VPN Gateway Generations

[dan-dimitrov]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

An error message appears when attempting to deploy the VPN gateway in the hub with the SKU VpnGw5AZ. This deployment automatically determined the gateway generation as generation 1 and the SKU is not available. The following advanced configuration needs to be used in order to successfully deploy the VPN gateway as this SKU.

  advanced = {
    custom_settings_by_resource_type = {
      azurerm_virtual_network_gateway = {
        connectivity = {
          vpngw = {
            (var.connectivity_resources_location) = {
              generation = "Generation2"
            }
          }
        }
      }
    }
  }

It would be good if this could be rectified automatically, or if we can specify the gateway generation manually without using the advanced configuration.

[krowlandson]

Thank you for logging this @dan-dimitrov

Adding this to the input variable schema will be a breaking change so I will try to include this on the v1.2.0 release where we will be introducing other breaking changes if we cannot automatically correlate the generation value based on sku alone.

[krowlandson]

Documented generation to SKU mapping:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#benchmark

[krowlandson]

Considerations for auto-determination of generation by sku:

1. The product team has a preference for customers to move to Generation 2 SKUs
2. Given the overlap between Generation1 and Generation2 SKUs, customers who have already deployed SKUs from VpnGw1 to VpnGw3 will be using Generation1
3. If we auto-set Generation2 for all supported SKUs, customers within the overlapping SKUs (VpnGw1 and VpnGw2) will have their gateways re-deployed.
4. Generation setting is not required for ExpressRoute SKUs.

To avoid unexpected redeployments, we are thinking to tackle this the following way:

1. Auto-set generation for SKU VpnGw4/VpnGw4AZ and above to Generation2
2. Because of consideration 4 above, we will not add the generation attribute within the gateway config input and this will continue to be handled via the advanced block
3. We will target a future release for updating the preference to Generation2 for all supported SKUs

[krowlandson]

Following further discussions around this issue, we have decided to set a preference to Generation2 and will include a breaking change warning in the release notes along with instructions on how to use the advanced block if a customer wants to continue using Generation1.