Review StandardV2 NAT Gateway cutover exceptions before relying on session continuity

Source facts

Microsoft’s StandardV2 known-issues section warns that adding the gateway can interrupt outbound connections using a load balancer, Azure Firewall or VM-level public IP. New outbound connections use StandardV2. It also documents disruption of IPv6 outbound traffic using load-balancer outbound rules when the gateway is associated.

A Standard NAT gateway cannot be upgraded in place to StandardV2: a new gateway must replace it on the subnet. StandardV2 also requires matching StandardV2 public IP addresses or prefixes, not Standard public IPs. Microsoft Learn.

Applicability

Inventory existing outbound methods, long-lived sessions, address-family requirements and receiving-service allowlists. Check current regional support and known issues before selecting this SKU.

DSE recommendation

DSE recommends a bounded cutover with an approved recovery path. Test existing sessions and newly opened connections separately, including IPv6 wherever the workload requires it. Coordinate the changed source identity with downstream owners before association. Do not use general NAT Gateway continuity language to override a documented StandardV2-specific exception.

Verification

Observe representative sessions across the controlled association and record interruption, reconnection and destination-side source addresses. Verify both address families required by the workload. If the intended existing IPv6 path is incompatible, resolve the design before proceeding. Keep the actual gateway and public-IP SKUs in the evidence so a successful test of another configuration is not reused as approval.

Official references

Microsoft Learn: What Is Azure NAT Gateway?. Source retrieved September 9, 2026.