azure-virtual-wan

Name: azure-virtual-wan
Author: microsoftdocs

github.com/microsoftdocsCloud & DevOps796170 installsUpdated 3d ago

About azure-virtual-wan

A guidance skill for agents working with Azure Virtual WAN, covering network planning, routing, security, configuration, and deployment. Its local index and remote documentation retrieval support work ranging from troubleshooting to architecture design.

Key features

01Virtual WAN troubleshooting
02Routing and network architecture design
03VPN security and access configuration
04Limits, quotas, and scaling guidance
05PowerShell integration and deployment

Use cases

01Plan hub routing and network isolation
02Configure P2S VPN authentication
03Diagnose Virtual WAN connectivity issues

MCP support

The skill can retrieve remote documentation with mcp_microsoftdocs microsoft_docs_fetch. The input does not describe tools or resources it exposes through MCP.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/microsoftdocs/agent-skills --skill azure-virtual-wan

After installing, type/azure-virtual-wanin Claude Code to confirm it loaded.

Details

From the project README

Azure Virtual WAN Skill

This skill provides expert guidance for Azure Virtual WAN. Covers troubleshooting, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L36-L41	Diagnosing and fixing Virtual WAN issues, including P2S VPN client prerequisite checks, connectivity problems, and using built-in tools and diagnostics for troubleshooting.
Decision Making	L42-L49	Guidance on planning Virtual WAN changes: migrating Linux/P2S VPN clients, switching to Microsoft Entra apps, upgrading Basic→Standard VWAN, and choosing partners/hub locations.
Architecture & Design Patterns	L50-L77	Designing Virtual WAN hub-and-spoke routing, isolation, DR, and global transit patterns, including routing intent, static/BGP routes, firewalls/NVAs, SD-WAN, ExpressRoute, and Microsoft 365 connectivity.
Limits & Quotas	L78-L84	Limits and design guidance for Virtual WAN: P2S client pool sizing, hub routing/throughput caps, and using Private Link endpoints within scale and quota constraints.
Security	L85-L94	Configuring secure P2S VPN access in Virtual WAN using Microsoft Entra ID (MFA, OpenVPN, custom app IDs), Azure VPN Client setup/migration, and hub roles/permissions.
Configuration	L95-L147	Configuring Azure Virtual WAN hubs, routing, NVAs, BGP, IPsec, and P2S/Always On VPN (cert- and Entra-based), including policies, route-maps, client profiles, and monitoring/logging.
Integrations & Coding Patterns	L148-L154	PowerShell and automation patterns for integrating Virtual WAN with ExpressRoute, SD-WAN/VPN CPEs, RADIUS user groups, and sharing services via Azure Private Link
Deployment	L155-L158	PowerShell-based deployment of cross-tenant VNet connections to Virtual WAN hubs and step-by-step setup of integrated NVAs inside Virtual WAN hubs.

Troubleshooting

Topic	URL
Use Azure VPN Client prerequisites check for P2S	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-prerequisites-check
Troubleshooting tools and diagnostics for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-troubleshooting-overview

Decision Making

Topic	URL
Plan migration from Azure VPN Client for Linux	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-linux-retirement
Migrate P2S VPN clients to Microsoft-registered Entra app	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-gateway-update
Decide and perform upgrade from Basic to Standard Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/upgrade-virtual-wan
Select Azure Virtual WAN partners and hub locations	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-locations-partners

