# Check deployment eligibility before proposing a High Bandwidth VPN gateway upgrade

> Review the documented migration and connectivity boundaries of Advanced Connectivity.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-147-check-deployment-eligibility-before-proposing-a-high-bandwidth-vpn-gateway-upgrade/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:33+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Review the documented migration and connectivity boundaries of Advanced Connectivity.

## Potentially affected

Use this review when assessing whether Advanced Connectivity fits an existing network. Identify current gateway functions, ExpressRoute configuration and target region. Read the latest regional and feature limitations directly before approving a design; this article does not establish eligibility for a particular deployment.

## DSE recommendation

DSE recommends a requirement matrix that marks each current dependency against the documented limitations.

## Article

## Source facts

Microsoft’s High Bandwidth tunnel guidance lists no migration path from existing gateways. It describes the capability as operating over ExpressRoute private peering and requires FastPath on the ExpressRoute connection. The documented limitations also exclude point-to-site connections, APIPA BGP addresses, NAT, IPv6 and Virtual WAN interoperability. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-high-bandwidth-tunnel).

## Applicability

Use this review when assessing whether Advanced Connectivity fits an existing network. Identify current gateway functions, ExpressRoute configuration and target region. Read the latest regional and feature limitations directly before approving a design; this article does not establish eligibility for a particular deployment.

## DSE recommendation

DSE recommends a requirement matrix that marks each current dependency against the documented limitations. Treat the absence of a migration path as a planning issue requiring an explicit replacement design. Assign owners for application continuity, address changes and recovery, and reject a simple in-place-upgrade assumption until the complete deployment plan is reviewed.

## Verification

Validate the proposed configuration in an approved isolated environment that meets the documented prerequisites. Check each required tunnel, route and application path, and record any unsupported dependency as an unresolved design issue. Keep observed throughput or connectivity separate from proof that all former gateway functions have an accepted replacement.

## Official references

[Microsoft Learn: Create site-to-site high bandwidth tunnels in the Azure portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-high-bandwidth-tunnel).

## Primary reference

- Name: Create site-to-site high bandwidth tunnels in the Azure portal - Azure VPN Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-high-bandwidth-tunnel
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check deployment eligibility before proposing a High Bandwidth VPN gateway upgrade,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-147-check-deployment-eligibility-before-proposing-a-high-bandwidth-vpn-gateway-upgrade/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.