Skip to content
LiveNew tools this week
Submit
AIMarketly
azure-virtual-wan logo

Azure Virtual WAN Skill

azure-virtual-wan

Expert knowledge for Azure Virtual WAN development including troubleshooting, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when designing Virtual WAN hubs, P2S/Always On VPN, BGP/NVA routing, Express...

MicrosoftDocs/Agent-Skills0installs772stars

SKILL.md

Full skill instructions

Azure Virtual WAN Skill

This skill provides expert guidance for Azure Virtual WAN. Covers troubleshooting, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/​markdown. Returns Markdown.

Category Index

CategoryLinesDescription
TroubleshootingL36-L41Diagnosing and fixing Virtual WAN issues, including P2S VPN client prerequisite checks, connectivity problems, and using built-in tools and diagnostics for troubleshooting.
Decision MakingL42-L49Guidance on planning Virtual WAN deployments: using NVAs in hubs, migrating Linux VPN clients, upgrading from Basic to Standard, and choosing partners and hub locations.
Architecture & Design PatternsL50-L78Designing and troubleshooting Azure Virtual WAN architectures: routing patterns, hub-and-spoke and global transit designs, security/​firewall integration, SD-WAN, isolation, DR, and Microsoft 365 connectivity.
Limits & QuotasL79-L84P2S VPN client IP pool sizing, scale limits, and Virtual WAN hub routing capabilities, throughput caps, and performance constraints
SecurityL85-L96Configuring secure P2S VPN access in Virtual WAN using Microsoft Entra ID (MFA, OpenVPN, custom app IDs), Azure VPN Client setup/​migration, and hub roles/​permissions.
ConfigurationL97-L149Configuring Azure Virtual WAN hubs, routing, BGP/​NVA integration, P2S/​Always On VPN (certs, Entra ID, IPsec, NAT, client profiles), firewall/​NGFW, monitoring, and advanced route-maps.
Integrations & Coding PatternsL150-L157PowerShell and automation patterns for integrating Virtual WAN with ExpressRoute, SD-WAN/​VPN CPEs, RADIUS user groups, and sharing services via Azure Private Link
DeploymentL158-L162PowerShell-based deployment of cross-tenant VNet connections to Virtual WAN hubs and step-by-step setup of integrated NVAs inside Virtual WAN hubs.

Troubleshooting

TopicURL
Use Azure VPN Client prerequisites check for P2Shttps://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-prerequisites-check
Troubleshooting tools and diagnostics for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-troubleshooting-overview

Decision Making

TopicURL
Use Network Virtual Appliances in a Virtual WAN hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/about-nva-hub
Plan migration from Azure VPN Client for Linuxhttps://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-linux-retirement
Decide and perform upgrade from Basic to Standard Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/upgrade-virtual-wan
Select Azure Virtual WAN partners and hub locationshttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-locations-partners

Architecture & Design Patterns

TopicURL
Routing intent patterns to secure internet accesshttps://learn.microsoft.com/en-us/azure/virtual-wan/about-internet-routing
Choose routing preference in Azure Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing-preference
Design disaster recovery architecture for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/disaster-recovery-design
Design selective Azure Firewall bypass in secure hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/firewall-custom-bypass
Combine Azure Firewall and spoke NVAs with static routinghttps://learn.microsoft.com/en-us/azure/virtual-wan/hybrid-firewall-spoke-static
Route traffic to indirect spokes with Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/indirect-spoke-architecture
Architect China interconnect using Virtual WAN secured hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/interconnect-china
Migrate hub-and-spoke networks to Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology
Deep dive into Azure Virtual WAN routing behaviorhttps://learn.microsoft.com/en-us/azure/virtual-wan/routing-deep-dive
Use routing intent with static routes in Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/routing-intent-static-route
Connect Microsoft 365 via ExpressRoute private peering in Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-365-expressroute-private
Implement any-to-any routing with Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-any-to-any
Configure BGP peering with Azure Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-bgp-peering-hub
Design Virtual WAN routing to isolate VNetshttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-isolate-vnets
Configure custom VNet isolation with Virtual WAN routinghttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-isolate-vnets-custom
Secure Application Gateway traffic via Virtual WAN secured hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-secured-hub-app-gateway
Route to shared services VNets using Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/scenario-shared-services-vnet
Integrate private SD-WAN with Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/sd-wan-connectivity-architecture
Inspect north-south traffic with spoke NVAs in Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/spoke-inspection-north-south
Design static routing patterns in Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/static-routes
Route Virtual WAN traffic through Azure Firewallhttps://learn.microsoft.com/en-us/azure/virtual-wan/static-routes-firewall-basic
Select third-party integrations in Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/third-party-integrations
Design hub-and-spoke with Virtual WAN and Network Managerhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-network-manager-integration
Choose connectivity options between Azure Virtual WANshttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-connectivity
Design global transit network architecture with Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture

Limits & Quotas

TopicURL
Plan P2S client address pools and scale for Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/about-client-address-pools
Virtual hub routing capabilities and throughput limitshttps://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing

