Azure VPN keeps disconnecting

Common causes of Azure VPN disconnects

Token and client lifecycle

• VPN clients authenticate with Entra ID (Azure AD). If the refresh token or session expires, the client may drop the connection and try to reconnect.
• One-time or short-lived certificates can also cause sign-out or re-authentication prompts.
• Outdated Azure VPN Client versions can mishandle token refresh or keepalive signals.

Idle timeouts and long-running sessions

• Many VPN gateways and clients terminate idle connections after a period of inactivity.
• If your users leave their devices idle or the connection appears unused, you may see disconnects and immediate reconnects.

Client device behavior

• When a user locks the computer or the VPN client runs in the background, some configurations drop the tunnel to save power.
• VPN clients on laptops can behave differently when the device enters sleep or hibernation.

Gateway and VPN tunnel configuration

• Site-to-Site and Point-to-Site have different idle and keepalive behaviors.
• Mismatches in IPsec/IKE parameters, phase 1/2 lifetimes, and dead-peer detection settings can cause frequent drops.

Network and device Edge cases

• Intermediate firewalls or NAT devices can disrupt long-lived VPN sessions.
• On-premises VPN devices that are not validated or not regularly updated may reset the tunnel.

Troubleshooting steps you can take

Start with the client and token lifecycle

• Verify the Azure VPN Client version in use is up to date.
• Check the authentication method: if you use certificate-based or token-based, ensure certificates are valid and tokens refresh as expected.
• Look for sign-in prompts or token expiry messages. Consider increasing token lifetimes if policy allows.

Tackle idle timeouts and keepalive settings

• Confirm idle timeout values on the VPN gateway. If they’re too low, increase them to allow longer activity before a drop.
• Review keepalive settings:
• For OpenVPN-based setups, ensure keepalive parameters are appropriate (examples: keepalive 10 120 or similar values depending on your environment).
• For IKEv2/IPsec VPNs, ensure Dead Peer Detection (DPD) and rekey timers align between client and gateway.

Check device behavior during lock or suspend

• If users report disconnects when the device is locked, test with:
• Disabling power-saving network throttling on Windows/macOS.
• Ensuring the VPN client remains active during lock (depending on OS policies).
• Consider policy adjustments to keep the tunnel alive during short lock events if business needs require it.

Validate gateway and VPN configuration

• Ensure you are using a validated VPN device and supported OS versions for Site-to-Site if applicable.
• Check that the VPN gateway’s tunings (IKE/ESP, lifetimes, and rekey intervals) match client expectations.
• Review and, if needed, reconfigure the gateway to align with recommended Microsoft troubleshooting guidance.

Monitor for external network disruptions

• Look for frequent drops that coincide with router resets, ISP hiccups, or firewall changes.
• If the issue occurs only at certain sites or for certain users, isolate the network path to identify local problems.

Practical configuration checks and recommendations

• Keep the Azure VPN Client and all related network adapters up to date.
• Align token lifetimes and refresh behavior with your Entra ID policy. Ensure refresh tokens don’t expire unexpectedly during a session.
• Set reasonable idle timeouts on both client and gateway to balance security and continuity.
• Use consistent IKE/ESP lifetimes across the gateway and clients:
• For IPsec-based Point-to-Site, ensure phase 1 and phase 2 lifetimes match your gateway’s defaults.
• For OpenVPN-based configurations, tuning keepalive values can significantly reduce disconnects.
• Validate devices on the list of supported or validated VPN devices and OS versions to avoid incompatibilities.

A practical comparison: common fixes by scenario

Real-world patterns and what to watch

• If you see a pattern like “disconnects every hour,” token lifetimes or refresh token expiry are a strong suspect. The Azure VPN client may be attempting a refresh and failing, causing a disconnect.
• If disconnects cluster around device state changes (lock screen, sleep, resume), focus on OS power management and client resiliency.
• If sites experience intermittent drops across multiple users, the gateway and site-to-site configuration (lifetime values, DPD, rekey intervals) is a likely factor.

How to test fixes without impacting users

• Implement a staged rollout: apply a new idle timeout or keepalive setting to a subset of users first.
• Monitor connection logs for the VPN client, gateway, and any on-prem devices for a week to observe changes.
• Use a controlled test device to reproduce the issue with lock/unlock, idle, and network changes.

When to escalate or seek Microsoft support

• If after applying recommended fixes, disconnections persist consistently across multiple users and sites.
• If logs indicate token or authentication failures that you cannot resolve within policy.
• If gateway hardware or firmware shows warnings or inconsistencies in the MS troubleshooting guidance.

Recommendation Fixing your VPN when it won't work with at&t

• Start with the client and gateway lifetimes: ensure token refresh works, update the VPN client, and align idle and keepalive settings.
• Prioritize resolving lock/suspend related drops by adjusting device power management and client behavior.
• Verify gateway configurations against Microsoft’s troubleshooting guides for VPN gateway disconnections and ensure you’re using validated devices.
• If you still see instability, collect comprehensive logs (client VPN logs, gateway logs, and network traces) and open a support case with Microsoft to review token lifetimes, DPD behavior, and rekey parameters.

Final note

Azure VPN disconnects can be caused by a mix of client-side, gateway, and network factors. A systematic approach, starting with authentication lifetimes, then idle/keepalive settings, followed by device and gateway validation, produces steady improvements. By aligning configurations, updating software, and monitoring outcomes, you can reduce the frequency of disconnects and keep users connected more reliably.