{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "slug": "dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route", "url": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/" }, "title": "Preserve Route Server BGP communication when inserting a firewall route", "summary": "An inspection route can unintentionally divert the control-plane traffic needed by the gateway or peered appliance.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:06+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 239, "potentially_affected": "Azure Route Server deployments with inspection UDRs on GatewaySubnet or a BGP-peered NVA subnet.", "dse_recommendation": "Review the RouteServerSubnet path separately from workload inspection before associating the route table.", "primary_source": { "name": "Troubleshoot Azure Route Server issues | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/troubleshoot-route-server", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that a GatewaySubnet route intended to send on-premises traffic through a firewall can also divert BGP communication between the gateway and Route Server. This occurs when the inspection route covers traffic destined for the Route Server virtual network.

\n

The same concern applies to an SD-WAN appliance subnet peered with Route Server. Microsoft’s documented exception uses the actual RouteServerSubnet prefix with VirtualNetwork as next hop, rather than sending that control-plane path through the firewall. Microsoft Learn.

\n

Applicability

\n

Identify the gateway or appliance subnet, RouteServerSubnet range and proposed inspection route. Use the deployment’s actual addresses; the documentation’s example ranges are not configuration values for another network.

\n

DSE recommendation

\n

DSE recommends drawing the BGP path separately from the workload path during route review. Decide how the control-plane session remains reachable before associating the inspection table. Review any exception with both routing and security owners so it is neither an accidental bypass nor an omitted dependency. Retain the previous route table and the agreed recovery trigger.

\n

Verification

\n

During an approved test, confirm BGP adjacency and route learning as well as the intended inspected application connection. Compare the actual next hops with the reviewed paths. If workload forwarding changes while the control plane fails, stop and investigate before continuing the rollout. Record both outcomes; a successful firewall rule test alone does not establish that Route Server peering survived.

\n

Official references

\n

Microsoft Learn: Troubleshoot Azure Route Server issues. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft documents that a GatewaySubnet route intended to send on-premises traffic through a firewall can also divert BGP communication between the gateway and Route Server. This occurs when the inspection route covers traffic destined for the Route Server virtual network.\nThe same concern applies to an SD-WAN appliance subnet peered with Route Server. Microsoft’s documented exception uses the actual RouteServerSubnet prefix with VirtualNetwork as next hop, rather than sending that control-plane path through the firewall. Microsoft Learn.\nApplicability\nIdentify the gateway or appliance subnet, RouteServerSubnet range and proposed inspection route. Use the deployment’s actual addresses; the documentation’s example ranges are not configuration values for another network.\nDSE recommendation\nDSE recommends drawing the BGP path separately from the workload path during route review. Decide how the control-plane session remains reachable before associating the inspection table. Review any exception with both routing and security owners so it is neither an accidental bypass nor an omitted dependency. Retain the previous route table and the agreed recovery trigger.\nVerification\nDuring an approved test, confirm BGP adjacency and route learning as well as the intended inspected application connection. Compare the actual next hops with the reviewed paths. If workload forwarding changes while the control plane fails, stop and investigate before continuing the rollout. Record both outcomes; a successful firewall rule test alone does not establish that Route Server peering survived.\nOfficial references\nMicrosoft Learn: Troubleshoot Azure Route Server issues. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents that a GatewaySubnet route intended to send on-premises traffic through a firewall can also divert BGP communication between the gateway and Route Server. This occurs when the inspection route covers traffic destined for the Route Server virtual network.\n\nThe same concern applies to an SD-WAN appliance subnet peered with Route Server. Microsoft’s documented exception uses the actual RouteServerSubnet prefix with VirtualNetwork as next hop, rather than sending that control-plane path through the firewall. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/troubleshoot-route-server).\n\n## Applicability\n\nIdentify the gateway or appliance subnet, RouteServerSubnet range and proposed inspection route. Use the deployment’s actual addresses; the documentation’s example ranges are not configuration values for another network.\n\n## DSE recommendation\n\nDSE recommends drawing the BGP path separately from the workload path during route review. Decide how the control-plane session remains reachable before associating the inspection table. Review any exception with both routing and security owners so it is neither an accidental bypass nor an omitted dependency. Retain the previous route table and the agreed recovery trigger.\n\n## Verification\n\nDuring an approved test, confirm BGP adjacency and route learning as well as the intended inspected application connection. Compare the actual next hops with the reviewed paths. If workload forwarding changes while the control plane fails, stop and investigate before continuing the rollout. Record both outcomes; a successful firewall rule test alone does not establish that Route Server peering survived.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot Azure Route Server issues](https://learn.microsoft.com/en-us/azure/route-server/troubleshoot-route-server). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "url": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve Route Server BGP communication when inserting a firewall route", "item": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "url": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/", "headline": "Preserve Route Server BGP communication when inserting a firewall route", "description": "An inspection route can unintentionally divert the control-plane traffic needed by the gateway or peered appliance.", "abstract": "An inspection route can unintentionally divert the control-plane traffic needed by the gateway or peered appliance.", "articleBody": "Source facts\nMicrosoft documents that a GatewaySubnet route intended to send on-premises traffic through a firewall can also divert BGP communication between the gateway and Route Server. This occurs when the inspection route covers traffic destined for the Route Server virtual network.\nThe same concern applies to an SD-WAN appliance subnet peered with Route Server. Microsoft’s documented exception uses the actual RouteServerSubnet prefix with VirtualNetwork as next hop, rather than sending that control-plane path through the firewall. Microsoft Learn.\nApplicability\nIdentify the gateway or appliance subnet, RouteServerSubnet range and proposed inspection route. Use the deployment’s actual addresses; the documentation’s example ranges are not configuration values for another network.\nDSE recommendation\nDSE recommends drawing the BGP path separately from the workload path during route review. Decide how the control-plane session remains reachable before associating the inspection table. Review any exception with both routing and security owners so it is neither an accidental bypass nor an omitted dependency. Retain the previous route table and the agreed recovery trigger.\nVerification\nDuring an approved test, confirm BGP adjacency and route learning as well as the intended inspected application connection. Compare the actual next hops with the reviewed paths. If workload forwarding changes while the control plane fails, stop and investigate before continuing the rollout. Record both outcomes; a successful firewall rule test alone does not establish that Route Server peering survived.\nOfficial references\nMicrosoft Learn: Troubleshoot Azure Route Server issues. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:06+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-290-preserve-route-server-bgp-communication-when-inserting-a-firewall-route/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve Route Server BGP communication when inserting a firewall route" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot Azure Route Server issues | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/troubleshoot-route-server" } } ] } }