{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "slug": "dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes", "url": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/" }, "title": "Do not assume Route Server VPN preference excludes NVA routes", "summary": "The VPN preference groups VPN gateway and NVA routes together and compares their AS paths for the same destination.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:07+00:00", "modified_at": "2026-09-10T02:11:18+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Azure Route Server hybrid designs receiving matching prefixes from VPN gateways, NVAs and ExpressRoute.", "dse_recommendation": "Compare the VPN and NVA advertisements together before selecting the routing preference.", "primary_source": { "name": "Routing preference with Azure Route Server - Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/hub-routing-preference", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Route Server’s VPN preference prioritizes routes from VPN gateways and NVAs over ExpressRoute routes. It does not distinguish the VPN gateway from the NVA: when both advertise the same route, the shorter BGP AS path is selected.

\n

ExpressRoute preference is the default and prioritizes ExpressRoute routes. AS Path preference instead compares path length regardless of the route’s source. Microsoft Learn.

\n

Applicability

\n

Inventory advertisements for the same destination prefix from each participating source. Do not infer the selected next hop solely from the preference label or from one peer’s established session.

\n

DSE recommendation

\n

DSE recommends documenting the desired primary and fallback route for each important prefix before changing preference. Compare actual VPN and NVA AS paths and coordinate any approved path manipulation with their owners. Avoid a broad preference change intended to fix one prefix without reviewing other overlapping advertisements.

\n

Verification

\n

Inspect learned and selected routes for representative prefixes, then exercise approved failure and recovery scenarios. Confirm the actual next hop matches the intended design while the relevant peers are available and after restoration. Retain advertisements, preference and traffic observations together. An established VPN session is not sufficient evidence that its route wins over an NVA.

\n

Official references

\n

Microsoft Learn: Routing preference with Azure Route Server. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure Route Server’s VPN preference prioritizes routes from VPN gateways and NVAs over ExpressRoute routes. It does not distinguish the VPN gateway from the NVA: when both advertise the same route, the shorter BGP AS path is selected.\nExpressRoute preference is the default and prioritizes ExpressRoute routes. AS Path preference instead compares path length regardless of the route’s source. Microsoft Learn.\nApplicability\nInventory advertisements for the same destination prefix from each participating source. Do not infer the selected next hop solely from the preference label or from one peer’s established session.\nDSE recommendation\nDSE recommends documenting the desired primary and fallback route for each important prefix before changing preference. Compare actual VPN and NVA AS paths and coordinate any approved path manipulation with their owners. Avoid a broad preference change intended to fix one prefix without reviewing other overlapping advertisements.\nVerification\nInspect learned and selected routes for representative prefixes, then exercise approved failure and recovery scenarios. Confirm the actual next hop matches the intended design while the relevant peers are available and after restoration. Retain advertisements, preference and traffic observations together. An established VPN session is not sufficient evidence that its route wins over an NVA.\nOfficial references\nMicrosoft Learn: Routing preference with Azure Route Server. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Route Server’s VPN preference prioritizes routes from VPN gateways and NVAs over ExpressRoute routes. It does not distinguish the VPN gateway from the NVA: when both advertise the same route, the shorter BGP AS path is selected.\n\nExpressRoute preference is the default and prioritizes ExpressRoute routes. AS Path preference instead compares path length regardless of the route’s source. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/hub-routing-preference).\n\n## Applicability\n\nInventory advertisements for the same destination prefix from each participating source. Do not infer the selected next hop solely from the preference label or from one peer’s established session.\n\n## DSE recommendation\n\nDSE recommends documenting the desired primary and fallback route for each important prefix before changing preference. Compare actual VPN and NVA AS paths and coordinate any approved path manipulation with their owners. Avoid a broad preference change intended to fix one prefix without reviewing other overlapping advertisements.\n\n## Verification\n\nInspect learned and selected routes for representative prefixes, then exercise approved failure and recovery scenarios. Confirm the actual next hop matches the intended design while the relevant peers are available and after restoration. Retain advertisements, preference and traffic observations together. An established VPN session is not sufficient evidence that its route wins over an NVA.\n\n## Official references\n\n[Microsoft Learn: Routing preference with Azure Route Server](https://learn.microsoft.com/en-us/azure/route-server/hub-routing-preference). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "url": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not assume Route Server VPN preference excludes NVA routes", "item": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "url": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/", "headline": "Do not assume Route Server VPN preference excludes NVA routes", "description": "The VPN preference groups VPN gateway and NVA routes together and compares their AS paths for the same destination.", "abstract": "The VPN preference groups VPN gateway and NVA routes together and compares their AS paths for the same destination.", "articleBody": "Source facts\nAzure Route Server’s VPN preference prioritizes routes from VPN gateways and NVAs over ExpressRoute routes. It does not distinguish the VPN gateway from the NVA: when both advertise the same route, the shorter BGP AS path is selected.\nExpressRoute preference is the default and prioritizes ExpressRoute routes. AS Path preference instead compares path length regardless of the route’s source. Microsoft Learn.\nApplicability\nInventory advertisements for the same destination prefix from each participating source. Do not infer the selected next hop solely from the preference label or from one peer’s established session.\nDSE recommendation\nDSE recommends documenting the desired primary and fallback route for each important prefix before changing preference. Compare actual VPN and NVA AS paths and coordinate any approved path manipulation with their owners. Avoid a broad preference change intended to fix one prefix without reviewing other overlapping advertisements.\nVerification\nInspect learned and selected routes for representative prefixes, then exercise approved failure and recovery scenarios. Confirm the actual next hop matches the intended design while the relevant peers are available and after restoration. Retain advertisements, preference and traffic observations together. An established VPN session is not sufficient evidence that its route wins over an NVA.\nOfficial references\nMicrosoft Learn: Routing preference with Azure Route Server. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:07+00:00", "dateModified": "2026-09-10T02:11:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-529-do-not-assume-route-server-vpn-preference-excludes-nva-routes/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not assume Route Server VPN preference excludes NVA routes" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Routing preference with Azure Route Server - Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/hub-routing-preference" } } ] } }