{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "slug": "dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance", "url": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/" }, "title": "Check Azure UDR next-hop reachability before routing through an appliance", "summary": "Review appliance subnet placement and direct next-hop connectivity before accepting a virtual-appliance route.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:33+00:00", "modified_at": "2026-09-10T00:52:39+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Azure virtual-network subnets routing traffic through network virtual appliances.", "dse_recommendation": "Validate the appliance's subnet and direct next-hop path before associating its route table with workload subnets.", "primary_source": { "name": "Azure virtual network traffic routing | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft advises placing a virtual appliance in a different subnet from the resources routed through it. Applying a route back through an appliance in the same subnet can create a loop that prevents traffic from leaving.

\n

The next-hop private address must be directly reachable; a path that first traverses ExpressRoute or Virtual WAN does not satisfy this requirement. Microsoft describes such an indirect next hop as an invalid UDR configuration. Microsoft Learn.

\n

Applicability

\n

Identify the workload subnet, associated route table, destination prefix, appliance subnet, and proposed next-hop address. Review the actual Azure topology rather than treating a reachable address from an administrator’s device as sufficient evidence.

\n

DSE recommendation

\n

DSE recommends drawing the first hop and return path before changing subnet routing. Have the network owner identify any same-subnet loop or gateway dependency explicitly. Preserve the previous route association and define the traffic that must remain available during the change, including appliance management access.

\n

Verification

\n

On an approved test subnet, inspect effective routes and exercise the intended application flow in both directions. Confirm that the observed next hop matches the reviewed topology. Include an excluded destination and investigate looping or unexpected detours before applying the table to additional workloads.

\n

Official references

\n

Microsoft Learn: Azure virtual network traffic routing. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft advises placing a virtual appliance in a different subnet from the resources routed through it. Applying a route back through an appliance in the same subnet can create a loop that prevents traffic from leaving.\nThe next-hop private address must be directly reachable; a path that first traverses ExpressRoute or Virtual WAN does not satisfy this requirement. Microsoft describes such an indirect next hop as an invalid UDR configuration. Microsoft Learn.\nApplicability\nIdentify the workload subnet, associated route table, destination prefix, appliance subnet, and proposed next-hop address. Review the actual Azure topology rather than treating a reachable address from an administrator’s device as sufficient evidence.\nDSE recommendation\nDSE recommends drawing the first hop and return path before changing subnet routing. Have the network owner identify any same-subnet loop or gateway dependency explicitly. Preserve the previous route association and define the traffic that must remain available during the change, including appliance management access.\nVerification\nOn an approved test subnet, inspect effective routes and exercise the intended application flow in both directions. Confirm that the observed next hop matches the reviewed topology. Include an excluded destination and investigate looping or unexpected detours before applying the table to additional workloads.\nOfficial references\nMicrosoft Learn: Azure virtual network traffic routing. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft advises placing a virtual appliance in a different subnet from the resources routed through it. Applying a route back through an appliance in the same subnet can create a loop that prevents traffic from leaving.\n\nThe next-hop private address must be directly reachable; a path that first traverses ExpressRoute or Virtual WAN does not satisfy this requirement. Microsoft describes such an indirect next hop as an invalid UDR configuration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview).\n\n## Applicability\n\nIdentify the workload subnet, associated route table, destination prefix, appliance subnet, and proposed next-hop address. Review the actual Azure topology rather than treating a reachable address from an administrator’s device as sufficient evidence.\n\n## DSE recommendation\n\nDSE recommends drawing the first hop and return path before changing subnet routing. Have the network owner identify any same-subnet loop or gateway dependency explicitly. Preserve the previous route association and define the traffic that must remain available during the change, including appliance management access.\n\n## Verification\n\nOn an approved test subnet, inspect effective routes and exercise the intended application flow in both directions. Confirm that the observed next hop matches the reviewed topology. Include an excluded destination and investigate looping or unexpected detours before applying the table to additional workloads.\n\n## Official references\n\n[Microsoft Learn: Azure virtual network traffic routing](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "url": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check Azure UDR next-hop reachability before routing through an appliance", "item": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "url": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/", "headline": "Check Azure UDR next-hop reachability before routing through an appliance", "description": "Review appliance subnet placement and direct next-hop connectivity before accepting a virtual-appliance route.", "abstract": "Review appliance subnet placement and direct next-hop connectivity before accepting a virtual-appliance route.", "articleBody": "Source facts\nMicrosoft advises placing a virtual appliance in a different subnet from the resources routed through it. Applying a route back through an appliance in the same subnet can create a loop that prevents traffic from leaving.\nThe next-hop private address must be directly reachable; a path that first traverses ExpressRoute or Virtual WAN does not satisfy this requirement. Microsoft describes such an indirect next hop as an invalid UDR configuration. Microsoft Learn.\nApplicability\nIdentify the workload subnet, associated route table, destination prefix, appliance subnet, and proposed next-hop address. Review the actual Azure topology rather than treating a reachable address from an administrator’s device as sufficient evidence.\nDSE recommendation\nDSE recommends drawing the first hop and return path before changing subnet routing. Have the network owner identify any same-subnet loop or gateway dependency explicitly. Preserve the previous route association and define the traffic that must remain available during the change, including appliance management access.\nVerification\nOn an approved test subnet, inspect effective routes and exercise the intended application flow in both directions. Confirm that the observed next hop matches the reviewed topology. Include an excluded destination and investigate looping or unexpected detours before applying the table to additional workloads.\nOfficial references\nMicrosoft Learn: Azure virtual network traffic routing. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:33+00:00", "dateModified": "2026-09-10T00:52:39+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-143-check-azure-udr-next-hop-reachability-before-routing-through-an-appliance/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check Azure UDR next-hop reachability before routing through an appliance" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure virtual network traffic routing | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview" } } ] } }