{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "slug": "dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings", "url": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/" }, "title": "Keep a Virtual WAN BGP peer out of dynamic NAT mappings", "summary": "When the on-premises peering address needs translation, the documented design uses a separate static mapping and the translated link address.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:34+00:00", "modified_at": "2026-09-10T01:23:48+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "BGP-enabled Virtual WAN site-to-site VPN connections using dynamic NAT for overlapping address ranges.", "dse_recommendation": "Review the BGP peer's static mapping and link address separately from the dynamic application-address pool.", "primary_source": { "name": "Configure VPN NAT rules for your gateway - Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says the on-premises BGP peer cannot be included in a dynamic rule’s pre-NAT mapping because the translated address and port are not fixed. If that peer needs translation, the documented approach is a separate static rule for the peering address.

\n

The VPN site’s link-connection BGP address must then use the translated address. The guidance also excludes site-to-site connections that use policy-based traffic selectors from this NAT capability. Microsoft Learn.

\n

Applicability

\n

Identify the original peer address, intended translated peer address, dynamic application range and connection type. Keep the routing-control endpoint distinct from the traffic whose overlapping addresses motivated NAT.

\n

DSE recommendation

\n

DSE recommends a mapping worksheet that shows the BGP peer’s dedicated static translation alongside the dynamic pool. Have both VPN owners check the link-connection setting and expected route advertisements before the change. Do not assume that a working translated application flow demonstrates the BGP peering configuration is correct. Review the full source for ingress, egress and route-translation settings.

\n

Verification

\n

In an approved test connection, inspect the deployed NAT rules and the configured BGP link address, then verify peering and learned routes. Exercise an intended translated application path and its return traffic separately. Retain the original and translated identities with the observed routes so future address changes do not accidentally move the control-plane peer into the dynamic mapping.

\n

Official references

\n

Microsoft Learn: Configure VPN NAT rules for your gateway. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft says the on-premises BGP peer cannot be included in a dynamic rule’s pre-NAT mapping because the translated address and port are not fixed. If that peer needs translation, the documented approach is a separate static rule for the peering address.\nThe VPN site’s link-connection BGP address must then use the translated address. The guidance also excludes site-to-site connections that use policy-based traffic selectors from this NAT capability. Microsoft Learn.\nApplicability\nIdentify the original peer address, intended translated peer address, dynamic application range and connection type. Keep the routing-control endpoint distinct from the traffic whose overlapping addresses motivated NAT.\nDSE recommendation\nDSE recommends a mapping worksheet that shows the BGP peer’s dedicated static translation alongside the dynamic pool. Have both VPN owners check the link-connection setting and expected route advertisements before the change. Do not assume that a working translated application flow demonstrates the BGP peering configuration is correct. Review the full source for ingress, egress and route-translation settings.\nVerification\nIn an approved test connection, inspect the deployed NAT rules and the configured BGP link address, then verify peering and learned routes. Exercise an intended translated application path and its return traffic separately. Retain the original and translated identities with the observed routes so future address changes do not accidentally move the control-plane peer into the dynamic mapping.\nOfficial references\nMicrosoft Learn: Configure VPN NAT rules for your gateway. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft says the on-premises BGP peer cannot be included in a dynamic rule’s pre-NAT mapping because the translated address and port are not fixed. If that peer needs translation, the documented approach is a separate static rule for the peering address.\n\nThe VPN site’s link-connection BGP address must then use the translated address. The guidance also excludes site-to-site connections that use policy-based traffic selectors from this NAT capability. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway).\n\n## Applicability\n\nIdentify the original peer address, intended translated peer address, dynamic application range and connection type. Keep the routing-control endpoint distinct from the traffic whose overlapping addresses motivated NAT.\n\n## DSE recommendation\n\nDSE recommends a mapping worksheet that shows the BGP peer’s dedicated static translation alongside the dynamic pool. Have both VPN owners check the link-connection setting and expected route advertisements before the change. Do not assume that a working translated application flow demonstrates the BGP peering configuration is correct. Review the full source for ingress, egress and route-translation settings.\n\n## Verification\n\nIn an approved test connection, inspect the deployed NAT rules and the configured BGP link address, then verify peering and learned routes. Exercise an intended translated application path and its return traffic separately. Retain the original and translated identities with the observed routes so future address changes do not accidentally move the control-plane peer into the dynamic mapping.\n\n## Official references\n\n[Microsoft Learn: Configure VPN NAT rules for your gateway](https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "url": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep a Virtual WAN BGP peer out of dynamic NAT mappings", "item": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "url": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/", "headline": "Keep a Virtual WAN BGP peer out of dynamic NAT mappings", "description": "When the on-premises peering address needs translation, the documented design uses a separate static mapping and the translated link address.", "abstract": "When the on-premises peering address needs translation, the documented design uses a separate static mapping and the translated link address.", "articleBody": "Source facts\nMicrosoft says the on-premises BGP peer cannot be included in a dynamic rule’s pre-NAT mapping because the translated address and port are not fixed. If that peer needs translation, the documented approach is a separate static rule for the peering address.\nThe VPN site’s link-connection BGP address must then use the translated address. The guidance also excludes site-to-site connections that use policy-based traffic selectors from this NAT capability. Microsoft Learn.\nApplicability\nIdentify the original peer address, intended translated peer address, dynamic application range and connection type. Keep the routing-control endpoint distinct from the traffic whose overlapping addresses motivated NAT.\nDSE recommendation\nDSE recommends a mapping worksheet that shows the BGP peer’s dedicated static translation alongside the dynamic pool. Have both VPN owners check the link-connection setting and expected route advertisements before the change. Do not assume that a working translated application flow demonstrates the BGP peering configuration is correct. Review the full source for ingress, egress and route-translation settings.\nVerification\nIn an approved test connection, inspect the deployed NAT rules and the configured BGP link address, then verify peering and learned routes. Exercise an intended translated application path and its return traffic separately. Retain the original and translated identities with the observed routes so future address changes do not accidentally move the control-plane peer into the dynamic mapping.\nOfficial references\nMicrosoft Learn: Configure VPN NAT rules for your gateway. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:34+00:00", "dateModified": "2026-09-10T01:23:48+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-262-keep-a-virtual-wan-bgp-peer-out-of-dynamic-nat-mappings/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep a Virtual WAN BGP peer out of dynamic NAT mappings" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure VPN NAT rules for your gateway - Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway" } } ] } }