Architecture & Design Patterns

Topic	URL
Design routing intent patterns in Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/about-internet-routing
Choose routing preference in Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing-preference
Design disaster recovery architectures for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/disaster-recovery-design
Design selective Azure Firewall bypass in secure hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/firewall-custom-bypass
Combine Azure Firewall and spoke NVAs with static routing	https://learn.microsoft.com/en-us/azure/virtual-wan/hybrid-firewall-spoke-static
Route traffic to indirect spokes with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/indirect-spoke-architecture
Architect China interconnect using Virtual WAN secured hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/interconnect-china
Migrate hub-and-spoke networks to Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology
Deep dive into Azure Virtual WAN routing behavior	https://learn.microsoft.com/en-us/azure/virtual-wan/routing-deep-dive
Use routing intent with static routes in Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/routing-intent-static-route
Connect Microsoft 365 via ExpressRoute private peering in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-365-expressroute-private
Implement any-to-any routing with Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-any-to-any
Configure BGP peering with Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-bgp-peering-hub
Design Virtual WAN routing to isolate VNets	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-isolate-vnets
Configure custom VNet isolation with Virtual WAN routing	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-isolate-vnets-custom
Secure Application Gateway traffic via Virtual WAN secured hub	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-secured-hub-app-gateway
Route to shared services VNets using Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-shared-services-vnet
Integrate private SD-WAN with Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/sd-wan-connectivity-architecture
Inspect north-south traffic with spoke NVAs in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/spoke-inspection-north-south
Design static routing patterns in Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/static-routes
Route Virtual WAN traffic through Azure Firewall	https://learn.microsoft.com/en-us/azure/virtual-wan/static-routes-firewall-basic
Select third-party integrations in Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/third-party-integrations
Choose connectivity options between Azure Virtual WANs	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-connectivity
Design global transit network architecture with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture

Limits & Quotas

Topic	URL
Plan P2S client address pools and scale for Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/about-client-address-pools
Virtual hub routing capabilities and throughput limits	https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing
Configure Azure Virtual WAN Private Link endpoints	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-private-link

Security

Topic	URL
Secure P2S client access to spoke VNets with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/manage-secure-access-resources-spoke-p2s
Enable Microsoft Entra multifactor authentication for VPN users	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-mfa
Configure a Microsoft Entra tenant for Virtual WAN P2S OpenVPN	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant
Configure Entra-based OpenVPN auth with multiple apps	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant-multi-app
Configure Azure VPN Client for P2S with Microsoft Entra ID	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-windows
Assign roles and permissions for Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/roles-permissions

Configuration

Topic	URL
Work with Azure Virtual WAN User VPN client profiles	https://learn.microsoft.com/en-us/azure/virtual-wan/about-vpn-profile-download
Configure optional Azure VPN Client OpenVPN settings	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-optional-configurations
Generate P2S User VPN certificates using PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site
Generate P2S User VPN certificates using MakeCert	https://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site-makecert
Configure BGP peering to NVA in Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-portal
Configure BGP peering to NVAs in Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-powershell
View effective routes for a Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/effective-routes-virtual-hub
Configure and understand Virtual WAN gateway settings	https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings
Configure forced tunneling for Virtual WAN P2S VPN	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-forced-tunnel
Manage IP configurations for NVAs in Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-network-virtual-appliance-add-ip-configurations
Configure DNAT for Virtual WAN integrated NVAs	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-network-virtual-appliance-inbound
Configure Palo Alto Cloud NGFW in Azure Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-palo-alto-cloud-ngfw
Configure routing policies and intent in Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies
Configure Azure Virtual WAN virtual hub routing	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing
Configure virtual hub routing with Azure PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing-powershell
Set Virtual WAN hub routing preference with PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing-preference-powershell
Configure Always On VPN device tunnel for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-always-on-device-tunnel
Configure Always On VPN user tunnel for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-always-on-user-tunnel
Configure Azure Firewall in a Virtual WAN secured hub	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-firewall
Set virtual hub routing preference in Azure portal	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-virtual-hub-routing-preference
Configure Azure Virtual WAN hub settings and scale units	https://learn.microsoft.com/en-us/azure/virtual-wan/hub-settings
Reference monitoring metrics and logs for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan-reference
Use next hop IP and BGP peering in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/next-hop-ip
Configure Azure path selection across multiple WAN links	https://learn.microsoft.com/en-us/azure/virtual-wan/path-selection-multiple-links
Manage Virtual WAN VPN gateway root certificate migration	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-about-gateway-certificate-migration
Generate P2S User VPN certificates on Linux with OpenSSL	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-certificates-linux-openssl
Generate P2S User VPN certificates on Linux with strongSwan	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-certificates-linux-strongswan
Configure Virtual WAN P2S VPN with Entra ID and registered client	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-gateway
Configure custom Entra app ID for P2S VPN authentication	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-register-custom-app
Configure Azure VPN Client on Linux for Entra P2S	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-linux
Configure Azure VPN Client with Entra ID on macOS	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-mac
Use supported IPsec policies for Virtual WAN P2S VPN	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-ipsec
Configure P2S VPN address pools with PowerShell in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-user-groups-powershell
Understand and configure Virtual WAN Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-about
Drop inbound branch routes with Virtual WAN Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-drop-inbound-branch-sites
Configure Route-maps for Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-how-to
Summarize routes leaving Virtual WAN using Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-how-to-summarize-routes-leaving-your-virtual-wan
Prepend routes using Virtual WAN Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-prepend-routes
Summarize NVA spoke routes with Virtual WAN Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-summarize-from-device-spoke-vnet-nva
Tag routes using Virtual WAN Route-maps	https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-tag-routes
Configure user groups and IP pools for Virtual WAN P2S	https://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-about
Configure P2S VPN user groups and IP pools in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-create
Set custom IPsec policies in Azure Virtual WAN portal	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-custom-ipsec-portal
Configure IPsec policy combinations for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-ipsec
Configure Entra ID auth for Virtual WAN P2S VPN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-point-to-site-azure-ad
Create virtual hub route tables to NVAs via PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva
Create virtual hub route tables to NVAs via portal	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva-portal
Configure IPsec over ExpressRoute in Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute
Configure Intune custom profile for Virtual WAN VPN	https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-profile-intune

