic configuration does not provide them.

Refer to the screenshot below as a guide for the default settings:

Enter the Azure gateway FQDN, upload the Azure gateway root CA, then select EAP with User Certificate (EAP-TLS) and upload the client certificate with its CA chain.

The Azure IKEv2 profile in VPN Tracker is intended for certificate-based Point-to-Site connections. Because Azure gateway policies and enterprise certificate setups vary, validate the connection with a pilot user and compare the VPN Tracker log with Azure VPN Gateway diagnostics before rollout.

Roll out Azure VPN connections to a team

Build and test one reference connection for each approved protocol before distributing anything. With VPN Tracker TeamCloud, administrators can share Azure VPN connections using end-to-end encryption and centrally update routes, DNS, gateway settings, and access assignments.

1. Create separate, clearly named connections for production, staging, and each Azure region or virtual network where necessary.
2. Keep user-specific client certificates and private keys assigned to the individual user or managed device.
3. Run a small pilot on representative home, office, hotspot, and guest networks.
4. Document the owner, authentication method, certificate lifetime, routes, DNS behavior, and rollback path.
5. Use group-based access and remove access promptly when roles change.

Troubleshooting Azure VPN connections

• The connection times out: Confirm that the gateway is provisioned, the selected Point-to-Site protocol is enabled, the Azure FQDN resolves, and the client network permits the required traffic. IKEv2 needs outbound UDP 500 and 4500; OpenVPN depends on the protocol and port in the generated profile.
• Certificate authentication fails: Check that the client certificate includes its private key, is valid for Client Authentication, chains to a root certificate uploaded to Azure, and has not expired or been revoked.
• Server identity validation fails: Use the complete FQDN from the Azure configuration package, upload the matching VpnServerRoot.cer, and keep remote certificate verification enabled.
• IKEv2 certificate authentication fails: Confirm that EAP-TLS is selected. If a local identity must be entered manually, use the subject of the selected client certificate; the remote identity is the Azure gateway FQDN.
• The VPN connects but resources are unreachable: Compare the Azure VNet ranges with VPN Tracker’s remote networks. Check Network Security Groups, user-defined routes, peering, return routing, and firewalls on the destination resource.
• IP addresses work but names do not: Verify that internal DNS servers and search domains are configured and reachable through the VPN.
• A profile stopped working after an Azure change: Generate and import a fresh client configuration package after changing the gateway, tunnel type, certificates, authentication, or server certificate.
• OpenVPN works but IKEv2 does not: Test from another network. Many guest and filtered networks allow TLS traffic but block IPsec traffic on UDP 500 or 4500.

Legacy SSTP connections and migration

Do not start a new Azure SSTP deployment. Microsoft no longer supports enabling SSTP on Azure VPN gateways as of August 31, 2026, and existing SSTP connections are scheduled to stop working after March 31, 2027. See Microsoft’s SSTP retirement and migration guidance.

Azure rejects new SSTP configurations and instructs administrators to select IKEv2 or OpenVPN.

For an existing VPN Tracker SSTP connection, keep the current profile only long enough to support an orderly migration:

1. Inventory affected gateways, users, certificates, routes, DNS settings, and business-critical resources.
2. For the lowest-risk staged migration, add IKEv2 alongside SSTP, generate new client profiles, and move users in controlled batches.
3. If OpenVPN is preferred, plan a cutover window. SSTP and OpenVPN cannot coexist on the same Azure gateway, so existing SSTP users lose connectivity when the gateway switches.
4. Pilot the new VPN Tracker connection, verify access and DNS, then distribute it to the remaining users.
5. Remove obsolete SSTP connections and certificates after the migration is complete and documented.

SSTP migration support

Move from SSTP with confidence

Need to migrate an existing Azure SSTP deployment to IKEv2 or OpenVPN? VPN Tracker Consulting can help assess your setup, choose the right protocol, plan the cutover, and prepare a controlled rollout for your team.

Plan your SSTP migration

Coming to Windows

VPN Tracker for Windows preview

Planning a mixed Mac and Windows rollout? Explore the VPN Tracker for Windows preview and follow the latest development updates before finalizing your deployment.

Explore VPN Tracker for Windows

Frequently asked questions

Can Azure run OpenVPN and IKEv2 at the same time?

Yes. Azure VPN Gateway can be configured for IKEv2 and OpenVPN together. This is useful when different user groups or network conditions require different protocols.

Can Azure run OpenVPN and SSTP at the same time?

No. Both are TLS-based protocols and cannot coexist on the same Azure VPN Gateway. A move from SSTP to OpenVPN therefore requires a planned cutover.

Does Microsoft Entra ID authentication work with IKEv2?

No. Azure supports Microsoft Entra ID authentication only with OpenVPN, using the Azure VPN Client flow. For the VPN Tracker OpenVPN and IKEv2 workflows in this guide, use a compatible certificate-based configuration.

Should every user receive a separate client certificate?

Use one certificate per user or managed device wherever practical. Unique certificates make it possible to revoke one user or device without replacing credentials for the rest of the team.

Where can I start an Azure connection in VPN Tracker?

Open the Azure connection creator, select the matching protocol, and enter or import the values from the current Azure VPN client configuration package.