Site-to-Site (S2S) VPN connections are a critical component of hybrid connectivity between Azure and on-premises environments. A tunnel outage can impact applications, user access, and business operations. Although Azure VPN Gateway automatically attempts to re-establish a tunnel when connectivity is restored, administrators should be notified immediately when a tunnel disconnects so they can quickly investigate and mitigate the issue.
In this article, you'll learn how to configure an Azure Monitor alert that automatically notifies administrators whenever an Azure VPN Gateway tunnel enters a disconnected state.
Why monitor VPN tunnel status?
VPN tunnels can disconnect for a variety of reasons, including:
- Internet connectivity issues
- On-premises VPN device failures
- IPSec/IKE negotiation issues
- Network maintenance activities
- Device reboots or software upgrades
By implementing proactive monitoring, organizations can:
- Reduce Mean Time to Detection (MTTD)
- Improve network availability
- Receive automated notifications
Step 1: Enable VPN Gateway diagnostic logs
Before creating an alert rule, ensure that diagnostic logging is enabled for your VPN Gateway.
- Navigate to Azure Monitor in the Azure portal.
- Under Settings, select Diagnostic settings.
- Select the appropriate Subscription, Resource Group, and Resource Type, then choose your VPN Gateway resource.
- Click Add diagnostic setting.
- Provide a name for the diagnostic setting and select AllLogs (or at minimum TunnelDiagnosticLog).
- Choose Send to Log Analytics Workspace (or Event Hub / Storage Account, as required).
- Click Save to apply the diagnostic setting.
Step 2: Create an alert rule
After enabling diagnostics, navigate to Azure Portal > Monitor > Alerts, and select Create > Alert Rule.
Scope
Select Scope and click Select scope. In the resource selection pane, choose your Virtual Network Gateway (VPN Gateway) resource and click Apply. This sets the VPN Gateway as the target resource for the alert rule.
Condition
On the Condition tab, select Custom log search as the signal name and choose Aggregated logs as the query type.
Enter the following KQL query to identify VPN tunnel disconnection events during the last 10 minutes:
AzureDiagnostics
| where TimeGenerated > ago(10m)
| where Category == "TunnelDiagnosticLog"
| where status_s == "Disconnected"
| project TimeGenerated, Resource, status_s
Configure the measurement settings as follows:
- Measure: Table rows
- Aggregation type: Count
- Aggregation granularity: 5 minutes
- Threshold type: Static
- Operator: Greater than
- Threshold value: 0
This configuration triggers an alert whenever one or more tunnel disconnection events are detected.
Actions
On the Actions tab, select Use action groups and either choose an existing action group or create a new one. Configure the action group to send notifications through email, SMS, webhook, or other supported notification channels when a VPN tunnel disconnection event is detected. You can also customize the email subject to make alert notifications easier to identify and manage.
Details
On the Details tab, provide a meaningful Alert Rule Name, select the appropriate Severity, and add a brief description of the alert. This information will help operations teams quickly understand the purpose and importance of the alert when it is triggered.
Review + create
Review all configuration settings to ensure they are correct, then select Create to deploy the alert rule. Azure Monitor will begin evaluating the configured query and automatically notify the specified recipients whenever a VPN tunnel enters a disconnected state.
Summary
By combining Azure VPN Gateway diagnostic logs with Azure Monitor alert rules, organizations can proactively monitor VPN tunnel health and receive near real-time notifications when a tunnel disconnects. This approach improves operational visibility, reduces troubleshooting time, and helps maintain reliable hybrid connectivity between Azure and on-premises networks.
Microsoft