I have no experience with Azure, so I'm not sure what the vpn is for. I'm assuming that you're doing this to MS? Anyway, you can configure vpns on 8.25, so you may want to find out why they want a version => 8.3. The 8.3 upgrade will tremendously increase your config. It reconfigures your nat rules. Now, you have static nats that look like: static (inside,outside) 1.1.1.1 192.168.1.1 netmask 255.255.255.255 After 8.3, you'll have an object for every address that you have on top of a nat rule: object obj_1.1.1.1  host 1.1.1.1 object obj_192.168.1.1 host 192.168.1.1 nat (inside,outside) static 1.1.1.1   The above is a quick example. The conversion utility will make many changes to your nat static and dynamic rules. This is a major upgrade, and Cisco even recommended to me to have a 3-hour outage window for troubleshooting purposes. Another note, as you can see above it's going to tremendously increase the amount of lines that you have in your config. You may also be surprised to find out that (well, in my case at least) there was a lot of redundancy in the converted config. I swear I had 50 "obj_192.168.1.0" objects. They were configured like: obj_192.168.1.0 obj_192.168.1.0_1 obj_192.168.1.0_2 etc. For whatever reason, the converter didn't take the one object and apply it to several rules, but instead created an object for each rule. The other side of this is that you're on an old version of IOS, so upgrading would be a good thing for that alone. You will want to make sure that your hardware can run the new version as there are some requirements (like some models require 2Gb of ram). I wouldn't let a vendor tell me I must be on a new version unless they can give me a good reason why. As far as I know, vpn didn't change between versions so that wouldn't keep you from being able to get a tunnel up with them. HTH, John ... View more