Integrations & Coding Patterns

Topic	URL
Create ExpressRoute associations to Virtual WAN via PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/expressroute-powershell
Configure RADIUS VSAs for Virtual WAN user groups	https://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-radius
Automate SD-WAN and VPN CPE integration with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-configure-automation-providers

Deployment

Topic	URL
Deploy an integrated NVA in an Azure Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-nva-hub

Comments

Markdown supported

Details

Author: microsoftdocs
Repository: microsoftdocs/agent-skills
Category: Cloud & DevOps
Installs: 170
GitHub stars: 796

Report

More skills

All skills

lark-apps

open.feishu.cn

732.0k

Develop and host Miaoda (Spark/Miaoda) apps: app creation, local full-stack development, cloud generation and iteration, creative design (UI mockups / interactive prototypes / wireframes / landing pages / dashboards / slide decks / visual exploration), integration of AI-related capabilities, Feishu platform capabilities, or other external capabilities; log/Trace/monitoring metric/PV/UV queries; environment variable management; app collaborators and collaboration permissions; app roles and members; and automation triggers (scheduled / record changes / Webhook / Feishu approvals). Use when users want to develop or create a system, tool, platform, or app; develop locally or in the cloud, modify, deploy, publish, launch, or get a shareable link; create a page or website with HTML and deploy it to Miaoda; design, create a mockup, prototype, wireframe, PPT, deck, or visual exploration; or mention Miaoda/Spark/Miaoda apps (links like `/app/app_xxx` or `/page/<token>`, runtime domains like *.aiforce.cloud), app databases, app file storage, open API Keys, visibility, app collaborators/developer permissions, app roles/role members, production logs, API request volume, error volume, latency, traffic, environment variables, or setting up automation tasks, scheduled triggers, or approval-triggered automation for Miaoda apps. Not for regular cloud drive file uploads (lark-drive), Feishu document editing (lark-doc), or native slide creation (lark-slides).

azure-prepare

github.com/microsoft

571.7k

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.

wizard

github.com/mattpocock

571.5k

Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.

azure-ai

github.com/microsoft

571.2k

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.