The default policy set for Azure VPN gateway is listed in the article: About VPN devices and IPsec/IKE parameters for Site-to-Site VPN Gateway connections. As a result, the policies and the number of proposals cannot cover all possible combinations of available cryptographic algorithms and key strengths. The default policy sets were chosen to maximize interoperability with a wide range of third-party VPN devices in default configurations. If you do not request a specific combination of cryptographic algorithms and parameters, Azure VPN gateways use a set of default proposals. IPsec and IKE protocol standard supports a wide range of cryptographic algorithms in various combinations. About IPsec and IKE policy parameters for Azure VPN gateways When IKEv1 and IKEv2 connections are applied to the same VPN gateway, the transit between these two connections is auto-enabled. Note that VPN gateways using IKEv1 might experience up tunnel reconnects during Main mode rekeys. For more information, see VPN Gateway SKUs. In order to enhance the experience of customers using IKEv1 protocols, we are now allowing IKEv1 connections for all of the VPN gateway SKUs, except Basic SKU. The Basic SKUs allow only 1 connection and along with other limitations such as performance, customers using legacy devices that support only IKEv1 protocols were having limited experience. Traditionally we allowed IKEv1 connections for Basic SKUs only and allowed IKEv2 connections for all VPN gateway SKUs other than Basic SKUs. About IKEv1 and IKEv2 for Azure VPN connections This article discusses how you can configure Azure VPN gateways to satisfy your cryptographic requirements for both cross-premises S2S VPN tunnels and VNet-to-VNet connections within Azure.

Vpp connection hash table