Monitor Azure Virtual WAN

This guide explains how to monitor the health, performance, and usage of an Azure Virtual WAN environment using Azure Portal, Azure Monitor, PowerShell, and Azure CLI.

Prerequisites

Owner or Reader role on the Virtual WAN resource.
Azure Monitor workspace enabled.
Azure PowerShell 10.0+ or Azure CLI 2.30+.

Monitoring via Azure Portal

Navigate to Virtual WAN in the Azure portal.
Select your Virtual WAN instance.
Open the Insights blade.
Review the charts for Throughput, Connection health, and VPN gateway status.

Monitoring via Azure Monitor

Azure Monitor provides Metrics and Logs for Virtual WAN. Use the following metric names:

Metric	Description
VpnTunnelIngressBytes	Ingress traffic per VPN tunnel.
VpnTunnelEgressBytes	Egress traffic per VPN tunnel.
ConnectionHealth	Overall health status of a connection.
HubThroughput	Total throughput of a hub.

Example query for connection health:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT_NETWORK"
| where Category == "VirtualWANConnectionHealth"
| summarize arg_max(TimeGenerated, *) by ConnectionId
| project TimeGenerated, ConnectionId, HealthState, Details

Monitoring via PowerShell

Run the following script to fetch health status of all connections:

Connect-AzAccount
$wan = Get-AzVirtualWan -ResourceGroupName "myResourceGroup" -Name "myVirtualWan"
$connections = Get-AzVirtualHubConnection -VirtualHubName $wan.Name -ResourceGroupName $wan.ResourceGroupName
foreach ($c in $connections) {
    $status = (Get-AzVirtualHubConnectionHealth -VirtualHubName $wan.Name -Name $c.Name -ResourceGroupName $wan.ResourceGroupName).HealthState
    Write-Host "$($c.Name): $status"
}

Monitoring via Azure CLI

Use the following command to list hub metrics:

az monitor metrics list \\
  --resource /subscriptions//resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualWans/myVirtualWan/hubs/myHub \\
  --metric "HubThroughput" "VpnTunnelEgressBytes" \\
  --interval PT5M \\
  --aggregation Average

FAQ

How often are metrics updated?: Metrics are refreshed every 5 minutes. Logs may have up to a 15‑minute latency.
Can I set alerts on connection health?: Yes. Create an alert rule in Azure Monitor using the ConnectionHealth metric with a threshold of Degraded or Unhealthy.