{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "slug": "dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool", "url": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/" }, "title": "Map a tenant virtual gateway to its routing subnet and gateway pool", "summary": "Which tenant and routing references must be checked when adding an SDN virtual gateway?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:13+00:00", "modified_at": "2026-09-08T18:23:27+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 204, "potentially_affected": "Administrators adding site-to-site connectivity to SDN tenant virtual networks.", "dse_recommendation": "Have the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership.", "primary_source": { "name": "Add a Virtual Gateway to a Tenant Virtual Network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. Microsoft documentation.

\n

Applicability

\n

Identify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.

\n

DSE recommendation

\n

Have the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.

\n

Verification

\n

After approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.

\n

Official references

\n

Microsoft Learn: Add a Virtual Gateway to a Tenant Virtual Network. Source reviewed September 8, 2026.

", "content_text": "Source facts\nA tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. Microsoft documentation.\nApplicability\nIdentify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.\nDSE recommendation\nHave the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.\nVerification\nAfter approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.\nOfficial references\nMicrosoft Learn: Add a Virtual Gateway to a Tenant Virtual Network. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nA tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network).\n\n## Applicability\n\nIdentify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.\n\n## DSE recommendation\n\nHave the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.\n\n## Verification\n\nAfter approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.\n\n## Official references\n\n[Microsoft Learn: Add a Virtual Gateway to a Tenant Virtual Network](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "url": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Map a tenant virtual gateway to its routing subnet and gateway pool", "item": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "url": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/", "headline": "Map a tenant virtual gateway to its routing subnet and gateway pool", "description": "Which tenant and routing references must be checked when adding an SDN virtual gateway?", "abstract": "Which tenant and routing references must be checked when adding an SDN virtual gateway?", "articleBody": "Source facts\nA tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. Microsoft documentation.\nApplicability\nIdentify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.\nDSE recommendation\nHave the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.\nVerification\nAfter approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.\nOfficial references\nMicrosoft Learn: Add a Virtual Gateway to a Tenant Virtual Network. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:13+00:00", "dateModified": "2026-09-08T18:23:27+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Map a tenant virtual gateway to its routing subnet and gateway pool" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 204, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Add a Virtual Gateway to a Tenant Virtual Network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network" } } ] } }