Skip to content

Commit fddfc7c

Browse files
JillGrant615JillGrant615
authored
Merge pull request #310415 from aimee-littleton/nat-gateway-v2-migrate-doc
Nat gateway v2 migrate doc
2 parents d79e071 + 355dcd3 commit fddfc7c

2 files changed

Lines changed: 266 additions & 0 deletions

File tree

‎articles/nat-gateway/nat-gateway-v2-migrate.md‎

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
---
2+
3+
title: Migrate Azure NAT Gateway from Standard to StandardV2 - Guidance
4+
description: Upgrade guidance for migrating Standard NAT Gateway to StandardV2 NAT Gateway.
5+
author: alittleton
6+
ms.author: alittleton
7+
ms.service: azure-nat-gateway
8+
ms.topic: concept-article
9+
ms.customs: references_regions
10+
ms.date: 01/13/2026
11+
12+
# Customer intent: "As a cloud engineer with Standard NAT Gateway, I need guidance on migrating my workloads off Standard to StandardV2 SKU."
13+
---
14+
15+
# Migrate from Standard to StandardV2 NAT Gateway
16+
17+
18+
StandardV2 NAT Gateway offers enhanced data processing limits and high availability through zone redundancy. StandardV2 NAT Gateway is recommended for production workloads requiring resiliency to zonal outages.
19+
20+
In this article, we discuss guidance for how to migrate your subnets from Standard NAT gateway to StandardV2 NAT gateway. In place migration to StandardV2 NAT Gateway isn't available.
21+
22+
> [!IMPORTANT]
23+
> Migration from Standard to StandardV2 NAT Gateway involves **downtime and impact to existing connections**. It also requires the use of new StandardV2 Public IPs. Existing Standard SKU Public IPs don't work with StandardV2 NAT Gateway. Plan accordingly.
24+
25+
## Pre-migration steps
26+
27+
We recommend the following pre-migration steps to prepare for the migration.
28+
* StandardV2 NAT Gateway requires the use of StandardV2 public IPs. Existing Standard SKU public IPs don’t work with StandardV2 NAT Gateway. Make sure you’re able to re-IP to StandardV2 Public IPs before you create StandardV2 NAT Gateway.
29+
* Check if you have allow listing requirements at destination endpoints since you have to re-IP to StandardV2 public IPs to use StandardV2 NAT Gateway.
30+
* Plan for application downtime during the migration. Existing connections with Standard NAT Gateway are impacted when migrating to StandardV2 NAT Gateway.
31+
* Confirm which subnets in your virtual network need to be migrated to StandardV2 NAT Gateway.
32+
33+
## Unsupported scenarios
34+
35+
Before you migrate to StandardV2 NAT gateway, make sure that your specific scenario is supported. Review the following unsupported scenarios and [known issues](#known-issues) with StandardV2 NAT gateway.
36+
37+
* StandardV2 NAT Gateway must be used with StandardV2 SKU public IPs. Standard SKU public IPs aren't supported.
38+
* Azure Kubernetes Service (AKS) managed NAT gateway doesn't support StandardV2 NAT Gateway deployment. To use a StandardV2 NAT gateway with AKS, StandardV2 NAT Gateway must be deployed as user-assigned.
39+
* StandardV2 NAT Gateway and Basic SKU Load balancer or Basic SKU public IPs aren't supported.
40+
* StandardV2 NAT Gateway doesn't support the use of custom public IPs (BYOIP).
41+
* The following regions don't support StandardV2 NAT Gateway:
42+
* Canada East
43+
* Central India
44+
* Chile Central
45+
* Indonesia Central
46+
* Israel Northwest
47+
* Malaysia West
48+
* Qatar Central
49+
* UAE Central
50+
51+
## Known issues
52+
53+
* StandardV2 NAT Gateway doesn't support and can't be attached to delegated subnets for the following services:
54+
* Azure SQL Managed Instance
55+
* Azure Container Instances
56+
* Azure Database for PostgreSQL - Flexible Server
57+
* Azure Database for MySQL - Flexible Server
58+
* Azure Database for MySQL
59+
* Azure Data Factory - Data Movement
60+
* Microsoft Power Platform services
61+
* Azure Stream Analytics
62+
* Azure Web Apps
63+
* Azure Container Apps
64+
* Azure DNS Private Resolver
65+
66+