Security

TopicURL
Secure P2S client access to spoke VNets with Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/manage-secure-access-resources-spoke-p2s
Enable Microsoft Entra multifactor authentication for VPN usershttps://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-mfa
Configure a Microsoft Entra tenant for Virtual WAN P2S OpenVPNhttps://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant
Configure Entra-based OpenVPN auth with multiple appshttps://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant-multi-app
Migrate P2S VPN to Microsoft-registered Azure VPN Client apphttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-gateway-update
Create custom Entra app IDs for P2S VPN authenticationhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-register-custom-app
Configure Azure VPN Client for P2S with Microsoft Entra IDhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-windows
Assign roles and permissions for Azure Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/roles-permissions

Configuration

TopicURL
Work with Azure Virtual WAN User VPN client profileshttps://learn.microsoft.com/en-us/azure/virtual-wan/about-vpn-profile-download
Configure optional Azure VPN Client OpenVPN settingshttps://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-optional-configurations
Generate P2S User VPN certificates using PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site
Generate P2S User VPN certificates using MakeCerthttps://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site-makecert
Configure BGP peering to NVA in Virtual WAN hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-portal
Configure BGP peering from Virtual WAN hub to NVA (PowerShell)https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-powershell
View effective routes for a Virtual WAN hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/effective-routes-virtual-hub
Configure and understand Virtual WAN gateway settingshttps://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings
Configure forced tunneling for Virtual WAN P2S VPNhttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-forced-tunnel
Manage IP configurations for NVAs in Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-network-virtual-appliance-add-ip-configurations
Configure DNAT for Virtual WAN integrated NVAshttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-network-virtual-appliance-inbound
Configure Palo Alto Cloud NGFW in Azure Virtual WAN hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-palo-alto-cloud-ngfw
Configure Virtual WAN hub routing policies (intent)https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies
Configure Azure Virtual WAN virtual hub routinghttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing
Configure virtual hub routing with Azure PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing-powershell
Set virtual hub routing preference with PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing-preference-powershell
Configure Always On VPN device tunnel for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/howto-always-on-device-tunnel
Configure Always On VPN user tunnel for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/howto-always-on-user-tunnel
Configure Azure Firewall in a Virtual WAN secured hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/howto-firewall
Set virtual hub routing preference in Azure portalhttps://learn.microsoft.com/en-us/azure/virtual-wan/howto-virtual-hub-routing-preference
Configure Azure Virtual WAN hub settings and scale unitshttps://learn.microsoft.com/en-us/azure/virtual-wan/hub-settings
Reference monitoring metrics and logs for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan-reference
Configure VPN NAT rules on Azure Virtual WAN gatewayshttps://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway
Configure VPN NAT rules for Virtual WAN using PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway-powershell
Use next hop IP and BGP peering in Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/next-hop-ip
Configure Azure path selection across multiple WAN linkshttps://learn.microsoft.com/en-us/azure/virtual-wan/path-selection-multiple-links
Manage Virtual WAN P2S gateway certificate rotationhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-about-gateway-certificate-migration
Generate P2S User VPN certificates on Linux with OpenSSLhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-certificates-linux-openssl
Generate P2S User VPN certificates on Linux with strongSwanhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-certificates-linux-strongswan
Configure Virtual WAN P2S VPN with Entra ID and registered clienthttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-gateway
Configure Azure VPN Client with Entra ID on Linuxhttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-linux
Configure Azure VPN Client with Entra ID on macOShttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-mac
Reference IPsec policy combinations for Virtual WAN P2Shttps://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-ipsec
Understand and configure Virtual WAN Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-about
Drop inbound branch routes with Virtual WAN Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-drop-inbound-branch-sites
Configure Route-maps for Azure Virtual WAN hubshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-how-to
Summarize routes leaving Virtual WAN using Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-how-to-summarize-routes-leaving-your-virtual-wan
Prepend routes using Virtual WAN Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-prepend-routes
Summarize NVA spoke routes with Virtual WAN Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-summarize-from-device-spoke-vnet-nva
Tag routes using Virtual WAN Route-mapshttps://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-tag-routes
Understand user groups and IP pools for P2S VPNhttps://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-about
Configure P2S user groups and IP address poolshttps://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-create
Configure custom IPsec policies for Virtual WAN in the portalhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-custom-ipsec-portal
Reference IPsec policy combinations for Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-ipsec
Configure Virtual WAN P2S with Entra ID authhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-point-to-site-azure-ad
Create virtual hub route tables to NVAs via PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva
Create virtual hub route tables to NVAs via portalhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva-portal
Configure IPsec over ExpressRoute in Azure Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute
Create Intune custom profiles for Azure VPN clientshttps://learn.microsoft.com/en-us/azure/virtual-wan/vpn-profile-intune

Integrations & Coding Patterns

TopicURL
Create ExpressRoute associations to Virtual WAN via PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/expressroute-powershell
Share Azure Private Link services via Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/howto-private-link
Configure RADIUS VSAs for Virtual WAN user groupshttps://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-radius
Automate SD-WAN and VPN CPE integration with Virtual WANhttps://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-configure-automation-providers

Deployment

TopicURL
Connect cross-tenant VNets to Virtual WAN hubs with PowerShellhttps://learn.microsoft.com/en-us/azure/virtual-wan/cross-tenant-vnet
Deploy an integrated NVA in an Azure Virtual WAN hubhttps://learn.microsoft.com/en-us/azure/virtual-wan/how-to-nva-hub