I need help setting up a VPN gateway for an existing Virtual Network

Question

I need help setting up a VPN gateway for an existing Virtual Network

Terry Phillips 21

I am trying to set up a VPN gateway so that developers can remotely access certain VMs in Azure. I am confused about the exact steps to do this with our existing network.

Vallepu Venkateswarlu 9,830 Reputation points Microsoft External Staff Moderator

2026-05-15T16:46:07.7633333+00:00
Hi Terry Phillips,

Welcome to Microsoft Q&A Platform.

Based on your scenario, you have an existing Virtual Network (VNet) containing Virtual Machines (VMs), and the requirement is to allow developers to connect through VPN and access those VMs.

To configure this setup, please ensure the following prerequisite is completed:

Verify that the VNet contains a subnet named GatewaySubnet.

If the subnet does not exist, create a subnet with the exact name GatewaySubnet within the existing VNet.

It is recommended to allocate a subnet range of /27 or larger to support the Virtual Network Gateway deployment.

The GatewaySubnet is a mandatory requirement for deploying the Azure VPN Gateway, which enables secure VPN connectivity into the VNet.

Follow the Create and manage a VPN gateway using the Azure portal and Configure server settings for P2S VPN Gateway certificate authentication

Test connectivity

For P2S, install and run the VPN client from your workstation and verify you can RDP/SSH into the target VMs. Ref: Configure native VPN client client for P2S certificate authentication connections - Windows

Please "upvote" if the information helped you. This will help us and others in the community as well.
Terry Phillips 21 Reputation points

2026-05-15T18:23:58.7+00:00

Hi and thank you for the prompt response. I did try to go down that road but my network has the subnet 10.0.0.0/24 already so there is are no available addresses left to give the GatewaySubnet. Is there a way to safely take some of the addresses from the subnet and allocate it to the GatewaySubnet?
Vallepu Venkateswarlu 9,830 Reputation points Microsoft External Staff Moderator

2026-05-15T21:22:58.4766667+00:00
Hi Terry Phillips,

Since the entire VNet address space: 10.0.0.0/24 is currently consumed by a single subnet, you would need to resize/split that subnet to create space for the required GatewaySubnet.

Note: Azure does not allow changing a subnet address range while resources are attached to the subnet.

You can add an additional address space to the existing VNet and place the GatewaySubnet in that new range.

Current configuration:

VNet address space: 10.0.0.0/24 Existing subnet: 10.0.0.0/24

Add an additional VNet address space: 10.0.1.0/24

Then create: GatewaySubnet: 10.0.1.0/27

No VNet peering is required because both address ranges belong to the same VNet. Azure automatically routes traffic between subnets/address spaces within a VNet.

Ref: Add or remove an address range

Important considerations:

Azure VPN Gateway requires a dedicated subnet named exactly: GatewaySubnet

Microsoft recommends /27 or larger for production deployments.

Reference: About VPN Gateway configuration settings

Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer accepted by question author

Andreas Baumgarten 132K MVP Volunteer Moderator

Hi @Terry Phillips ,

it is possible to increase the IP Address space of the Virtual Network from /24 to /16.

If your Virtual Network is 10.0.0.0/24 with a related subnet of 10.0.0.0/24 you can extend the IP Address space of the Virtual Network to 10.0.0/16.

User's image

This way you are able to create the GatewaySubnet with for instance 10.0.1.0/27.

User's image

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

0 comments

1 additional answer

Your answer

Vallepu Venkateswarlu 9,830 Reputation points Microsoft External Staff Moderator

2026-05-15T16:46:07.7633333+00:00

Hi Terry Phillips,

Welcome to Microsoft Q&A Platform.

Based on your scenario, you have an existing Virtual Network (VNet) containing Virtual Machines (VMs), and the requirement is to allow developers to connect through VPN and access those VMs.

To configure this setup, please ensure the following prerequisite is completed:

Verify that the VNet contains a subnet named GatewaySubnet.

If the subnet does not exist, create a subnet with the exact name GatewaySubnet within the existing VNet.

It is recommended to allocate a subnet range of /27 or larger to support the Virtual Network Gateway deployment.

The GatewaySubnet is a mandatory requirement for deploying the Azure VPN Gateway, which enables secure VPN connectivity into the VNet.

Follow the Create and manage a VPN gateway using the Azure portal and Configure server settings for P2S VPN Gateway certificate authentication

Test connectivity

For P2S, install and run the VPN client from your workstation and verify you can RDP/SSH into the target VMs. Ref: Configure native VPN client client for P2S certificate authentication connections - Windows

Please "upvote" if the information helped you. This will help us and others in the community as well.
Terry Phillips 21 Reputation points

2026-05-15T18:23:58.7+00:00

Hi and thank you for the prompt response. I did try to go down that road but my network has the subnet 10.0.0.0/24 already so there is are no available addresses left to give the GatewaySubnet. Is there a way to safely take some of the addresses from the subnet and allocate it to the GatewaySubnet?
Vallepu Venkateswarlu 9,830 Reputation points Microsoft External Staff Moderator

2026-05-15T21:22:58.4766667+00:00

Hi Terry Phillips,

Since the entire VNet address space: 10.0.0.0/24 is currently consumed by a single subnet, you would need to resize/split that subnet to create space for the required GatewaySubnet.

Note: Azure does not allow changing a subnet address range while resources are attached to the subnet.

You can add an additional address space to the existing VNet and place the GatewaySubnet in that new range.

Current configuration:

VNet address space: 10.0.0.0/24 Existing subnet: 10.0.0.0/24

Add an additional VNet address space: 10.0.1.0/24

Then create: GatewaySubnet: 10.0.1.0/27

No VNet peering is required because both address ranges belong to the same VNet. Azure automatically routes traffic between subnets/address spaces within a VNet.

Ref: Add or remove an address range

Important considerations:

Azure VPN Gateway requires a dedicated subnet named exactly: GatewaySubnet

Microsoft recommends /27 or larger for production deployments.

Reference: About VPN Gateway configuration settings

Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer 1

Andreas Baumgarten 132K MVP Volunteer Moderator

Hi @Terry Phillips ,

if there is an existing virtual network in your Azure environment please take a look here:

Tutorial: Create and manage a VPN gateway using the Azure portal

More information regarding the Point-To-Site VPN connections you will find here: About Point-to-Site VPN

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

0 comments

Share via

I need help setting up a VPN gateway for an existing Virtual Network

1 additional answer

Your answer