* StandardV2 NAT Gateway disrupts outbound connections made with Load balancer outbound rules for IPv6 traffic only. Standard SKU NAT gateway can be used to provide outbound for IPv4 traffic while Load balancer outbound rules is used for IPv6 outbound traffic. If you see disruption to outbound connectivity for IPv6 outbound traffic with Load balancer outbound rules, remove the StandardV2 NAT Gateway from the subnet or virtual network. Use Load balancer outbound rules to provide outbound connectivity for both IPv4 and IPv6 traffic. Or use Standard SKU NAT Gateway to provide outbound connectivity for IPv4 traffic and Load balancer outbound rules for IPv6 traffic.
67+
68+
* Attaching a StandardV2 NAT Gateway to an empty subnet created before April 2025 without any virtual machines may cause the virtual network to go into a failed state. To return the virtual network to a successful state, remove StandardV2 NAT Gateway, create and add a virtual machine to the subnet and then reattach the StandardV2 NAT Gateway.
69+
70+
* Long running outbound connections using a Load balancer or an instance-level public IP on a VM instance may be disrupted by attaching a Standard SKU or StandardV2 NAT gateway to the subnet. New connections use the NAT gateway.
71+
72+
## Guidance for manual migration
73+
74+
### Migration using the portal
75+
76+
Use the suggested order of operations for manually migrating from a Standard SKU NAT Gateway to a StandardV2 SKU NAT Gateway using the Portal.
77+
78+
1. Create a new **StandardV2 SKU NAT gateway**. Make sure to select StandardV2 as the SKU.
79+
80+
2. Create a new **StandardV2 SKU public IP** or **StandardV2 SKU public IP prefix** resource during the create experience for the StandardV2 NAT gateway. Select the IP version required - either IPv4 or IPv6.
81+
82+
> [!IMPORTANT]
83+
> StandardV2 NAT gateway requires the use of StandardV2 public IPs. Existing Standard SKU public IPs don’t work with StandardV2 NAT Gateway. Make sure you’re able to re-IP to StandardV2 public IPs before you create StandardV2 NAT gateway.
84+
85+
3. **Skip the Networking tab** during the portal create experience for StandardV2 NAT gateway. You attach the StandardV2 NAT gateway to the subnet later.
86+
87+
4. **Create** the StandardV2 NAT gateway.
88+
89+
5. From your resource group, navigate to the **subnet** you want to migrate from Standard NAT gateway to StandardV2 NAT gateway.
90+
91+
6. **Update** the subnet configuration to use the new StandardV2 NAT gateway. (This replaces your existing Standard NAT gateway with the StandardV2 NAT gateway).
92+
93+
7. **Save** the subnet configuration.
94+
95+
> [!IMPORTANT]
96+
> Existing connections with Standard NAT gateway are impacted when migrating to StandardV2 NAT gateway. Plan for application downtime during the migration. It's advised to migrate one subnet at a time and validate connectivity before proceeding to the next subnet. To minimize impact to your applications, consider performing this step during a maintenance window.
97+
98+
8. Repeat steps 5-7 for each subnet you want to migrate to StandardV2 NAT gateway.
99+
100+
> [!NOTE]
101+
> This migration doesn't delete your existing Standard NAT gateway or Standard SKU public IP resources.
102+
103+
### Migration using PowerShell
104+
105+
Use the suggested order of operations for migrating from a Standard SKU NAT gateway to a StandardV2 SKU NAT gateway using PowerShell.
106+
107+
Before you begin, ensure you meet the following criteria:
108+
109+
- Azure PowerShell installed locally or use Azure Cloud Shell.
110+
- If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-azure-powershell).
111+
- If you run PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
112+
- Ensure that your `Az.Network` module is 7.17.0 or later. To verify the installed module, use the command `Get-InstalledModule -Name "Az.Network"`. If the module requires an update, use the command `Update-Module -Name Az.Network`.
113+
- Sign in to Azure PowerShell and select the subscription that you want to use. For more information, see [Sign in with Azure PowerShell](/powershell/azure/authenticate-azureps).
114+
115+
The following steps should be taken to migrate from Standard NAT gateway to StandardV2 NAT gateway using PowerShell:
116+
117+
1. Create a new **StandardV2 SKU public IP** or **StandardV2 SKU public IP prefix** resource using the `New-AzPublicIpAddress` or `New-AzPublicIpPrefix` cmdlet. Select IPv4 or IPv6 for IP version.
118+
119+
```powershell
120+
$publicIp = New-AzPublicIpAddress -ResourceGroupName <your-resource-group> -Name <your-public-ip-name> -Location <your-location> -Sku StandardV2 -AllocationMethod Static -IpVersion IPv4 -Zone 1,2,3
121+
```
122+
123+
Or
124+
125+
```powershell
126+
$publicIpPrefix = New-AzPublicIpPrefix -ResourceGroupName <your-resource-group> -Name <your-public-ip-prefix-name> -Location <your-location> -Sku StandardV2 -PrefixLength 28 -Zone 1,2,3
127+
```
128+
129+
2. Create a new **StandardV2 SKU NAT gateway** using the `New-AzNatGateway` cmdlet. Make sure to select StandardV2 as the SKU.
130+
131+
```powershell
132+
$natGateway = New-AzNatGateway -ResourceGroupName <your-resource-group> -Name <your-nat-gateway-name> -Location <your-location> -Sku StandardV2, -PublicIpAddress $publicIp
133+
```
134+
135+
Or
136+
137+
```powershell
138+
$natGateway = New-AzNatGateway -ResourceGroupName <your-resource-group> -Name <your-nat-gateway-name> -Location <your-location> -Sku StandardV2 -PublicIpPrefix $publicIpPrefix
139+
```
140+
141+
3. From your resource group, retrieve the **subnet** you want to migrate from Standard NAT gateway to StandardV2 NAT gateway using the `Get-AzVirtualNetwork` cmdlet.
142+
143+
```powershell
144+
$subnet = Get-AzVirtualNetwork -ResourceGroupName <your-resource-group> -Name <your-vnet-name> | Get-AzVirtualNetworkSubnetConfig -Name <your-subnet-name>
145+
```
146+
147+
4. **Update** the subnet configuration to use the new StandardV2 NAT gateway using the `Set-AzVirtualNetworkSubnetConfig` cmdlet.
148+
149+
```powershell
150+
Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name <your-subnet-name> -NatGateway $natGateway
151+
```
152+
153+
5. **Save** the subnet configuration using the Set-AzVirtualNetwork cmdlet.
154+
155+
```powershell
156+
Set-AzVirtualNetwork -VirtualNetwork $vnet
157+
```
158+
159+
6. Repeat steps 3-5 for each subnet you want to migrate to StandardV2 NAT gateway.
160+
161+
>[!NOTE]
162+
> This migration process doesn't delete your existing Standard NAT gateway or Standard SKU public IP resources.
163+
164+
### Migration using CLI
165+
166+
Use the suggested order of operations for migrating from a Standard SKU NAT gateway to a StandardV2 SKU NAT gateway using CLI.
167+
168+
Before you begin, ensure you meet the following criteria:
169+
170+
- To run CLI reference commands locally, [install](/cli/azure/install-azure-cli) the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see [How to run the Azure CLI in a Docker container](/cli/azure/run-azure-cli-docker).
171+
- If you're using a local installation, sign in to the Azure CLI by using the [az login](/cli/azure/reference-index#az-login) command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see [Authenticate to Azure using Azure CLI](/cli/azure/authenticate-azure-cli).
172+
- When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see [Use and manage extensions with the Azure CLI](/cli/azure/azure-cli-extensions-overview).
173+
- Run [az version](/cli/azure/reference-index?#az-version) to find the version and dependent libraries that are installed. To upgrade to the latest version, run [az upgrade](/cli/azure/reference-index?#az-upgrade).
174+
175+
The following steps should be taken to migrate from Standard NAT gateway to StandardV2 NAT gateway using CLI:
176+
177+
1. Create a new StandardV2 SKU public IP or StandardV2 SKU public IP prefix resource using the az network public-ip create or az network public-ip prefix create cmdlet. Select IPv4 or IPv6 for IP version.
178+
179+
```azurecli-interactive
180+
az network public-ip create \
181+
--resource-group test-rg \
182+
--name public-ip-nat \
183+
--location eastus \
184+
--sku StandardV2 \
185+
--allocation-method Static \
186+
--version IPv4 \
187+
--zone 1 2 3
188+
```
189+
190+
or
191+
192+
```azurecli-interactive
193+
az network public-ip prefix create \
194+
--resource-group test-rg \
195+
--name public-ip-prefix-nat \
196+
--location eastus \
197+
--sku StandardV2 \
198+
--length 28 \
199+
--version IPv4 \
200+
--zone 1 2 3
201+
```
202+
203+
2. Create a new StandardV2 SKU NAT gateway using the az network nat gateway create cmdlet. Make sure to select StandardV2 as the SKU.
204+
205+
```azurecli-interactive
206+
az network nat gateway create \
207+
--resource-group test-rg \
208+
--name nat-gatewayv2 \
209+
--location eastus \
210+
--public-ip-addresses public-ip-nat \
211+
--idle-timeout 4 \
212+
--sku StandardV2 \
213+
--zone 1 2 3
214+
```
215+
216+
3. Replace the Standard NAT gateway on your subnet with your newly created StandardV2 NAT gateway using the az network vnet subnet update cmdlet.
217+
218+
```azurecli-interactive
219+
az network vnet subnet update \
220+
--resource-group test-rg \
221+
--vnet-name myVNet \
222+
--name mySubnet \
223+
--nat-gateway nat-gatewayv2
224+
```
225+
226+
4. Repeat step 3 for each subnet you want to migrate to StandardV2 NAT gateway.
227+
228+
## Post-migration steps
229+
230+
After you migrate your subnets to StandardV2 NAT gateway, we recommend the following post-migration steps.
231+
232+
Validate outbound connectivity to the internet from your virtual machines in the subnets that were migrated to StandardV2 NAT gateway.
233+
234+
Monitor your applications for any issues related to connectivity or performance after the migration.
235+
236+
## Common questions
237+
238+
### Can I use my existing Standard SKU public IPs with StandardV2 NAT gateway?
239+
240+
No, StandardV2 NAT gateway requires the use of StandardV2 public IPs. Existing Standard SKU public IPs aren't compatible with StandardV2 NAT gateway.
241+
242+
### Is there any downtime during the migration?
243+
244+
Yes, migrating from Standard NAT gateway to StandardV2 NAT gateway causes downtime and impacts existing connections. It's recommended to plan for application downtime during the migration and perform the migration during a maintenance window.
245+
246+
### How long is the expected downtime?
247+
248+
The duration of downtime depends on the number of subnets being migrated and the complexity of your network configuration. It's advisable to migrate one subnet at a time and validate connectivity before proceeding to the next subnet to minimize downtime.
249+
250+
### Can I automate the migration process?
251+
252+
Yes, you can use PowerShell or Azure CLI scripts to automate the migration process. The steps provided in this article can be adapted into scripts for automation.
253+
254+
### How do I revert back to Standard NAT gateway if needed?
255+
256+
To revert back to Standard NAT gateway, you need to reattach the subnets to the existing Standard NAT gateway and reassign the original Standard SKU public IPs. This process also involves downtime and impacts existing connections.
257+
258+
### Is my Standard NAT gateway deleted after migration?
259+
260+
No, migrating to StandardV2 NAT Gateway doesn't delete your existing Standard NAT Gateway or Standard SKU public IP resources. You need to manually delete these resources if they're no longer needed. Don't delete these resources until you fully validate that your workloads function as expected with StandardV2 NAT Gateway and you no longer need the Standard NAT Gateway or Standard SKU public IPs.
261+
262+
### How do I validate that the migration is successful?
263+
264+
After migrating your subnets to StandardV2 NAT gateway, you can validate the migration by checking outbound connectivity to the internet from your virtual machines in the migrated subnets. You can also monitor your applications for any connectivity or performance issues. Follow guidance on how to test NAT Gateway connectivity in the Create StandardV2 NAT Gateway article.

‎articles/nat-gateway/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ items:
1313
href: nat-gateway-resource.md
1414
- name: NAT Gateway SKUs
1515
href: nat-sku.md
16+
- name: Migrate NAT Gateway to Standard V2
17+
href: nat-gateway-v2-migrate.md
1618
- name: Reliability
1719
items:
1820
- name: Reliability in Azure NAT Gateway

0 commit comments

Comments
 (0)